files folders and icons missing windows 7

tft2595 · Oct 26, 2012

I just recently got my laptop to boot windows after working with the information from this forum. yet, i still have issues where icons are missing from my desktop and start menu. files and folders are completely empty or missing. I also cannot access number of program files because they are locked and i apparently don't have permission to access them. If you guys could help me i would greatly appreciate it. thank you

chaslang · Oct 26, 2012

Welcome to Major Geeks!

It looks like you may have run some kind of temporary file disk cleaner or may have done manual cleaning. If that is the case, the below Unhide.exe program may not be able to fix missing items.

Please download and save the below to your Desktop or anywhere else you can find it ( if the Desktop is not showing )

http://download.bleepingcomputer.com/grinler/unhide.exe

Now run it ( if you are running Vista or Win 7, use right click and select Run As Administrator ). Did that help with your missing items?

Now rerun Hitman Pro and allow it to fix all those items it found. Then reboot immediately.

After reboot, Rerun RogueKiller and run a scan. After it finishes the scan, select the Registry tab and then select any of the below that still exist and then click the Delete button.

[RUN][SUSP PATH] HKUS\.DEFAULT[...]\Run : lJfRcBDsdsQNy.exe (C:\ProgramData\lJfRcBDsdsQNy.exe) -> FOUND
[RUN][SUSP PATH] HKUS\S-1-5-18[...]\Run : lJfRcBDsdsQNy.exe (C:\ProgramData\lJfRcBDsdsQNy.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : volmgr (C:\Windows\system32\config\systemprofile\AppData\Local\volmgr.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : g5Dzj9WaSl8p1rU8234A (C:\Users\Will\AppData\Roaming\Aa2tY7otqQ2x\VI9dncVLn0tT6bc.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : RENGgU0aqcp8234A (C:\Users\Will\AppData\Roaming\pbj1gc7logt4\kIiskiLlD7U.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : qunJYBaqt2HK8234A (C:\Users\Will\AppData\Roaming\Yp7w0GLUiHqzpYP\TdBG9rbKr.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : nJuUKpxC7pcI8234A (C:\Users\Will\AppData\Roaming\bchaBK2lKik\Z4xgFBRpAqHcYs1.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : kLrvLOn9DRS8234A (C:\Users\Will\AppData\Roaming\NGZBvG8CxLcg1qP\riQj16Uv8O5YcsV.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : WOnZPHwo9bq0Hjx8234A (C:\Users\Will\AppData\Roaming\QbJ9BSXbj4w15Z\OD7VDEe2RyQe2LN.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : RL63Pk8p1IC7pu8234A (C:\Users\Will\AppData\Roaming\flZHvtwRQDNZ5\kl9HbtYJozt.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : J5eF90fxJ8234A (C:\Users\Will\AppData\Roaming\WEOngt4huWB3guE\QCS8BFL0KImCaq0.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : kGvrCE5pFSN8234A (C:\Users\Will\AppData\Roaming\N9JvO9axZsAwsxh\J6iU7iUUfGxCfFi.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : kKGvrk8WHpoxjs18234A (C:\Users\Will\AppData\Roaming\N9JvO9axZsAwsxh\J6iU7iUUfGxCfFi.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : bUUXjgd5spSIeZC8234A (C:\Users\Will\AppData\Roaming\dhjkqTg8EW79Zhw\RwUBASi21PBVrOO.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : iUUXjgd5spSIeZC8234A (C:\Users\Will\AppData\Roaming\dhjkqTg8EW79Zhw\RwUBASi21PBVrOO.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : keVOxAc23GWjw08234A (C:\Users\Will\AppData\Roaming\mBPcD45KRhwCI\meBOxu2Fn56Wf9T.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : txAc23GWqw0ci3n8234A (C:\Users\Will\AppData\Roaming\v7EgReO028R9wVB\BRhwCIzyAvFmad8.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : P2HdUNbhP2G8234A (C:\Users\Will\AppData\Roaming\jc23GWqwPci3na6\REgqYUOyn5dZkB.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : O5UDKlo8OaX268234A (C:\Users\Will\AppData\Roaming\J7qcHZzpg\G1GCAQzp9x6k3Zy.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : Vy5jDKlo8OaX26j8234A (C:\Users\Will\AppData\Roaming\NKTwto7qcHZzpg\G1GCAQzp9x6k3Zy.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : GHdKRTYINAc2baH8234A (C:\Users\Will\AppData\Roaming\XLwxD68Ucn\NS3asETCO0ioHTw.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : xXNmXxQquKVsU3L8234A (C:\Users\Will\AppData\Roaming\oXIAbQ7ZVxD\jTN37wSa8lDsI.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : TkvQg0LrnhP4gt48234A (C:\Users\Will\AppData\Roaming\LDsZrbsZlimZzFd\HePuFQ8Tlx3.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : csZIv5ZlJj278234A (C:\Users\Will\AppData\Roaming\zx2mdLCyiQ\btiHTr1H8rSa8e.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : ov5fCAnEISmZOD8234A (C:\Users\Will\AppData\Roaming\D6gkxD69kxDH8wx\TH8kcHgUvG8wNod.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : F1Y5xO9aP8234A (C:\Users\Will\AppData\Roaming\Gzb7kbLcOW0UQAR\pcwsxZitfFrX6SU.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : l2fzGZPmCcWU28B8234A (C:\Users\Will\AppData\Roaming\dTxaqcQV2EloTvL\y6Yc6C17ln9cdI3.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : bXu6eSde2KIbfl38234A (C:\Users\Will\AppData\Roaming\VFRz49yGTxaX\yQYSWlFRcdebZN.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : G9hXXwjVIt8234A (C:\Users\Will\AppData\Roaming\hioFHsJE8gZYXkV\xBzP01ivFmHQ7Kg.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : dgXjeVztAc2DQYx8234A (C:\Users\Will\AppData\Roaming\zx0i3GaHsJLgYUB\rySv3naHsJE8RYB.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : Ew0osZBFLevdlFe8234A (C:\Users\Will\AppData\Roaming\zx0i3GaHsJLgYUB\rySv3naHsJE8RYB.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : HzR1WB3Rr39NaY8234A (C:\Users\Will\AppData\Roaming\bHZVcagtH8YIyo\G0G7XIx2GWjS6yY.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : gfzGgOnTxHwiEzQ8234A (C:\Users\Will\AppData\Roaming\bHZVcagtH8YIyo\Bjr0DQfV3EoBEvj.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : QgCVtunWqruDH7g8234A (C:\Users\Will\AppData\Roaming\neIzNx1SoFpGaJd\phXXUeBzxvbG.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : HkvKk2HYxmZ8234A (C:\Users\Will\AppData\Roaming\ytbdwNoJhrv\DafwxvHRV1sXyFd.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : tp5QdKgZhXjVI8234A (C:\Users\Will\AppData\Roaming\EySi3FaHs7\T8RqXkeOz.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : KBupWTkOAiafXVA8234A (C:\Users\Will\AppData\Roaming\AUz1FQK9jkNvpQK\rBPyAi2n4Hs7EgZ.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : zTVu36LYrPv4Wgw8234A (C:\Users\Will\AppData\Roaming\VoGKTrvpd\lBu36gexi4WgI0o.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : zNo6hrvQLe8234A (C:\Users\Will\AppData\Roaming\OLI1HTlFZBn8z4K\KAmKqzvaRkuGKql.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : hlt01DoFpQ7E8234A (C:\Users\Will\AppData\Roaming\ebGW7EgZYwV\rPc1v3a5W7E8Zhw.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : tua9k0GEYumqBD58234A (C:\Users\Will\AppData\Roaming\AtpfwP4Lk\b4EwcnJYPmZzoW.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : PYUlBz0ciDoFp58234A (C:\Users\Will\AppData\Roaming\fd9TjCkVOtAuipH\kETqYkVlNxDo4m6.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : rS3aWETCO8234A (C:\Users\Will\AppData\Roaming\IK9jIN1oGJ9jINv\Q56fhCBN05dLqkz.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : ZgYVNubnmWLTqYw8234A (C:\Users\Will\AppData\Roaming\sbpGa6W7LgX\RezxuinQ6W7.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : r1v2FGQ6WfLhXUe8234A (C:\Users\Will\AppData\Roaming\gdE8ZXUeIzNAu2b\g5Q6EfZhXjeIrP.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : KJ89VBN1Do45JKh8234A (C:\Users\Will\AppData\Roaming\Pn4678hCUrOtPyv\En4HJLRhwUlzcvF.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : XzzzOAipHW7R9Tj8234A (C:\Users\Will\AppData\Roaming\RxAA11uvS2ob3p\EGGG6ddWK8RhqUe.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : jSo5gYUltP8234A (C:\Users\Will\AppData\Roaming\azyyxvi6grS46W7\eEELL9gTZqjGWLZ.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : Cs7EZYwlNy1vbGQ8234A (C:\Users\Will\AppData\Roaming\k5dgXBcv4d9jlPb\h9e0QfXerAiGQsE.exe) -> FOUND
[RUN][SUSP PATH] HKLM\[...]\Wow6432Node\Run : uubXBvbGQ8hUBzN8234A (C:\Users\Will\AppData\Roaming\hellIIBtzPyA\ZpJEZXl1pKTCO02.exe) -> FOUND
[TASK][SUSP PATH] {0F468204-DA7D-4EED-A53F-DBF9212B5E87} : C:\Windows\system32\pcalua.exe -a "C:\Users\Will\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZMWZ140O\OPAL_066F_855D_8560_0_1720_B[1].exe" -d C:\Users\Will\Desktop -> FOUND
[TASK][SUSP PATH] {4ABEFB70-E2A3-4C75-8108-309F8250ACAF} : C:\Windows\system32\pcalua.exe -a "C:\Users\Will\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\371O11SU\CA2010Install[1].exe" -d C:\Users\Will\Desktop -> FOUND
[TASK][SUSP PATH] {BB8E159B-9354-4A42-A44D-12C73F9CE797} : C:\Windows\system32\pcalua.exe -a C:\Users\Will\Desktop\OPAL_066F_855D_8560_0_1720_B.exe -d C:\Users\Will\Desktop -> FOUND
Click to expand...

Then immediately reboot your PC.

After reboot, run a new scan with RogueKiller and save a log as in original instructions. Do the same with Hitman Pro.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

the new Hitman log

the new RogueKiller log

C:\MGlogs.zip

tft2595 · Oct 27, 2012

the unhide.exe brought folders back but no programs inside the folders hopefully I haven't lost them but I may have. I noticed there are locks on some folders such as my system restore folder. I ran those programs as asked and here are my logs.

chaslang · Oct 27, 2012

tft2595 said: ↑

the unhide.exe brought folders back but no programs inside the folders hopefully I haven't lost them but I may have.
Click to expand...

Did you run any disk cleaning programs prior to being able to run unhide?

tft2595 said: ↑

I noticed there are locks on some folders such as my system restore folder.
Click to expand...

It is supposed to be locked. It is a special system folder.

Your logs look good now. Are you having any problems other than the missing icons?

tft2595 · Oct 28, 2012

Yea I downloaded norton anti-virus because i didnt have it when i got my system back up and wasnt thinking. I ran a scan. everything on my system besides the folders being empty. thank you so much for the help I'm just sorry i ran that antivirus.

chaslang · Oct 28, 2012

Maybe there are some settings/folders that you can copy from the Mcx1 user account to get certain things back.

Like the equivalent of the below folders from your account which are empty.

C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu

C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs

C:\Users\Will\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Also Grinler ( the creator of unhide.exe ) has the below link which gives info on restoring some system defaults when the unhide program
cannot find backups. Scroll down in the link:

http://www.bleepingcomputer.com/forums/topic405109.html

Log in or Sign up

files folders and icons missing windows 7

tft2595 Private E-2

Attached Files:

MGlogs.zip

HitmanPro_20121025_1620.log

mbam-log-2012-10-25 (23-40-17).zip

RKreport[1].txt

TDSSKiller.2.8.13.0_25.10.2012_16.05.12_log.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tft2595 Private E-2

Attached Files:

HitmanPro_20121027_1245.log

RKreport[4].txt

MGlogs.zip

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

tft2595 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member