start menu programs gone, no restore

henriksonj · Mar 26, 2013

My sons computer was attacked by a virus/malware.. his start menu programs are all gone, and his system restore had no restore points when I tried to use it to set the computer back. the only thing I saw from a scan were some java exploits that MS security essentials had quarantined. (He did however attempt to run some repair tools himself I'm going to attach the log files as per the instructions in hopes that someone might see something to fix the problem.
Many thanks!
John H.
ps i can't find the log file for the hitman pro scan - so I'm redoing it and posting it in the next post, as I dont' want this post to time out as I try to run it. thanks and sorry for the extra post. John H.

henriksonj · Mar 26, 2013

I was unable to get hitman pro to produce a log file - it said no threat found.. I did however run a windows sfc scan and attached the results to this message..

henriksonj · Mar 26, 2013

Oh I"m also unable to pin to the task bar now on this machine.

chaslang · Mar 31, 2013

It does not look like you are having malware problems. Looks like someone messed up Windows. On a quicklook, I see a couple important environment variables that are missing like the below:

APPDATA=C:\Users\Andrew\AppData\Roaming
LOCALAPPDATA=C:\Andrew\charlie\AppData\Local

Not sure if the below will work or cure all issues, but let's see what happens.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData"="C:\\Users\\Andrew\\AppData\\Local"
"My Video"="C:\\Users\\Andrew\\Videos"
"AppData"="C:\\Users\\Andrew\\AppData\\Roaming"
"My Pictures"="C:\\Users\\Andrew\\Pictures"
"Desktop"="C:\\Users\\Andrew\\Desktop"
"History"="C:\\Users\\Andrew\\AppData\\Local\\Microsoft\\Windows\\History"
"NetHood"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts"
"Cookies"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Cookies"
"Favorites"="C:\\Users\\Andrew\\Favorites"
"SendTo"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\SendTo"
"Start Menu"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
"My Music"="C:\\Users\\Andrew\\Music"
"Programs"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs"
"Recent"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Recent"
"CD Burning"="C:\\Users\\Andrew\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn"
"PrintHood"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts"
"Startup"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup"
"Personal"="C:\\Users\\Andrew\\Documents"
"Cache"="C:\\Users\\Andrew\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files"
"Templates"="C:\\Users\\Andrew\\AppData\\Roaming\\Microsoft\\Windows\\Templates"
"Fonts"="C:\\Windows\\Fonts"

Click to expand...

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now reboot your PC.
After reboot, run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below log:

C:\MGlogs.zip

Make sure you tell me how things are working now!

Log in or Sign up

start menu programs gone, no restore

henriksonj Private E-2

Attached Files:

RKreport[1]_S_03252013_02d2253.txt

mbam-log-2013-03-26 (08-10-49).txt

TDSSKiller.2.8.16.0_25.03.2013_23.03.03_log.txt

MGlogs.zip

henriksonj Private E-2

Attached Files:

CBS.zip

henriksonj Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member