[Alexandra D. Porsi]

You know, I started making the last few fixes, and noticed the start menu folders are still empty. Looks like the default folders like the accessories folder are still there, but the rest all say (empty). It's not the end of the world, but is there any way to restore them? Thanks!

[Advertisements]

Not easily. You might look in your C:\Users\alex\AppData\Local\temp folder and see if there is a strange folder created at the same time as your infection. The malware used to move all of the shortcuts to the folder called smtmp but I had OTL look for it and it didn't find it. This may help a bit:

Copy the text in the code box.

'Novi 2011

Option Explicit

Dim objFSO, Shell, Link
Dim objCurrentFolder, objFolder, objNewFolder, objOutput
Dim InputFolderName, TargetFolder, File, Folder
Dim TxtFile
Dim Query
Dim TempFolderName, FinalFolderName, MakeFolder
Dim FileLength, SearchStartPos
Dim FolderLength, DelCharPos

CONST ForAppending = 8

TargetFolder = "\Program Files"

Set objFSO = CreateObject("Scripting.FileSystemObject")

InputFolderName = InputBox("Enter folder name:")
InputFolderName = Trim(InputFolderName)

   If Not objFSO.FolderExists(InputFolderName) Then

      Set MakeFolder = objFSO.CreateFolder(InputFolderName)

   End If

Set Shell = CreateObject("WScript.Shell")

   If objFSO.FileExists("Report.txt") Then
      Set TxtFile = objFSO.OpenTextFile("Report.txt", ForAppending)
      Else Set TxtFile = objFSO.CreateTextFile("Report.txt", True)
   End If

   CheckFolder(objFSO.GetFolder(TargetFolder)), TxtFile

   TxtFile.Close

Query = MsgBox("The script has completed.", vbOKOnly + vbInformation, "That's All Folks!")

WScript.Quit

Sub CheckFolder(objCurrentFolder, objOutput)

      On Error Resume Next

      FolderLength = Len(objCurrentFolder)
      DelCharPos = FolderLength - 17
      TempFolderName = Right(objCurrentFolder, DelCharPos)
      FinalFolderName =  InputFolderName & "\" & TempFolderName
      
      If Not objFSO.FolderExists(FinalFolderName) Then

         Set MakeFolder = objFSO.CreateFolder(FinalFolderName)

      End If

      For each File in objCurrentFolder.Files

      FileLength = Len(File.Name)

      If FileLength < 5 Then

         FileLength = 5

      End If

      SearchStartPos = FileLength - 4

      If InStr(SearchStartPos, File.Name, ".exe", 1) > 0 Then

         TxtFile.WriteLine File.Path
         
         Set Link = Shell.CreateShortcut(FinalFolderName & "\" & File.Name & ".lnk")
         Link.TargetPath = File.Path
         Link.WindowStyle = 3
         Link.Save

      End If   

      Next

      For Each objNewFolder in ObjCurrentFolder.SubFolders

         CheckFolder objNewFolder, objOutput     

      Next

End Sub

Start, Run, notepad, OK

Ctrl + v or Edit, Paste and the text should appear. File, Save As, to your desktop, "fix.vbs" OK (Make sure you include the quotation marks or it will tack on a .txt which won't work.)

Right click on the fix.vbs and Open with Command Prompt (or Run As Admin if you have the option). It will ask you for a folder name. Call it junk. It will take about 5 minutes or so to finish and there will be a little box to tell you that it has finished. Once it finishes you can open junk and look inside. There will be a folder for each folder in Program Files. Inside will be shortcuts for each .exe in the corresponding folder in Program Files. These folders can all be copied to
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\

This should repopulate the Start, (All) Programs section for all users.

[RKinner]

Not easily. You might look in your C:\Users\alex\AppData\Local\temp folder and see if there is a strange folder created at the same time as your infection. The malware used to move all of the shortcuts to the folder called smtmp but I had OTL look for it and it didn't find it. This may help a bit:

Copy the text in the code box.

'Novi 2011

Option Explicit

Dim objFSO, Shell, Link
Dim objCurrentFolder, objFolder, objNewFolder, objOutput
Dim InputFolderName, TargetFolder, File, Folder
Dim TxtFile
Dim Query
Dim TempFolderName, FinalFolderName, MakeFolder
Dim FileLength, SearchStartPos
Dim FolderLength, DelCharPos

CONST ForAppending = 8

TargetFolder = "\Program Files"

Set objFSO = CreateObject("Scripting.FileSystemObject")

InputFolderName = InputBox("Enter folder name:")
InputFolderName = Trim(InputFolderName)

   If Not objFSO.FolderExists(InputFolderName) Then

      Set MakeFolder = objFSO.CreateFolder(InputFolderName)

   End If

Set Shell = CreateObject("WScript.Shell")

   If objFSO.FileExists("Report.txt") Then
      Set TxtFile = objFSO.OpenTextFile("Report.txt", ForAppending)
      Else Set TxtFile = objFSO.CreateTextFile("Report.txt", True)
   End If

   CheckFolder(objFSO.GetFolder(TargetFolder)), TxtFile

   TxtFile.Close

Query = MsgBox("The script has completed.", vbOKOnly + vbInformation, "That's All Folks!")

WScript.Quit

Sub CheckFolder(objCurrentFolder, objOutput)

      On Error Resume Next

      FolderLength = Len(objCurrentFolder)
      DelCharPos = FolderLength - 17
      TempFolderName = Right(objCurrentFolder, DelCharPos)
      FinalFolderName =  InputFolderName & "\" & TempFolderName
      
      If Not objFSO.FolderExists(FinalFolderName) Then

         Set MakeFolder = objFSO.CreateFolder(FinalFolderName)

      End If

      For each File in objCurrentFolder.Files

      FileLength = Len(File.Name)

      If FileLength < 5 Then

         FileLength = 5

      End If

      SearchStartPos = FileLength - 4

      If InStr(SearchStartPos, File.Name, ".exe", 1) > 0 Then

         TxtFile.WriteLine File.Path
         
         Set Link = Shell.CreateShortcut(FinalFolderName & "\" & File.Name & ".lnk")
         Link.TargetPath = File.Path
         Link.WindowStyle = 3
         Link.Save

      End If   

      Next

      For Each objNewFolder in ObjCurrentFolder.SubFolders

         CheckFolder objNewFolder, objOutput     

      Next

End Sub

Start, Run, notepad, OK

Ctrl + v or Edit, Paste and the text should appear. File, Save As, to your desktop, "fix.vbs" OK (Make sure you include the quotation marks or it will tack on a .txt which won't work.)

Right click on the fix.vbs and Open with Command Prompt (or Run As Admin if you have the option). It will ask you for a folder name. Call it junk. It will take about 5 minutes or so to finish and there will be a little box to tell you that it has finished. Once it finishes you can open junk and look inside. There will be a folder for each folder in Program Files. Inside will be shortcuts for each .exe in the corresponding folder in Program Files. These folders can all be copied to
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\

This should repopulate the Start, (All) Programs section for all users.

[Alexandra D. Porsi]

Thanks so much for your help!!!!