Most files from Program Files disppeared

[truCido]

I'm not sure when this happened however I went to launch a program the other day and I got the:

 

"The item x.exe that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly. Do you want to delete this shortcut?"

 

This has happened for nearly all programs apart from things like chrome for some reason. I've had a look in Program Files directory and sure enough most things have disappeared.

 

I'm running on Windows XP SP3. Can anyone help please?

[truCido]

If you look at the installed programs in the attached log. They aren't in Program Files anymore. I've ran malwarebytes (after re-installing) and it didn't find anything

 

 

FRST.txt

Addition.txt

[AdvancedSetup]

Please go into Control Panel, Add/Remove and uninstall ALL versions of Java and then run the following
 
Please download JavaRa-1.16 and save it to your computer.

• Double click to open the zip file and then select all and choose Copy.
• Create a new folder on your Desktop named RemoveJava and paste the files into this new folder.
• Quit all browsers and other running applications.
• Right-click on JavaRa.exe in RemoveJava folder and choose Run as administrator to start the program.
• From the drop-down menu, choose English and click on Select.
• JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
• Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
• A logfile will pop up. Please save it to a convenient location and post it in your next reply.

 

 

 

Then run the following
 
Please visit this webpage and read the ComboFix User's Guide:

• Once you've read the article and are ready to use the program you can download it directly from the link below.
• Important! - Please make sure you save combofix to your desktop and do not run it from your browser
• Direct download link for: ComboFix.exe
• Please make sure you disable your security applications before running ComboFix.
• Once Combofix has completed it will produce and open a log file.  Please be patient as it can take some time to load.
• Please attach that log file to your next reply.
• If needed the file can be located here:  C:\combofix.txt
• NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

[truCido]

Thanks for the reply Advanced. I've ran JavaRa and attached JavaRa. I'll do ComboFix now.

JavaRa.log

[truCido]

And ComboFix log attached!

log.txt

[AdvancedSetup]

Why do you have a proxy set on the computer?

 

proxy.utest.com:9999

 

Please restart the computer and let me know if you're able to see folders under C:\Program Files folder now.

[truCido]

Ah thats for some testing that I do. It's not an issue,I just forget to remove it after my last test cycle

[truCido]

I've just restarted and no nothing has come back

[truCido]

Actually I take that back. A few folders have appeared, but there all empty

[AdvancedSetup]

Well it's should just be a setting. As the computer would not start if the Program Files folder was missing.

 

Please follow this article and enable showing all hidden files, folders, and extensions please and then let me know

 

 

 

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

 

Thanks

[truCido]

Sorry I didn't say the Programs folder had disappeared. I said most things in Program Files had disappeared. I've tried enabling all that but nothing else has appeared.

[AdvancedSetup]

Well still not certain what it is that you're meaning then. Can you take a screen shot of what you're seeing and then explain what you think it looked like before? Just not sure what you're issue is. Are programs not there and don't run anymore or ??

[truCido]

Exactly. I had loads of programs installed, started up my computer one day and went to use a bit of software and got shortcut not found when trying to launch from the start menu. Upon further investigation it looks like most folders and programs have been removed. But all the uninstall entries are there in Add/Remove Programs but fail to uninstall (because they seem to have physically gone?) and all the entries are still in the Start Menu. Windows updates  seem to have been removed.

 

It's almost as if a System Restore to a really old state had been applied, apart from I didn't!

 

My Start Menu: http://i246.photobucket.com/albums/gg106/truCido1/start_menu_zpse66c052f.jpg

 

My Program Files: http://i246.photobucket.com/albums/gg106/truCido1/program_files_zps827e07bf.jpg

[AdvancedSetup]

Well it's very likely that you were hit by one of the older infections that actually moved data to the temp folder but somewhere along the way the information to restore it was removed as Combofix and FRST should have seen it in order to restore it but neither one did. At this point in time the best thing to do really is backup your data and reinstall Windows and your applications. You could simply start reinstalling applications but at this point the computer will always be in a semi messed up state without doing a clean install of Windows.

[truCido]

Lovely I haven't been able to find my windows install disc so I guess this is a good excuse for an upgrade!

 

Thanks for your help!

[AdvancedSetup]

Yes, sorry - a hard lesson to learn. Please review this link as there are plenty of good free backup programs once you do get things fixed back up - best to always have an external backup.
 

Backup Software
 
If there is anything else I can help you with please let me know otherwise we'll go ahead and close up here soon.
 
Thanks

[AdvancedSetup]

Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you.