Nowadays there are many rogue programs over the Internet (like Smart HDD) that hide the majority of files, folders and other data on the infected system. The desktop turns out to be entirely empty (black of blank). There are no quick launch items, shortcuts and icons on it anymore. The list of programs in the Start menu also disappears, except for the files having to do with the particular rogue program. These amendments are initiated by the malware for the purpose of scaring users, and, surely, sometimes this goal is successfully accomplished. The rogue keeps warning users with a lot of untrue information about various system errors, bugs and problems and then offers itself as the solution to fix these issues. However, it will not do anything for free, it first tells you to effect the payment in favor of the frauds that developed it. You should realize that this malicious application is the cause of such problems, including the issue of hidden or missing files. So, it first creates these problems and then tells you to pay for it to have them fixed. Don’t you think this is a really unfair way of making business? Even if the rogue’s full version can somehow restore your files it is not worth buying this scam, because by doing so you’re just wasting your funds for nothing. So, once you encounter this malicious tool on your PC, please do not obey its misleading instructions. Instead, you may follow this simple guide that will help you understand the basic principles of file restoration (recovery) after the attack of malware.
Some users believe that the virus deleted their data once and for all. Well, this is not exactly so. It indeed wiped off the majority of files and folders, even though it created the backup copy of them and located them into the folder known as “smtmp”. You may find more detailed information about it below, including the steps to recover your data effectively. There are some programs over the Internet that are developed to assist you in restoring your files, even though sometimes they aren’t as effective as they claim to be. If this is the case, you must understand where to find your data that was hidden by the rogue. So, here is the guide we’ve developed to assist you in this matter. First of all, make sure to completely remove the virus from your PC with reliable security software. Finally, below is the guide you need to recover your files and other data that you cherish so much.
Steps to restore missing data:
The first thing we need to implement is to make sure we see all our hidden files and folders, because the virus sets this hidden attribute for the files it relocated to smtmp folder. Running legitimate anti-virus applications would not remove this hidden attribute, so here is what we need to perform depending on the type of our operating system:
How to view hidden files in Windows XP:
- Open “My Computer”, go to “Tools” tab and select “Folder Options”.
- In the window that appeared select “View” tab and choose the option “Show hidden files and folders”. Click “Apply” and “OK”.
XP folder options
Show hidden files in XP
How to view hidden files in Windows Vista/7:
- Open “My Computer”, go to “Organize” tab and select “Folder and search options”.
- In the window that appeared select “View” tab and choose the option “Show hidden files, folders, and drives”. Click “Apply” and “OK”.
Windows Vista / 7 folder and search options
Windows Vista / 7 show hidden files
Our next step is to find smtmp folder and move all files from it to their proper and respective destinations. The location of smtmp folder is in %Temp%. Keep in mind that %Temp% stands for the Windows Temp folder. By default, it has the location C:\Windows\Temp for Windows 95/98/ME, C:\DOCUMENTS AND SETTINGS\Current User\LOCAL SETTINGS\Temp for Windows 2000/XP, and C:\Users\Current User\AppData\Local\Temp for Windows Vista and Windows 7. Below please find the examples of how the destination path for smtmp folder looks like in various operating systems:
Smtmp folder location in Windows XP:
Smtmp in Windows XP
Smtmp folder location in Windows Vista / 7:
Smtmp in Windows Vista / 7
Below please find the list of sub-folders found in smtmp folder and what locations the shortcuts should normally dwell in depending on the version of OS installed on your computer.
%Temp%\smtmp\1:
Windows XP: C:\Documents and Settings\All Users\Start Menu
Windows Vista and Windows 7: C:\ProgramData\Microsoft\Windows\Start Menu%Temp%\smtmp\2\:
Windows XP: C:\Documents and Settings\[your username]\Application Data\Microsoft\Internet Explorer\Quick Launch\
Windows Vista and Windows 7: C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\%Temp%\smtmp\3\:
Windows XP: It does not exist in XP. So, do not worry if you don’t find %Temp%\smtmp\3 on Windows XP.
Windows Vista and Windows 7: C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar%Temp%\smtmp\4\:
Windows XP: C:\Documents and Settings\All Users\Desktop
Windows Vista and Windows 7: C:\Users\Public\Desktop
In order to manually recover your desktop icons, quick launch items and other shortcuts you need to open up each of these sub-folders (from 1 to 4) available on your computer and copy their contents into the relevant folder specified above. Again, this depends on the type of the operating system you have. For example, if you have Windows XP, then you must copy the entire information located in %Temp%\smtmp\2\ to C:\Documents and Settings\[your username]\Application Data\Microsoft\Internet Explorer\Quick Launch\. If you have Windows Vista or 7, you should copy the information from %Temp%\smtmp\2\ to C:\Users\[your username]\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\.
Finally, here is the last but not the least piece of advise for you. If your computer is infected with fake HDD virus do not remove any of the files in this %Temp% folder of your computer. You should not execute any temp file cleaning utilities removing this backup folder. If you or such software applications delete this folder you will not be able to restore the icons and shortcuts back to where they should be.
