Malware named:
Windows Recovery XP/Vista/7

Do not run any temp cleaners until the shortcuts have been restored.

The malware hides the start menu links in

c:\documents and settings\*Infected User*\Local Settings\TEMP\SNTMP (XP)
C\Users\*Infected User*\AppData\Local\Temp\smtmp (Vista and Win7)

and/or

1 2 4 etc etc

All shortcuts and .lnk's will be listed in there:
1 = Start Menu Program shortcuts
2 = Current User Quick Start shortcuts
4 = All Users Desktop folders and shortcuts

-------------------------------------


Restore directories:

c:\Documents and Settings\All Users\Start Menu (Windows XP)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs (Vista and Win7)

*The All Users desktop folder is C:\Users\Public\Desktop

---

Do not to run any cleaners or virus tools untill you can get the sntmp folder completely out.  Sometimes the folders will be empty. Make sure you run the unhide.exe program after you have stopped the malware from starting up.

1. Log into safe mode with networking (unhook all connections to the internet)
2. First thing you need to do is go into Computer, then tools, folder options, show hidden files and folders, scroll down 3 or 4 lines, uncheck the box that says Hide protected operating system files.
3. Close all windows, go to c:\Documents and Settings\All Users\App Data Scroll toward the bottom there will be files looking like <random>.exe could be 2 could be 1. Depending on which virus you are dealing with. Delete these manually. This will stop the pop ups in normal mode.

4. From there run the unhide.exe in safe mode.

5. Go to C\Users\*Infected User*\AppData\Local\Temp\smtmp

5. 1 2 4 <<< These folders will be listed. ( If these folders are empty after the unhide.exe. Then they are simply not there.

6. Office has a repair function ( ADD/REMOVE Programs ) that will restore the start menu items.

7. When restoring the start menu items, make sure you are in the c\document and settings\all users\start menu and paste there.