How to Retrieve and Show Files Hidden by Virus Thanks to a Simple Trick

Feb

2011

How to Retrieve and Show Files Hidden by Virus Thanks to a Simple Trick

Restore hidden files After recovering your Windows 7 from a virus attack, you might find out that your computer is unable to show some of your files and folders. In fact, they have been hidden by the virus itself! Mind you, they were not deleted but only hidden from view. Before panicking and thinking that all your files and documents were erased,wiped out and lost forever from your computer desktop or laptop, read this guide as it could restore and show back your precious stuff thanks to a simple trick!

In order to get your files and folder back after a computer virus infection follow these easy steps (Windows 7 andVista):

Click Start on your desktop.
On the black Search field, type: cmd and do not press Enter yet.
Right click the CMD icon and click Run as Administrator.
Now, go to the driver which was infected by the virus (C: for example) and enter the following commands: attrib –s –h *.* /S /C
Click Enter to retrieve allyour files!

Tags: hack, Windows 7

Related Tags

how to see hidden files made by recycler
how to retrieve file hidden by virus
access denied in resetting the hidden read only and system files
lost all my bookmarks due to hidden files
my files goes hidden after affected by recycle virus
recovering recycler hidden files

Related ArticlesLatest Articles

10 Comments to “How to Retrieve and Show Files Hidden by Virus Thanks to a Simple Trick”

Gregg DesElms Says:
February 24th, 2011

Hmm. I’m not sure that unhiding — and certainly not “unsysteming” (if that’s even a word… but you get my point) — all system and hidden files on C: is a good idea… at least not using the ATTRIB command the way you’ve set forth.
The “-s” switch is the one most concerning. The “-h” switch simply unhides; and while I can think of some reasons what even that switch should not be run on absolutely every file on the machine, I’m not sure it would hurt much to so do, anyway.
But the “-s” switch… I dunno. That one turns off a system file’s even being a system file anymore. Of course even if the “-s” switch is used on a system file, it continues to perform as one. But files which are designated system files are so designated for a reason. It’s more than just whether or not the file shows-up in Explorer if the “hide system files” checkbox is checked. It can also affect how updates are applied; and how installers/uninstaller delete (or don’t delete) things, and other seemingly unrelated stuff.
Hmm. I’m just not sure about the “-s” switch.
Don’t get me wrong: I’m not trying to poke a hole in this otherwise good tip… but I’m just sayin’. The “-s” switch… I dunno.
I do know this: It would certainly be less worrisome if the command were only run from the top level of the user’s folder, downward. Maybe the Program Files folder… maybe some others… but not the Windows folder. But I dunno. I’d have to research it some; and I’d also need to see just exactly what’s going on on the machine in question.
Still, it’s a perfectly good tip.
Hope that helps.
_________________________________
Gregg DesElms
Napa, California USA
gregg at greggdeselms dot com
Agilang Tamad Says:
March 26th, 2011

@Gregg DesElms
what the “-s” switch does is it removes the “system file” attribute on a file. but this will only apply to files or folders that are NOT a system file by nature. i.e. you’re only supposed to use these commands “attrib -s -h *.*” on personal files/folders that has been hidden by a virus.
I would recommend adding the “-r” switch because some viruses would also change your files/folders to a Read-only & that could cause some problems when editing documents.
Cheers!
Anne Says:
May 30th, 2011

Hey, I *LOVED* this entry! Look, I was hit by this horrid thing that I’ve been working days to recover from. Finally got everything cleared, my Catalyst Control Center finally working fine, only to realize that what I thought had been another symptom wasn’t fixed yet – all the files hidden with a black desktop.
So upon finding your blog, I thought: hey, that’ll do it. Did an attrib/? first just to understand what you were saying. On my Vista Home Premium, there isn’t a /C switch, so I did your suggestion without it. Bingo! Took a couple minutes and it rolled through all the thousands of system files that it didn’t ‘un-systemize’ (for each: Access denied – \file path\file). My desktop icons popped up, all my personal files show up in the Preferred User structure as well as some folders I have directly in the c:\path structure. The only thing I need to redo manually now is the desktop background and put back together my QuickLaunch toolbar. WOW, thanks so much for writing this blog entry! Mmmmmwah! A huge kiss from me!
SaiZo Says:
June 24th, 2011

Note: This does NOT work. I have found too many others with exactly the same thing. This is caused by a virus, yes.
I have still same issue, and that is 19Gb+ of files missing. And this “hokus pokus” act just doesn’t work.
You actually have to create 3 different accounts inorder to get the files back, they are not only hidden, they have infected the account itself!
It’s a copy-paste thing you have to go thru:
http://windows.microsoft.com/en-US/windows7/fix-a-corrupted-user-profile
The virus(es) they keep launching is the same, just altered. First time I was bombed with it , nothing happened, next time this.
I have seen this “trick”, the SHOWALL and NOHIDE trick, the “goto folder settings” trick – none which works.
You aswell, forgot to mention: Use antimalware and then antivirus BEFORE doing anything (not to mention, you must use right click commandshell and use admin rights for it aswell). This does only apply to flashdisks, not HDD’s.
Ralph Says:
July 2nd, 2011

I am totally lost. I had a virus hit my computer and wiped all programs, documents and photos out. Best Buy tech told me to go in a reset date back before the virus hit on backup. Did that and got my programs back but some don’t work. None of my documents or photos appear anywhere. Can’t change my background photo either.
Read this and tried it but nothing happens. The error code says ‘is not recogized…..”
Any ideas or help would be greatly appreicated as some of my photos were very important to me.
Johan Says:
July 12th, 2011

how do i know witch driver is invected
KARTHICK SAKTHI Says:
December 5th, 2011

Thanks for ur suggestion… Its working fine
Mitchina Says:
December 18th, 2011

Well, this didn’t work for me. I kept getting “is not recognized as an internal or external command, operable program or batch file” and my folder are still faded after I change the view in tools to “view all hidden”…. hhmmmm
And yes, this is how it looks now after I suspect I cleared the wonderful System Restore virus from my system…
Ollie Says:
June 4th, 2012

You’re still infected !!!!!!
Download Combofix from Bleepingcomputer.
Disable or ideally uninstall your current AV.
Run combofix as administrator.
Sorted after reboot!
DField Says:
March 19th, 2013

“parameter format not correct”
yeah, nice.