Bookmark and Share

Restore hidden filesAfter recovering your Windows 7 from a virus attack, you might find out that your computer is unable to show some of your files and folders. In fact, they have been hidden by the virus itself! Mind you, they were not deleted but only hidden from view. Before panicking and thinking that all your files and documents were erased,wiped out and lost forever from your computer desktop or laptop, read this guide as it could restore and show back your precious stuff thanks to a simple trick!

In order to get your files and folder back after a computer virus infection follow these easy steps (Windows 7 andVista):

  1. Click Start on your desktop.
  2. On the black Search field, type: cmd and do not press Enter yet.
  3. Right click the CMD icon and click Run as Administrator.
  4. Now, go to the driver which was infected by the virus (C: for example) and enter the following commands: attrib –s –h *.* /S /C
  5. Click Enter to retrieve  allyour files!

Related Tags

  • how to retrieve files hidden by virus
Related Articles Latest Articles

10 Comments to “How to Retrieve and Show Files Hidden by Virus Thanks to a Simple Trick”

  1. DField Says:

    “parameter format not correct”

    yeah, nice.

  2. Ollie Says:

    You’re still infected !!!!!!
    Download Combofix from Bleepingcomputer.
    Disable or ideally uninstall your current AV.
    Run combofix as administrator.
    Sorted after reboot!

  3. Mitchina Says:

    Well, this didn’t work for me. I kept getting “is not recognized as an internal or external command, operable program or batch file” and my folder are still faded after I change the view in tools to “view all hidden”…. hhmmmm

    And yes, this is how it looks now after I suspect I cleared the wonderful System Restore virus from my system…


    Thanks for ur suggestion… Its working fine

  5. Johan Says:

    how do i know witch driver is invected

  6. Ralph Says:

    I am totally lost. I had a virus hit my computer and wiped all programs, documents and photos out. Best Buy tech told me to go in a reset date back before the virus hit on backup. Did that and got my programs back but some don’t work. None of my documents or photos appear anywhere. Can’t change my background photo either.

    Read this and tried it but nothing happens. The error code says ‘is not recogized…..”

    Any ideas or help would be greatly appreicated as some of my photos were very important to me.

  7. SaiZo Says:

    Note: This does NOT work. I have found too many others with exactly the same thing. This is caused by a virus, yes.

    I have still same issue, and that is 19Gb+ of files missing. And this “hokus pokus” act just doesn’t work.

    You actually have to create 3 different accounts inorder to get the files back, they are not only hidden, they have infected the account itself!

    It’s a copy-paste thing you have to go thru:

    The virus(es) they keep launching is the same, just altered. First time I was bombed with it , nothing happened, next time this.

    I have seen this “trick”, the SHOWALL and NOHIDE trick, the “goto folder settings” trick – none which works.

    You aswell, forgot to mention: Use antimalware and then antivirus BEFORE doing anything (not to mention, you must use right click commandshell and use admin rights for it aswell). This does only apply to flashdisks, not HDD’s.

  8. Anne Says:

    Hey, I *LOVED* this entry! Look, I was hit by this horrid thing that I’ve been working days to recover from. Finally got everything cleared, my Catalyst Control Center finally working fine, only to realize that what I thought had been another symptom wasn’t fixed yet – all the files hidden with a black desktop.

    So upon finding your blog, I thought: hey, that’ll do it. Did an attrib/? first just to understand what you were saying. On my Vista Home Premium, there isn’t a /C switch, so I did your suggestion without it. Bingo! Took a couple minutes and it rolled through all the thousands of system files that it didn’t ‘un-systemize’ (for each: Access denied – \file path\file). My desktop icons popped up, all my personal files show up in the Preferred User structure as well as some folders I have directly in the c:\path structure. The only thing I need to redo manually now is the desktop background and put back together my QuickLaunch toolbar. WOW, thanks so much for writing this blog entry! Mmmmmwah! A huge kiss from me!

  9. Agilang Tamad Says:

    @Gregg DesElms

    what the “-s” switch does is it removes the “system file” attribute on a file. but this will only apply to files or folders that are NOT a system file by nature. i.e. you’re only supposed to use these commands “attrib -s -h *.*” on personal files/folders that has been hidden by a virus.

    I would recommend adding the “-r” switch because some viruses would also change your files/folders to a Read-only & that could cause some problems when editing documents.


  10. Gregg DesElms Says:

    Hmm. I’m not sure that unhiding — and certainly not “unsysteming” (if that’s even a word… but you get my point) — all system and hidden files on C: is a good idea… at least not using the ATTRIB command the way you’ve set forth.

    The “-s” switch is the one most concerning. The “-h” switch simply unhides; and while I can think of some reasons what even that switch should not be run on absolutely every file on the machine, I’m not sure it would hurt much to so do, anyway.

    But the “-s” switch… I dunno. That one turns off a system file’s even being a system file anymore. Of course even if the “-s” switch is used on a system file, it continues to perform as one. But files which are designated system files are so designated for a reason. It’s more than just whether or not the file shows-up in Explorer if the “hide system files” checkbox is checked. It can also affect how updates are applied; and how installers/uninstaller delete (or don’t delete) things, and other seemingly unrelated stuff.

    Hmm. I’m just not sure about the “-s” switch.

    Don’t get me wrong: I’m not trying to poke a hole in this otherwise good tip… but I’m just sayin’. The “-s” switch… I dunno.

    I do know this: It would certainly be less worrisome if the command were only run from the top level of the user’s folder, downward. Maybe the Program Files folder… maybe some others… but not the Windows folder. But I dunno. I’d have to research it some; and I’d also need to see just exactly what’s going on on the machine in question.

    Still, it’s a perfectly good tip.

    Hope that helps.

    Gregg DesElms
    Napa, California USA
    gregg at greggdeselms dot com

Copyright © 2007-2017 | Sitemap | Privacy | Back To Top
Best screen resolution 1280x800 or higher.
Web Talk is best viewed in Firefox.