Folders And Documents Hidden By Virus

 Posted by on June 7, 2011  viruses
Jun 072011
 

Easily unhide hidden files and folders with this simple guide. It is becoming common for viruses to hide all your documents, pictures, files and other personal folders (including start menu shortcuts) to make it look as if they are no longer on your computer.

This is scary when you open (My) Documents or (My) Pictures and see nothing there! Fortunately, in every case we have seen, your files are just hidden – they have not been deleted. UPDATED December 2012 – the fix below still works but I have added extra points in the Notes section at the bottom for external USB hard drives/flash drives and memory cards.

Why Would A Virus Hide My Files? The type of virus that does this is usually a fake antivirus or fake utility (e.g. hard drive checker) program in the form of trial software – it may pretend that your computer is infected by viruses or has hard drive problems and tries to scare you into paying for a full version of the software to supposedly ‘fix’ the problems.

Paying is absolutely the worst thing to do because the program itself is a virus and the cause of all your problems – and you will be giving your credit card details to a bunch of crooks! Hiding your documents is another way the virus tries to panic you into paying for their ‘solution’.

How Can I Unhide My Files? The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow our series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing it:

1. Manually (not recommended). You can unhide each folder or file by entering a command prompt and changing the ‘hidden’ attribute of the files using the attrib command. We do not recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

2. Automatically (recommended). Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program – it may take quite a while (e.g. 2 – 30+ minutes) to run depending how many files there are on your hard drive – just leave it running until it finishes.

The program automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay) hidden. Unhide.exe basically automates the attrib command to change the hidden attribute of all your files and folders. Once it has finished you should now be able to view and open your documents/pictures/music again just as before :-)

Notes

1. If you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

2. No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see our review of antivirus programs.

3. Unhide.exe goes through all the files on the internal hard drives in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

External USB Hard Drives, USB Flash Drives and Memory Cards

Note that the unhide program only works on internal hard drives. For all types of external storage you will need to unhide folders and documents manually:

  • Make sure the external storage device is plugged into the computer
  • Open an elevated (admin) Command Prompt:

XP – click Start \ All Programs \ Accessories \ Command Prompt
Vista/Windows 7 – click Start \ All Programs \ Accessories then right click on ‘Command Prompt’ and click on ‘Run as administrator’
Both options open up a Command Prompt window.

  • Type in the following command (see Note after it) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this assumes that your external storage drive is the i drive – if not, you must change the letter i to whatever your external drive letter is E.g. if your flash drive is the f drive you would change the middle bit to f:\*.*

This attrib command goes through the external storage device and unhides all files and folders. USB devices are a lot slower than internal hard drives so the process may take much longer – possibly hours if you have 100’s of GBs of data stored on them.

Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:

folders1

After attrib has un-hidden files on external drive i

Why Not Use This Command On Internal Drives Too?

The attrib command removes the ‘hidden’ attribute from ALL files on the selected drive. If you run it on the internal drive it would unhide everything – including important system files which are supposed to be hidden (to stop you deleting them by mistake and then finding that Windows no longer works)

Whereas the unhide.exe program does not unhide those important system files on the internal (Windows) drive – it avoids that risk and is also a little quicker as a result.

  92 Responses to “Folders And Documents Hidden By Virus”

  1. Hi! I reaaly need advice regarding my hard drive that had all the files hidden then i tried attrib -h -r -s e:\*.* /s /d then it says access denied. is there any possible way that I can restore or at least save some of my files. Thanks

    • Is e: an external drive? If so, are you sure you are using an administrator account (XP) or chose ‘run as administrator’ (Vista/W7) to open an elevated command prompt? If not, do so and try again.

      Alternatively, you may still have a virus blocking access – try booting in Safe Mode and run the command from there. You could also choose to ‘show hidden files’ in Folder Options so you can see your files but it is not a good idea to copy them elsewhere if you still have a virus (in case you transfer the infection too)

  2. Thank you very much with that…..it worked. Oh, i am happy now!

  3. Awsome !!! thanks for your quick fix it worked for me

  4. Really its command is nice :)
    My all file was infected and hidden by antivirus
    my all files now showing in pendrive after cleaning by antivirus.

  5. IT WORKED FOR ME!! :-) THANKS A LOT NOW I CAN ACCESS MY FOLDERS AGAIN JUST LIKE BEFORE.

  6. This program works like a charm. My ‘virus’ hidden spreadsheets, docs, pictures were back by the time I finished reading the information on this page. Thank you so much.

  7. Hey thanks for the great info, I have just tried this on my external hard drive and in the command prompt once i press enter it tells me ‘the system cannot find the path specified.
    Any suggestions of what else I can try?

    • @Penny – might be due to a registry value left behind by the virus. If you know your way around the registry, look in these two locations:
      HKCU\SOFTWARE\Microsoft\Command Processor\AutoRun
      HKLM\SOFTWARE\Microsoft\Command Processor\AutoRun

      If this Autorun key exists (and has a strange value e.g. a virus-type file name/location), back up the key first then clear or delete it. Please only try this if you know how to backup/restore the registry or you might end up worse off than before – if not, unhide those files from another computer.

      • Thanks, unfortunately no, I don’t know my way around and yes I did try and unhide the files from a different computer but it did not work either. Are you in Australia? Can I send it to you and I can pay you to fix it? Hehe :) I lived overseas for two years and this drive has all the photos on it from then. So I don’t want to risk losing it!

      • @Penny – sorry I’m not in Oz. If you tried from another PC too then maybe there aren’t any files to unhide or there is some issue with the ext drive – check if you can see any files if you choose ‘Show hidden files’ in Folder Options. Perhaps best to take it to a local tech for help if the files are important.