Easily unhide hidden files and folders with this simple guide. It is becoming common for viruses to hide all your documents, pictures, files and other personal folders (including start menu shortcuts) to make it look as if they are no longer on your computer.
This is scary when you open (My) Documents or (My) Pictures and see nothing there! Fortunately, in every case we have seen, your files are just hidden – they have not been deleted. UPDATED December 2012 – the fix below still works but I have added extra points in the Notes section at the bottom for external USB hard drives/flash drives and memory cards.
Why Would A Virus Hide My Files? The type of virus that does this is usually a fake antivirus or fake utility (e.g. hard drive checker) program in the form of trial software – it may pretend that your computer is infected by viruses or has hard drive problems and tries to scare you into paying for a full version of the software to supposedly ‘fix’ the problems.
Paying is absolutely the worst thing to do because the program itself is a virus and the cause of all your problems – and you will be giving your credit card details to a bunch of crooks! Hiding your documents is another way the virus tries to panic you into paying for their ‘solution’.
How Can I Unhide My Files? The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow our series of guides on how to remove viruses then come back to this page to unhide your files and folders.
Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing it:
1. Manually (not recommended). You can unhide each folder or file by entering a command prompt and changing the ‘hidden’ attribute of the files using the attrib command. We do not recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.
2. Automatically (recommended). Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program – it may take quite a while (e.g. 2 – 30+ minutes) to run depending how many files there are on your hard drive – just leave it running until it finishes.
The program automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay) hidden. Unhide.exe basically automates the attrib command to change the hidden attribute of all your files and folders. Once it has finished you should now be able to view and open your documents/pictures/music again just as before 
Notes
1. If you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.
2. No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see our review of antivirus programs.
3. Unhide.exe goes through all the files on the internal hard drives in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.
External USB Hard Drives, USB Flash Drives and Memory Cards
Note that the unhide program only works on internal hard drives. For all types of external storage you will need to unhide folders and documents manually:
- Make sure the external storage device is plugged into the computer
- Open an elevated (admin) Command Prompt:
XP – click Start \ All Programs \ Accessories \ Command Prompt
Vista/Windows 7 – click Start \ All Programs \ Accessories then right click on ‘Command Prompt’ and click on ‘Run as administrator’
Both options open up a Command Prompt window.
- Type in the following command (see Note after it) then press Enter:
attrib -h -r -s i:\*.* /s /d
Note – this assumes that your external storage drive is the i drive – if not, you must change the letter i to whatever your external drive letter is E.g. if your flash drive is the f drive you would change the middle bit to f:\*.*
This attrib command goes through the external storage device and unhides all files and folders. USB devices are a lot slower than internal hard drives so the process may take much longer – possibly hours if you have 100′s of GBs of data stored on them.
Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:
After attrib has un-hidden files on external drive i
Why Not Use This Command On Internal Drives Too?
The attrib command removes the ‘hidden’ attribute from ALL files on the selected drive. If you run it on the internal drive it would unhide everything – including important system files which are supposed to be hidden (to stop you deleting them by mistake and then finding that Windows no longer works)
Whereas the unhide.exe program does not unhide those important system files on the internal (Windows) drive – it avoids that risk and is also a little quicker as a result.
Works great! Wife’s pics of the family and Office documents have been found.
Thank you. I was able to help a friend easily because of this post. Worked perfectly!
thanks alot yar…ur information helped me alot…thank u so much, ur information saved my hard-works of 6 months, i m a researcher, i hv completed my 6 months of research work and saved the results of my research in my pen drive, bt today after 2 days, when i pluged my PD in my friends laptop, my PD was currupted by the recycler virus, the whole data of my 6 months thesis was gone…..i m so confused, what to do now, then i read this article/blog and did the things u told. now i am haapy, ur information saved my 6 months, thanks a lot yaar…..!!! thank u so much…!!!
Wow, that was lucky!
Moving (instead of copying) data to a flash drive is no backup at all – if you lose the flash drive or it stops working you lose all the data
Happily you got away with it but do put a copy of the data on your computer so you have a backup
Hello,
I have a PC that seems to be infected with a virus that is hiding programs and pictures.
By following your directions I have been able to get one PC up and running, but I am still missing Microsoft Outlook and tons of personal pictures from this one machine.
I have two logins:
1) Administrator
2) User
As the Administrator I can open and run all the steps as you directed. I am still missing programs and files under the user login. When I log in as the user on the same PC I can not get the rkill to run. All the other programs will install and run but with Rkill I get:
1st line: Terminating known malware processes”
2nd line “Please be patient”
3nd line “access is denied.”
The 3rd line is repeated several times then the screen dissappears.
Rkill screen does disappear when finished but should produce a Notepad text report of what action it took – if you don’t get a text file popping up perhaps the User account is still infected:
Log into User in ‘Safe Mode Without Networking’ and run rkill then Malwarebytes or SAS – TDSSkiller too.
If it’s a serious infection you may need to either system restore back (if you can) or use a boot CD like Kaspersky Rescue Disk to remove infections (if unsure or worried about important data/have no backup, get a good tech in to sort it out – some infections can be impossible to fully remove without a reinstall)
Good advice. thank you.
The information you provided was quite helpful for me. i recovered all my data on my usb drive which was not accessible after i removed recycler virus. Thank you very much.
OMG!It really works!!
I couldn’t see the pictures in my memory card on the computer but can see them on the camera. Tried the method above, with impression that the process might take ages. But it finished in less than a minute!Thank you very much for this guide.
Cool.
The process can take a long time on external USB hard drives as they can be 100s (or 1000s) of GB in size. With a memory card (or USB flash drive) it shouldn’t take too long as they are most likely only 2 – 16GB maximum
hi, i have windows XP and i have a virus that hides everything on my computer. i can use the internet, but that is all. i downloaded the unhide program and it worked for a minute. i restored everything, but than 2 minutes later everything was hidden again. so what can i do so everything stays unhiden this time? and what kind of virus protection would i need to get to protect me from this virus and get d of it? thank you
You need to remove the virus before unhiding files – try Malwarebytes or SuperAntiSpyware or install the 1 month trial of Kaspersky Internet Security (if you don’t have another antivirus installed) and do a full scan
If it’s a serious infection you may need to system restore back (if you can) or use a boot CD e.g. Kaspersky Rescue Disk to remove infections.
If unsure or worried about important data/have no backup, get a good tech in to sort it out – some infections can be impossible to fully remove for sure without a reinstall
Thank you so much
This is very helpful. Thank you very much for coming up with this solution. I was very close to panicking just a few minutes ago when my micro SD was infected by a trojan that hid 8GB worth of data. Admittedly, I was a bit skeptical at first but when I saw the files reappear one by one, I was truly relieved.