Folders And Documents Hidden By Virus

 Posted by on June 7, 2011  viruses
Jun 072011
 

Easily unhide hidden files and folders with this simple guide. It is becoming common for viruses to hide all your documents, pictures, files and other personal folders (including start menu shortcuts) to make it look as if they are no longer on your computer.

This is scary when you open (My) Documents or (My) Pictures and see nothing there! Fortunately, in every case we have seen, your files are just hidden – they have not been deleted. UPDATED December 2012 – the fix below still works but I have added extra points in the Notes section at the bottom for external USB hard drives/flash drives and memory cards.

Why Would A Virus Hide My Files? The type of virus that does this is usually a fake antivirus or fake utility (e.g. hard drive checker) program in the form of trial software – it may pretend that your computer is infected by viruses or has hard drive problems and tries to scare you into paying for a full version of the software to supposedly ‘fix’ the problems.

Paying is absolutely the worst thing to do because the program itself is a virus and the cause of all your problems – and you will be giving your credit card details to a bunch of crooks! Hiding your documents is another way the virus tries to panic you into paying for their ‘solution’.

How Can I Unhide My Files? The first thing to do is remove the virus (the fake software) as otherwise it will just hide them again… Follow our series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing it:

1. Manually (not recommended). You can unhide each item by entering a command prompt and changing the ‘hidden’ attribute of the files using the attrib command. We do not recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

2. Automatically (recommended). Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program – it may take quite a while (e.g. 2 – 30+ minutes) to run depending how many files there are on your hard drive – just leave it running until it finishes.

The program automatically goes through your computer and unhides all files except hidden system ones – these are Windows files that are supposed to be (and should stay) hidden. Unhide.exe basically automates the attrib command to change the hidden attribute of all your files and folders. Once it has finished you should now be able to view and open your documents/pictures/music again just as before 🙂

Notes

1. If you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

2. No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see our review of antivirus programs.

3. Unhide.exe goes through all the files on the internal hard drives in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

External USB Hard Drives, USB Flash Drives and Memory Cards

Note that the unhide program only works on internal hard drives. For all types of external storage you will need to unhide folders and documents manually:

  • Make sure the external storage device is plugged into the computer
  • Open an elevated (admin) Command Prompt:

XP – click Start \ All Programs \ Accessories \ Command Prompt
Vista/Windows 7 – click Start \ All Programs \ Accessories then right click on ‘Command Prompt’ and click on ‘Run as administrator’
Both options open up a Command Prompt window.

  • Type in the following command (see Note after it) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this assumes that your external storage drive is the i drive – if not, you must change the letter i to whatever your external drive letter is E.g. if your flash drive is the f drive you would change the middle bit to f:\*.*

This attrib command goes through the external storage device and unhides all files and folders. USB devices are a lot slower than internal hard drives so the process may take much longer – possibly hours if you have 100’s of GBs of data stored on them.

Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:

folders1

After attrib has un-hidden files on external drive i

Why Not Use This Command On Internal Drives Too?

The attrib command removes the ‘hidden’ attribute from ALL files on the selected drive. If you run it on the internal drive it would unhide everything – including important system files which are supposed to be hidden (to stop you deleting them by mistake and then finding that Windows no longer works)

Whereas the unhide.exe program does not unhide those important system files on the internal (Windows) drive – it avoids that risk and is also a little quicker as a result.


  93 Responses to “Folders And Documents Hidden By Virus”

  1. Hey It worked..Thank u very much..By by mistake I put e drive but my usb was in k drive..So is there any way to undo that for e drive only..

    • unless your e: drive is the windows system drive, not sure why it would matter if you had unhidden all files/folders?

      but if you want to rehide specific folders on e: just right click the folder and select Properties then select Hidden and then Apply – then choose whether to hide all subfolders and files within that folder

  2. Hi,

    Thanks a lot its very helpful for. Your saved my system format option.

    Regards,
    AB

  3. Hi,
    I tried the the external hard drive. I got the below message:
    Access denied – D:\Documents and Settings\All Users\Application Data\Microsoft\C
    rypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_998e5aea-e997-40ed-b5d4-a
    cfb84cd9d1e

    • You appear to have a full clone of your OS on your external hard drive? In which case some files/folders may be system files that you don’t have permissions for.

      Either change permissions or just unhide specific folders – right click the folder and select Properties then deselect Hidden and then Apply – then choose whether to unhide all subfolders and files within that folder

      • Hi Roy and thanks for your prompt reply.
        Yes indeed, the hard drive I am trying to clean used to be the hard drive of my infected PC. I put it in an external case and was trying to rescue the data from it.
        I have Win7 and I do not see any hidden folders (faded icons). How can I change the permission or what other option do I have ?

        Thanks.

      • You seem to be trying to copy data, not unhide files? If so, why not just copy your personal docs/pics/favorites etc so you can wipe the drive and reinstall Windows?

        Not much point trying to copy Windows/Application Data – viruses are most likely to be stored in those folders anyway…

      • The problem is that I cannot see those folders in order to copy them. I know they are there using softwares like treeview and others.

      • Only other suggestion – open Folder Options (type it into W7 search box then select it) and in the View tab select ‘Show hidden files and folders’ to see the hidden folders. Then follow guide in my first reply to unhide specific folders like Docs etc

  4. I tried typing it as you showed attrib -h -r -s /s /d e:\*.* switching e to p for the different drive, but I get a error msg saying “Invalid switch – /s/d”

    • @Kristina – try attrib -h -r -s p:\*.* /s /d instead and it should work ok for you.

      (Per the article, can take a long time on an external drive and you don’t get any sign of progress)

  5. WoW…
    This works like magic!

  6. Thank you so muuuuucccchhh…!!!
    Yes,. it worked perfectly, I was really very confused about hidden files & folder in my Flash Drive, now it all appeared and ready for future work, thanks again, God bless You… 😉

  7. tried following your instructions, but i kept receiving this error message:
    Data Error (cyclic redundancy check)

    what’s wrong?

    • that error message is usually caused by a faulty or failing drive – unhide prog may be reaching a bad part of the drive so cant go any further. backup first (in case testing finishes it off) then test the drive for errors – if there are errors then replacing the drive is the only permanent solution

  8. I tried but it kept saying that the files doesn’t exist.. In an external hard drive

    • *.* applies to all files on the drive so not sure how you get that message unless there are actually no files on the drive (e.g. they were deleted not hidden).

      But double check if you used the right drive letter for your external drive and check the spacing in the command.

  9. Hi, like many here I was hit by a trojan which then unleashed what has so far been a very damaging “scareware-type” virus (my AV program found and stopped it only AFTER it had caused untold mayhem). Besides completely erasing my 5 year old favorites list it, too, appeared to turn all my files (docs, downloads, pics, etc.) into “hidden” system files. At first they just seemed to be completely gone, but I used folder options to show hidden files and they all came back, but still as hidden system files (their icons are all faded). None of my 3rd party software can see them, such as my favorite image viewer. Only MS programs can see them. 3rd party software only sees those folders and files created/saved since the attack. I tried “unhide.exe” but every time I attempt to launch it, I get a pop-up with a big red circle off to one side (which has a white “X” in the middle of it) which then says “Not a valid Win32 Application.” I’ve tried launching “unhide.exe.” from a number of locations within the pc, such as from the desktop, the downloads folder, and I even attempted to launch it from the Windows folder itself, something another self-help website said to do (where I got a different pop-up alleging something about memory access denied, or words to that effect). So, how do I make this seemingly wonderful program (unhide.exe) actually do what it has for so many other here? I have thousands of files which only Microsoft programs can see, which, needless to say, severely limits what I can do with them. Many thanks in advance to whomever can help.

    • @Kelly First, re-download the file in case it was corrupted. If still gives the error, you have more damage than usual and may still need to run AV or Malwarebytes etc to fix/clean.

      However, try renaming the file to unhide.com then run it (accept the warning about changing the file extension) – make sure that you display file extensions for known file types first (in Folder Options) – the Extension must be .com not just the filename

  10. thank you very much it is working………………..thnk you