How To Unhide Files And Documents Hidden By Virus

Easily unhide files hidden by a virus with this simple guide.

It is becoming common for a virus to hide all your files, pictures and personal folders (including start menu shortcuts) – to make it look as if they no longer exist.

This is very scary when you open your Documents or Pictures library and find nothing there! Fortunately, in every case I have seen, the files were just hidden by the virus – they had not been deleted.

I’ll review how to fix this on Windows for internal hard drives, and have added an extra section at the bottom on how to unhide files on external USB hard drives, flash drives and memory cards.

Why are my Files Hidden by a Virus?

The type of virus that does this is usually a fake antivirus or fake utility (e.g. a PC ‘cleaner’) program in the form of trial software – it pretends that your computer is infected by viruses or has hard drive problems, to scare you into paying for the software to supposedly ‘fix’ these problems…

Paying is absolutely the worst thing to do because the program itself is the virus and is the cause of all the problems – and you would be giving your credit card details to a bunch of criminals.

Hiding your personal files is one highly effective method that such a virus may use – to panic you into paying for their ‘fix’, to unhide the files.

How can I Unhide my Files?

The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow my series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing this:

You can unhide each item by entering a Command Prompt and changing the ‘hidden’ attribute of the files using the Attrib command.

I don’t recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program.

This program may take quite a while (e.g. 30+ minutes) to run, depending how many files there are on your hard drive – just leave it running until it finishes.

It automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay!) hidden.

Unhide.exe basically automates the Attrib command to change the hidden attribute of all your personal files and folders. Once it has finished, you should now be able to view and open your files – documents, pictures, music etc just as before :-)

Notes:
Once you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see my  review of antivirus programs.

Unhide.exe goes through all the files on every internal hard drive in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

Unhide Files on External USB Drives/Cards

Note that the unhide.exe program described above only works on internal hard drives. For all types of external USB storage (e.g. USB hard drives, flash drives or memory cards) you will need to unhide files and folders on those manually.

Follow these steps to unhide files on external USB devices:

  • Make sure the external USB storage device is plugged into the computer
  • Open an elevated (administrator) Command Prompt:

Windows 10, 8, 7, Vista –  Click ‘Start’ and type CMD into the search box. Right click on the ‘CMD’ program in the search results and select ‘Run As administrator’.

You may now see a User Account Control message asking “Do you want to allow the following program to make changes to this computer?”. Click on ‘Yes’ to confirm. This will open an elevated (Administrator) level Command Prompt window.

Skip to ‘All versions of Windows’ below.

XP – click Start \ All Programs \ Accessories \ Command Prompt to open a Command Prompt window.

All versions of Windows – type in the following command (see Note after it!) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this example assumes that the external USB storage drive is drive letter i – you must change i to whatever your actual USB drive letter is e.g. if your USB drive letter is e then you should change the middle part of this command to e:\*.*

This attrib command goes through the external USB storage device and unhides all files and folders. Note that USB devices are a lot slower than internal hard drives so this process may take much longer – perhaps hours if you have 100’s of GB of data stored on it.

Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:

files hidden by virus
After attrib has un-hidden files on external USB drive letter i

Why not use Attrib Command on Internal Drives too?

As mentioned earlier, the attrib command removes the ‘hidden’ attribute from ALL files on the selected drive, which is fine for external USB storage devices.

But if you run it on the internal hard drive it would unhide everything, including important Windows system files which are supposed to be hidden – to stop you deleting them by mistake and then finding that Windows no longer works…

Whereas the unhide.exe program described above does not unhide those important system files on the internal (Windows) hard drive – so it avoids that risk of future deletion (and is also therefore a little quicker than using attrib).

93 thoughts on “How To Unhide Files And Documents Hidden By Virus”

  1. Hey thanks for the great info, I have just tried this on my external hard drive and in the command prompt once i press enter it tells me ‘the system cannot find the path specified.
    Any suggestions of what else I can try?

    • @Penny – might be due to a registry value left behind by the virus. If you know your way around the registry, look in these two locations:
      HKCU\SOFTWARE\Microsoft\Command Processor\AutoRun
      HKLM\SOFTWARE\Microsoft\Command Processor\AutoRun

      If this Autorun key exists (and has a strange value e.g. a virus-type file name/location), back up the key first then clear or delete it. Please only try this if you know how to backup/restore the registry or you might end up worse off than before – if not, unhide those files from another computer.

      • Thanks, unfortunately no, I don’t know my way around and yes I did try and unhide the files from a different computer but it did not work either. Are you in Australia? Can I send it to you and I can pay you to fix it? Hehe :) I lived overseas for two years and this drive has all the photos on it from then. So I don’t want to risk losing it!

      • @Penny – sorry I’m not in Oz. If you tried from another PC too then maybe there aren’t any files to unhide or there is some issue with the ext drive – check if you can see any files if you choose ‘Show hidden files’ in Folder Options. Perhaps best to take it to a local tech for help if the files are important.

  2. This program works like a charm. My ‘virus’ hidden spreadsheets, docs, pictures were back by the time I finished reading the information on this page. Thank you so much.

  3. Really its command is nice :)
    My all file was infected and hidden by antivirus
    my all files now showing in pendrive after cleaning by antivirus.

  4. Hi! I reaaly need advice regarding my hard drive that had all the files hidden then i tried attrib -h -r -s e:\*.* /s /d then it says access denied. is there any possible way that I can restore or at least save some of my files. Thanks

    • Is e: an external drive? If so, are you sure you are using an administrator account (XP) or chose ‘run as administrator’ (Vista/W7) to open an elevated command prompt? If not, do so and try again.

      Alternatively, you may still have a virus blocking access – try booting in Safe Mode and run the command from there. You could also choose to ‘show hidden files’ in Folder Options so you can see your files but it is not a good idea to copy them elsewhere if you still have a virus (in case you transfer the infection too)

  5. Hi, like many here I was hit by a trojan which then unleashed what has so far been a very damaging “scareware-type” virus (my AV program found and stopped it only AFTER it had caused untold mayhem). Besides completely erasing my 5 year old favorites list it, too, appeared to turn all my files (docs, downloads, pics, etc.) into “hidden” system files. At first they just seemed to be completely gone, but I used folder options to show hidden files and they all came back, but still as hidden system files (their icons are all faded). None of my 3rd party software can see them, such as my favorite image viewer. Only MS programs can see them. 3rd party software only sees those folders and files created/saved since the attack. I tried “unhide.exe” but every time I attempt to launch it, I get a pop-up with a big red circle off to one side (which has a white “X” in the middle of it) which then says “Not a valid Win32 Application.” I’ve tried launching “unhide.exe.” from a number of locations within the pc, such as from the desktop, the downloads folder, and I even attempted to launch it from the Windows folder itself, something another self-help website said to do (where I got a different pop-up alleging something about memory access denied, or words to that effect). So, how do I make this seemingly wonderful program (unhide.exe) actually do what it has for so many other here? I have thousands of files which only Microsoft programs can see, which, needless to say, severely limits what I can do with them. Many thanks in advance to whomever can help.

    • @Kelly First, re-download the file in case it was corrupted. If still gives the error, you have more damage than usual and may still need to run AV or Malwarebytes etc to fix/clean.

      However, try renaming the file to unhide.com then run it (accept the warning about changing the file extension) – make sure that you display file extensions for known file types first (in Folder Options) – the Extension must be .com not just the filename

    • *.* applies to all files on the drive so not sure how you get that message unless there are actually no files on the drive (e.g. they were deleted not hidden).

      But double check if you used the right drive letter for your external drive and check the spacing in the command.

  6. tried following your instructions, but i kept receiving this error message:
    Data Error (cyclic redundancy check)

    what’s wrong?

    • that error message is usually caused by a faulty or failing drive – unhide prog may be reaching a bad part of the drive so cant go any further. backup first (in case testing finishes it off) then test the drive for errors – if there are errors then replacing the drive is the only permanent solution

  7. Thank you so muuuuucccchhh…!!!
    Yes,. it worked perfectly, I was really very confused about hidden files & folder in my Flash Drive, now it all appeared and ready for future work, thanks again, God bless You… ;)

  8. I tried typing it as you showed attrib -h -r -s /s /d e:\*.* switching e to p for the different drive, but I get a error msg saying “Invalid switch – /s/d”

    • @Kristina – try attrib -h -r -s p:\*.* /s /d instead and it should work ok for you.

      (Per the article, can take a long time on an external drive and you don’t get any sign of progress)

Comments are closed.