Folders And Documents Hidden By Virus

 Posted by on June 7, 2011  viruses
Jun 072011
 

Easily unhide hidden files and folders with this simple guide. It is becoming common for viruses to hide all your documents, pictures, files and other personal folders (including start menu shortcuts) to make it look as if they are no longer on your computer.

This is scary when you open (My) Documents or (My) Pictures and see nothing there! Fortunately, in every case we have seen, your files are just hidden – they have not been deleted. UPDATED December 2012 – the fix below still works but I have added extra points in the Notes section at the bottom for external USB hard drives/flash drives and memory cards.

Why Would A Virus Hide My Files? The type of virus that does this is usually a fake antivirus or fake utility (e.g. hard drive checker) program in the form of trial software – it may pretend that your computer is infected by viruses or has hard drive problems and tries to scare you into paying for a full version of the software to supposedly ‘fix’ the problems.

Paying is absolutely the worst thing to do because the program itself is a virus and the cause of all your problems – and you will be giving your credit card details to a bunch of crooks! Hiding your documents is another way the virus tries to panic you into paying for their ‘solution’.

How Can I Unhide My Files? The first thing to do is remove the virus (the fake software) as otherwise it will just hide them again… Follow our series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing it:

1. Manually (not recommended). You can unhide each item by entering a command prompt and changing the ‘hidden’ attribute of the files using the attrib command. We do not recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

2. Automatically (recommended). Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program – it may take quite a while (e.g. 2 – 30+ minutes) to run depending how many files there are on your hard drive – just leave it running until it finishes.

The program automatically goes through your computer and unhides all files except hidden system ones – these are Windows files that are supposed to be (and should stay) hidden. Unhide.exe basically automates the attrib command to change the hidden attribute of all your files and folders. Once it has finished you should now be able to view and open your documents/pictures/music again just as before 🙂

Notes

1. If you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

2. No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see our review of antivirus programs.

3. Unhide.exe goes through all the files on the internal hard drives in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

External USB Hard Drives, USB Flash Drives and Memory Cards

Note that the unhide program only works on internal hard drives. For all types of external storage you will need to unhide folders and documents manually:

  • Make sure the external storage device is plugged into the computer
  • Open an elevated (admin) Command Prompt:

XP – click Start \ All Programs \ Accessories \ Command Prompt
Vista/Windows 7 – click Start \ All Programs \ Accessories then right click on ‘Command Prompt’ and click on ‘Run as administrator’
Both options open up a Command Prompt window.

  • Type in the following command (see Note after it) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this assumes that your external storage drive is the i drive – if not, you must change the letter i to whatever your external drive letter is E.g. if your flash drive is the f drive you would change the middle bit to f:\*.*

This attrib command goes through the external storage device and unhides all files and folders. USB devices are a lot slower than internal hard drives so the process may take much longer – possibly hours if you have 100’s of GBs of data stored on them.

Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:

folders1

After attrib has un-hidden files on external drive i

Why Not Use This Command On Internal Drives Too?

The attrib command removes the ‘hidden’ attribute from ALL files on the selected drive. If you run it on the internal drive it would unhide everything – including important system files which are supposed to be hidden (to stop you deleting them by mistake and then finding that Windows no longer works)

Whereas the unhide.exe program does not unhide those important system files on the internal (Windows) drive – it avoids that risk and is also a little quicker as a result.


  93 Responses to “Folders And Documents Hidden By Virus”

  1. Thanks Andrea, glad it solved the problem for you!

    This may be a good time to consider backup of all your important stuff so if the worst ever happens (e.g. hard drive dies or another virus deletes files rather than just hiding them) you wouldn’t lose everything forever – I have reviewed best ways to backup here – https://techlogon.com/2011/07/29/best-way-to-backup-files-on-a-hard-drive/

  2. Wooooooow….it WORKED. thank you, thank you, thank you!! i never comment but i have to on this one….i really appreciate this. If you have a paypal account I would gladly make a donation for what you do.

    Thanks again, and for any skeptics this totally works, free of charge. At the very least post if it worked or not…..ill gamble it will work for you like it worked for me….

  3. unbelievable how well that worked at restoring my files
    thanks a bunch you people must be the greatest

  4. Thank you so much! I picked up a really crappy virus that I thought my harddrive was out of there. After an entire day of working I finally have my computer on track AND my NORTON360 to protect. Thank you for helping me unhide my files. This is a scary world, Thank you for the few good ones out there!!!

  5. THANK YOU!!!! WOOOooohooooooo

  6. This works to unhide my files, but when i removed and plugged in the affected thumbdrive, the original files become hidden again, and the .lnk files are created again!

    Already did virus scan and removed all malicious stuff. How can I solve this?

  7. You haven’t removed all malicious stuff first – likely that a worm or rootkit is reinfecting.

    you don’t say what antivirus you have but it obviously isn’t finding everything – try a malwarebytes full scan and then a good antivirus boot cd e.g. kaspersky rescue http://support.kaspersky.com/viruses/rescuedisk/main?qid=208282142

  8. Hi! I need to clean my external HD but it seems that this program only works on C:

    • It should work on external drives too Ahmed as long as they are plugged in and viewable in Windows before you run Unhide.

      As USB drives are so much slower than internal drives the process could take hours if you have a huge drive full of files e.g. 1TB or larger.

      Alternatively, follow Alex’s reply to comment 10 above if you prefer the manual way of doing it using attrib – remember to change the drive letter to match your external HD

      • Hi Roy,

        I have tried everything but the program can’t see the F drive, even I copied it on the external drive itself.

        At the end, I could access the drive from the DOS, cut and paste them into a new location..

      • Hi Ahmed, thanks for feedback. I’m going to retest the latest version of unhide.exe (and update the article if required) as previous versions did work on external drives too.

        The attrib command should definitely have worked on an external drive (from DOS) – glad you got your files back

  9. Hi, I had a virus on my laptop. I was not able to access my files or folders as they were converted into shortcuts by the virus. I used MS Security Essentials which removed the virus. The folders are now no longer visible on the hard drive but are visible in the MS Security Essentials settings folder.

    • sounds like your folders (and files inside) are just hidden – have you tried running the unhide program or else follow advice from alex in comment 10 to unhide them

  10. Unhide only revealed the recycle folder. I did manage to access the folders/files. However by searching the F: drive, I managed to finally access the files and cut and paste them into a new location..

  11. AWESOME!!!!! I couldn’t access any of my files and you saved my life! I’m in my final quarter of my Bachelor’s degree and had many papers that had been hidden by a virus that I needed. This unhid them! Yay! So happy! Thanks!

  12. Thanks, you’re the best, I bought my Samsung laptop on September and did not buy the virus protection plan more than 200 dlls, so I either pay 130 dlls plus tax (200 for a one year protection plan), or was on my own, I chose the second and here I am, so happy that I could solve the problem with your easy to follow instructions,everything came back to normal..I bought Webroot /spysweeper with the laptop but now I think I will change antivirus,not sure which one but will chek your list.

    • Glad it helped you 🙂

      For paid antivirus I personally use Kaspersky Internet Security 2012 but have a look at tests and reviews to compare

  13. Roy — thank you SO very much for using your powers to do good. There is nothing more frustrating than having to clean up the ravages of a bloody virus. I installed your fix and my computer was ‘reborn’ in less than 15 minutes — I had a lot of files to unhide.

    People — listen up! Toss this man a few bucks. You know you would have spent far more in computer repair time and talent.

    Thanks again!

    • Hi Tamara, many thanks for your kind donation 🙂

      I have sent you a direct email reply.

      Malware can certainly be very annoying (prevention is a lot less stressful) and nowadays the damage caused is often harder to fix than removing the malware itself.

  14. Thank You!! Consider yourself hugged! I was crying but now I am very happy. It is nice to know there are people who still spread JOY and NOT viruses, =-)

  15. Just the other day a virus infected our computer and hid all our files. We panicked, naturally, until I decided to unhide a folder I had hidden and, lo and behold, the files were there. Then I decided to apply the unhide to everything and, viola, everything was there.

    The easiest way to unhide everything is to right click on a folder (it doesn’t matter which one) and then click on Properties. Under Attributes, unclick “Hidden” and your computer will ask you if you want to apply this to all folders and all contents on the computer. Select “Yes” and let it do it’s thing. No special software is required.

    • That would work but the problem with doing it that way is that you would remove the ‘hidden’ attribute from ALL files on the computer – including system files which are supposed to be hidden (to stop people deleting them by mistake and then finding that Windows no longer works…)

      The unhide program does not unhide those important system files so it avoids that risk (and is also a little quicker as a result)