How To Unhide Files And Documents Hidden By Virus

Easily unhide files hidden by a virus with this simple guide.

It is becoming common for a virus to hide all your files, pictures and personal folders (including start menu shortcuts) – to make it look as if they no longer exist.

This is very scary when you open your Documents or Pictures library and find nothing there! Fortunately, in every case I have seen, the files were just hidden by the virus – they had not been deleted.

I’ll review how to fix this on Windows for internal hard drives, and have added an extra section at the bottom on how to unhide files on external USB hard drives, flash drives and memory cards.

Why are my Files Hidden by a Virus?

The type of virus that does this is usually a fake antivirus or fake utility (e.g. a PC ‘cleaner’) program in the form of trial software – it pretends that your computer is infected by viruses or has hard drive problems, to scare you into paying for the software to supposedly ‘fix’ these problems…

Paying is absolutely the worst thing to do because the program itself is the virus and is the cause of all the problems – and you would be giving your credit card details to a bunch of criminals.

Hiding your personal files is one highly effective method that such a virus may use – to panic you into paying for their ‘fix’, to unhide the files.

How can I Unhide my Files?

The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow my series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing this:

You can unhide each item by entering a Command Prompt and changing the ‘hidden’ attribute of the files using the Attrib command.

I don’t recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program.

This program may take quite a while (e.g. 30+ minutes) to run, depending how many files there are on your hard drive – just leave it running until it finishes.

It automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay!) hidden.

Unhide.exe basically automates the Attrib command to change the hidden attribute of all your personal files and folders. Once it has finished, you should now be able to view and open your files – documents, pictures, music etc just as before :-)

Notes:
Once you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see my  review of antivirus programs.

Unhide.exe goes through all the files on every internal hard drive in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

Unhide Files on External USB Drives/Cards

Note that the unhide.exe program described above only works on internal hard drives. For all types of external USB storage (e.g. USB hard drives, flash drives or memory cards) you will need to unhide files and folders on those manually.

Follow these steps to unhide files on external USB devices:

  • Make sure the external USB storage device is plugged into the computer
  • Open an elevated (administrator) Command Prompt:

Windows 10, 8, 7, Vista –  Click ‘Start’ and type CMD into the search box. Right click on the ‘CMD’ program in the search results and select ‘Run As administrator’.

You may now see a User Account Control message asking “Do you want to allow the following program to make changes to this computer?”. Click on ‘Yes’ to confirm. This will open an elevated (Administrator) level Command Prompt window.

Skip to ‘All versions of Windows’ below.

XP – click Start \ All Programs \ Accessories \ Command Prompt to open a Command Prompt window.

All versions of Windows – type in the following command (see Note after it!) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this example assumes that the external USB storage drive is drive letter i – you must change i to whatever your actual USB drive letter is e.g. if your USB drive letter is e then you should change the middle part of this command to e:\*.*

This attrib command goes through the external USB storage device and unhides all files and folders. Note that USB devices are a lot slower than internal hard drives so this process may take much longer – perhaps hours if you have 100’s of GB of data stored on it.

Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:

files hidden by virus
After attrib has un-hidden files on external USB drive letter i

Why not use Attrib Command on Internal Drives too?

As mentioned earlier, the attrib command removes the ‘hidden’ attribute from ALL files on the selected drive, which is fine for external USB storage devices.

But if you run it on the internal hard drive it would unhide everything, including important Windows system files which are supposed to be hidden – to stop you deleting them by mistake and then finding that Windows no longer works…

Whereas the unhide.exe program described above does not unhide those important system files on the internal (Windows) hard drive – so it avoids that risk of future deletion (and is also therefore a little quicker than using attrib).

Related Posts:

93 thoughts on “How To Unhide Files And Documents Hidden By Virus”

  1. Just the other day a virus infected our computer and hid all our files. We panicked, naturally, until I decided to unhide a folder I had hidden and, lo and behold, the files were there. Then I decided to apply the unhide to everything and, viola, everything was there.

    The easiest way to unhide everything is to right click on a folder (it doesn’t matter which one) and then click on Properties. Under Attributes, unclick “Hidden” and your computer will ask you if you want to apply this to all folders and all contents on the computer. Select “Yes” and let it do it’s thing. No special software is required.

    • That would work but the problem with doing it that way is that you would remove the ‘hidden’ attribute from ALL files on the computer – including system files which are supposed to be hidden (to stop people deleting them by mistake and then finding that Windows no longer works…)

      The unhide program does not unhide those important system files so it avoids that risk (and is also a little quicker as a result)

  2. Thank You!! Consider yourself hugged! I was crying but now I am very happy. It is nice to know there are people who still spread JOY and NOT viruses, =-)

  3. Roy — thank you SO very much for using your powers to do good. There is nothing more frustrating than having to clean up the ravages of a bloody virus. I installed your fix and my computer was ‘reborn’ in less than 15 minutes — I had a lot of files to unhide.

    People — listen up! Toss this man a few bucks. You know you would have spent far more in computer repair time and talent.

    Thanks again!

    • Hi Tamara, many thanks for your kind donation :-)

      I have sent you a direct email reply.

      Malware can certainly be very annoying (prevention is a lot less stressful) and nowadays the damage caused is often harder to fix than removing the malware itself.

  4. Thanks, you’re the best, I bought my Samsung laptop on September and did not buy the virus protection plan more than 200 dlls, so I either pay 130 dlls plus tax (200 for a one year protection plan), or was on my own, I chose the second and here I am, so happy that I could solve the problem with your easy to follow instructions,everything came back to normal..I bought Webroot /spysweeper with the laptop but now I think I will change antivirus,not sure which one but will chek your list.

    • Glad it helped you :-)

      For paid antivirus I personally use Kaspersky Internet Security 2012 but have a look at tests and reviews to compare

  5. AWESOME!!!!! I couldn’t access any of my files and you saved my life! I’m in my final quarter of my Bachelor’s degree and had many papers that had been hidden by a virus that I needed. This unhid them! Yay! So happy! Thanks!

  6. Unhide only revealed the recycle folder. I did manage to access the folders/files. However by searching the F: drive, I managed to finally access the files and cut and paste them into a new location..

  7. Hi, I had a virus on my laptop. I was not able to access my files or folders as they were converted into shortcuts by the virus. I used MS Security Essentials which removed the virus. The folders are now no longer visible on the hard drive but are visible in the MS Security Essentials settings folder.

    • sounds like your folders (and files inside) are just hidden – have you tried running the unhide program or else follow advice from alex in comment 10 to unhide them

    • It should work on external drives too Ahmed as long as they are plugged in and viewable in Windows before you run Unhide.

      As USB drives are so much slower than internal drives the process could take hours if you have a huge drive full of files e.g. 1TB or larger.

      Alternatively, follow Alex’s reply to comment 10 above if you prefer the manual way of doing it using attrib – remember to change the drive letter to match your external HD

      • Hi Roy,

        I have tried everything but the program can’t see the F drive, even I copied it on the external drive itself.

        At the end, I could access the drive from the DOS, cut and paste them into a new location..

      • Hi Ahmed, thanks for feedback. I’m going to retest the latest version of unhide.exe (and update the article if required) as previous versions did work on external drives too.

        The attrib command should definitely have worked on an external drive (from DOS) – glad you got your files back

  10. This works to unhide my files, but when i removed and plugged in the affected thumbdrive, the original files become hidden again, and the .lnk files are created again!

    Already did virus scan and removed all malicious stuff. How can I solve this?

  12. Thank you so much! I picked up a really crappy virus that I thought my harddrive was out of there. After an entire day of working I finally have my computer on track AND my NORTON360 to protect. Thank you for helping me unhide my files. This is a scary world, Thank you for the few good ones out there!!!

  14. Wooooooow….it WORKED. thank you, thank you, thank you!! i never comment but i have to on this one….i really appreciate this. If you have a paypal account I would gladly make a donation for what you do.

    Thanks again, and for any skeptics this totally works, free of charge. At the very least post if it worked or not…..ill gamble it will work for you like it worked for me….

Comments are closed.