Easily unhide files hidden by a virus with this simple guide.
It is becoming common for a virus to hide all your files, pictures and personal folders (including start menu shortcuts) – to make it look as if they no longer exist.
This is very scary when you open your Documents or Pictures library and find nothing there! Fortunately, in every case I have seen, the files were just hidden by the virus – they had not been deleted.
I’ll review how to fix this on Windows for internal hard drives, and have added an extra section at the bottom on how to unhide files on external USB hard drives, flash drives and memory cards.
Why are my Files Hidden by a Virus?
The type of virus that does this is usually a fake antivirus or fake utility (e.g. a PC ‘cleaner’) program in the form of trial software – it pretends that your computer is infected by viruses or has hard drive problems, to scare you into paying for the software to supposedly ‘fix’ these problems…
Paying is absolutely the worst thing to do because the program itself is the virus and is the cause of all the problems – and you would be giving your credit card details to a bunch of criminals.
Hiding your personal files is one highly effective method that such a virus may use – to panic you into paying for their ‘fix’, to unhide the files.
How can I Unhide my Files?
The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow my series of guides on how to remove viruses then come back to this page to unhide your files and folders.
Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing this:
Manually (not recommended)
You can unhide each item by entering a Command Prompt and changing the ‘hidden’ attribute of the files using the Attrib command.
I don’t recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.
Automatically (recommended)
Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program.
This program may take quite a while (e.g. 30+ minutes) to run, depending how many files there are on your hard drive – just leave it running until it finishes.
It automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay!) hidden.
Unhide.exe basically automates the Attrib command to change the hidden attribute of all your personal files and folders. Once it has finished, you should now be able to view and open your files – documents, pictures, music etc just as before :-)
Notes:
Once you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.
No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see my review of antivirus programs.
Unhide.exe goes through all the files on every internal hard drive in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.
Unhide Files on External USB Drives/Cards
Note that the unhide.exe program described above only works on internal hard drives. For all types of external USB storage (e.g. USB hard drives, flash drives or memory cards) you will need to unhide files and folders on those manually.
Follow these steps to unhide files on external USB devices:
- Make sure the external USB storage device is plugged into the computer
- Open an elevated (administrator) Command Prompt:
Windows 10, 8, 7, Vista – Click ‘Start’ and type CMD into the search box. Right click on the ‘CMD’ program in the search results and select ‘Run As administrator’.
You may now see a User Account Control message asking “Do you want to allow the following program to make changes to this computer?”. Click on ‘Yes’ to confirm. This will open an elevated (Administrator) level Command Prompt window.
Skip to ‘All versions of Windows’ below.
XP – click Start \ All Programs \ Accessories \ Command Prompt to open a Command Prompt window.
All versions of Windows – type in the following command (see Note after it!) then press Enter:
attrib -h -r -s i:\*.* /s /d
Note – this example assumes that the external USB storage drive is drive letter i – you must change i to whatever your actual USB drive letter is e.g. if your USB drive letter is e then you should change the middle part of this command to e:\*.*
This attrib command goes through the external USB storage device and unhides all files and folders. Note that USB devices are a lot slower than internal hard drives so this process may take much longer – perhaps hours if you have 100’s of GB of data stored on it.
Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:
Why not use Attrib Command on Internal Drives too?
As mentioned earlier, the attrib command removes the ‘hidden’ attribute from ALL files on the selected drive, which is fine for external USB storage devices.
But if you run it on the internal hard drive it would unhide everything, including important Windows system files which are supposed to be hidden – to stop you deleting them by mistake and then finding that Windows no longer works…
Whereas the unhide.exe program described above does not unhide those important system files on the internal (Windows) hard drive – so it avoids that risk of future deletion (and is also therefore a little quicker than using attrib).
Thank you so much
hi, i have windows XP and i have a virus that hides everything on my computer. i can use the internet, but that is all. i downloaded the unhide program and it worked for a minute. i restored everything, but than 2 minutes later everything was hidden again. so what can i do so everything stays unhiden this time? and what kind of virus protection would i need to get to protect me from this virus and get d of it? thank you
You need to remove the virus before unhiding files – try Malwarebytes or SuperAntiSpyware or install the 1 month trial of Kaspersky Internet Security (if you don’t have another antivirus installed) and do a full scan
If it’s a serious infection you may need to system restore back (if you can) or use a boot CD e.g. Kaspersky Rescue Disk to remove infections.
If unsure or worried about important data/have no backup, get a good tech in to sort it out – some infections can be impossible to fully remove for sure without a reinstall
OMG!It really works!!
I couldn’t see the pictures in my memory card on the computer but can see them on the camera. Tried the method above, with impression that the process might take ages. But it finished in less than a minute!Thank you very much for this guide.
Cool.
The process can take a long time on external USB hard drives as they can be 100s (or 1000s) of GB in size. With a memory card (or USB flash drive) it shouldn’t take too long as they are most likely only 2 – 16GB maximum :-)
The information you provided was quite helpful for me. i recovered all my data on my usb drive which was not accessible after i removed recycler virus. Thank you very much.
Good advice. thank you.
Hello,
I have a PC that seems to be infected with a virus that is hiding programs and pictures.
By following your directions I have been able to get one PC up and running, but I am still missing Microsoft Outlook and tons of personal pictures from this one machine.
I have two logins:
1) Administrator
2) User
As the Administrator I can open and run all the steps as you directed. I am still missing programs and files under the user login. When I log in as the user on the same PC I can not get the rkill to run. All the other programs will install and run but with Rkill I get:
1st line: Terminating known malware processes”
2nd line “Please be patient”
3nd line “access is denied.”
The 3rd line is repeated several times then the screen dissappears.
Rkill screen does disappear when finished but should produce a Notepad text report of what action it took – if you don’t get a text file popping up perhaps the User account is still infected:
Log into User in ‘Safe Mode Without Networking’ and run rkill then Malwarebytes or SAS – TDSSkiller too.
If it’s a serious infection you may need to either system restore back (if you can) or use a boot CD like Kaspersky Rescue Disk to remove infections (if unsure or worried about important data/have no backup, get a good tech in to sort it out – some infections can be impossible to fully remove without a reinstall)
thanks alot yar…ur information helped me alot…thank u so much, ur information saved my hard-works of 6 months, i m a researcher, i hv completed my 6 months of research work and saved the results of my research in my pen drive, bt today after 2 days, when i pluged my PD in my friends laptop, my PD was currupted by the recycler virus, the whole data of my 6 months thesis was gone…..i m so confused, what to do now, then i read this article/blog and did the things u told. now i am haapy, ur information saved my 6 months, thanks a lot yaar…..!!! thank u so much…!!!
Wow, that was lucky!
Moving (instead of copying) data to a flash drive is no backup at all – if you lose the flash drive or it stops working you lose all the data :-(
Happily you got away with it but do put a copy of the data on your computer so you have a backup
Thank you. I was able to help a friend easily because of this post. Worked perfectly!
Works great! Wife’s pics of the family and Office documents have been found.
Great!!! Thanks a lot for the tips. Got my folders unhidden already!!!
Once you have used malware then the program above then restore to an earlier date in system restore. The only thing you may need to do after that is click a box in the Internet section for that to work. Hope this works
You should not need to do a system restore if you have already removed all malware and un-hidden files – unless you have any other issues there wouldn’t be much point? If you do try, make sure you go back to well before the malware to avoid reinfection.
You can try system restore before virus removal (although a lot of malware corrupts restore points so the restore fails)
Help me please. My external harddrive is experiencing the same problem but when my antivirus cured the infection not all the folders were restored. I can only see some but the hard drive says there is still 268G memory being used. I can see the folders im looking for using AutorunExterminator but i dont know how to unhide the folders i want.
See the additional notes at the end of the article for how to unhide hidden documents on external storage devices
Wow, I cannot thank you enough. You helped me recover 252 Gigs of items I thought I had lost on my external hard drive.
Cool ;-) That must have taken quite a while
I have a problem in removing recycler and unhiding the hard disk files including RUN program as explained above…. I tried all your advices but unfortunately it didn’t work. I downloaded the recyclers removal software and also the unhide software which linked on your literature. I don’t know what else to do. Please advise me more….
before you can unhide files you must first completely remove any malware like recycler virus or the files will just be hidden again. use malwarebytes or a good antivirus program to clean up.
Glad it helped you :-)
Like you say, beware of ‘fix all’ programs (e.g. PC tune up and registry cleaners) which claim to cure all sorts of things and speed up your computer – for a hefty fee. Some may cause more problems than they solve – see the following article if you want more info on registry cleaners – https://techlogon.com/do-i-need-a-registry-cleaner/
Thank you so much as i cant aford to take comp shop to get fix. This extreamly helpful with the hidden file. Please keep helping people as i have come across a lot crooks and have paid for some as well not happy with . Again Thank you