How To Unhide Files And Documents Hidden By Virus

Easily unhide files hidden by a virus with this simple guide. It is becoming common for a virus to hide all your files, pictures and personal folders (including start menu shortcuts) – to make it look as if they no longer exist.

This is very scary when you open your Documents or Pictures library and find nothing there!

Fortunately, in every case I have seen, the files were just hidden by the virus – they had not been deleted.

I’ll review how to fix this on Windows for internal hard drives, and have added an extra section at the bottom on how to unhide files on external USB hard drives, flash drives and memory cards.

Files Hidden By Virus – Why?

The type of virus that does this is usually a fake antivirus or fake utility (e.g. a PC ‘cleaner’) program in the form of trial software – it pretends that your computer is infected by viruses or has hard drive problems, to scare you into paying for the software to supposedly ‘fix’ these problems…

Paying is absolutely the worst thing to do because the program itself is the virus and is the cause of all the problems – and you would be giving your credit card details to a bunch of criminals.

Hiding your personal files is one highly effective method that such a virus may use – to panic you into paying for their ‘fix’, to unhide the files.

How Can I Unhide My Files?

The first thing to do is remove the virus (the fake software) as otherwise it will just hide your files again… Follow our series of guides on how to remove viruses then come back to this page to unhide your files and folders.

Assuming you have already removed all the viruses on your computer you can now unhide your personal files and folders. There are 2 ways of doing this:

  • Manually (not recommended). You can unhide each item by entering a Command Prompt and changing the ‘hidden’ attribute of the files using the Attrib command.

I don’t recommend this for most users as it is time consuming and very easy to miss certain folders that need to be unhidden.

  • Automatically (recommended). Download the unhide.exe program from Bleeping Computer here, save it to your computer then double click it to run the program

This program may take quite a while (e.g. 30+ minutes) to run, depending how many files there are on your hard drive – just leave it running until it finishes.

It automatically goes through your computer and unhides all files except hidden system files – these are Windows files that are supposed to be (and should stay!) hidden.

Unhide.exe basically automates the Attrib command to change the hidden attribute of all your personal files and folders. Once it has finished, you should now be able to view and open your files – documents, pictures, music etc just as before :-)

Notes:

Once you have successfully unhidden your files, see my guide on how to avoid virus infections in the first place – prevention is easier (and much less stressful!) than cure.

No antivirus program is 100% effective so you may just have been unlucky in getting infected – but if you want to check how your antivirus program compares to the best ones, see my  review of antivirus programs.

Unhide.exe goes through all the files on every internal hard drive in your computer – most people only have one internal hard drive but, if you have 2, then it may take twice as long to run.

Unhide Files on External USB Hard Drives, Flash Drives and Memory Cards

Note that the unhide.exe program described above only works on internal hard drives. For all types of external USB storage you will need to unhide files and folders manually.

Follow these steps to unhide files on external USB devices:

  • Make sure the external USB storage device is plugged into the computer
  • Open an elevated (administrator) Command Prompt:

Windows 10, 8, 7, Vista –  Click ‘Start’ and type CMD into the search box. Right click on the ‘CMD’ program in the search results and select ‘Run As administrator’.

You may now see a User Account Control message asking “Do you want to allow the following program to make changes to this computer?”. Click on ‘Yes’ to confirm. This will open an elevated (Administrator) level Command Prompt window

XP – click Start \ All Programs \ Accessories \ Command Prompt to open a Command Prompt window.

  • Type in the following command (see Note after it!) then press Enter:

attrib -h -r -s i:\*.* /s /d

Note – this example assumes that the external USB storage drive is drive letter i – you must change i to whatever your actual USB drive letter is e.g. if your USB drive letter was e then you should change the middle part of this command to e:\*.*

This attrib command goes through the external USB storage device and unhides all files and folders. Note that USB devices are a lot slower than internal hard drives so this process may take much longer – perhaps hours if you have 100’s of GB of data stored on it.

  • Once finished, the cursor returns to a flashing command prompt on a new line as shown below – now close the Command Prompt window:
files hidden by virus

After attrib has un-hidden files on external USB drive letter i

Why Not Use This Attrib Command On Internal Hard Drives Too?

As mentioned earlier, the attrib command removes the ‘hidden’ attribute from ALL files on the selected drive, which is fine for external USB storage devices.

But if you run it on the internal hard drive it would unhide everything, including important Windows system files which are supposed to be hidden – to stop you deleting them by mistake and then finding that Windows no longer works…

Whereas the unhide.exe program described above does not unhide those important system files on the internal (Windows) hard drive – so it avoids that risk of future deletion (and is also therefore a little quicker than using attrib).

Share this:

93 Responses to: "How To Unhide Files And Documents Hidden By Virus"

  1. Ali says:

    Hi,
    I tried the the external hard drive. I got the below message:
    Access denied – D:\Documents and Settings\All Users\Application Data\Microsoft\C
    rypto\RSA\MachineKeys\fc1e3851f429ea606d6ff1e01a5229f1_998e5aea-e997-40ed-b5d4-a
    cfb84cd9d1e

    • Roy says:

      You appear to have a full clone of your OS on your external hard drive? In which case some files/folders may be system files that you don’t have permissions for.

      Either change permissions or just unhide specific folders – right click the folder and select Properties then deselect Hidden and then Apply – then choose whether to unhide all subfolders and files within that folder

      • Ali says:

        Hi Roy and thanks for your prompt reply.
        Yes indeed, the hard drive I am trying to clean used to be the hard drive of my infected PC. I put it in an external case and was trying to rescue the data from it.
        I have Win7 and I do not see any hidden folders (faded icons). How can I change the permission or what other option do I have ?

        Thanks.

      • Roy says:

        You seem to be trying to copy data, not unhide files? If so, why not just copy your personal docs/pics/favorites etc so you can wipe the drive and reinstall Windows?

        Not much point trying to copy Windows/Application Data – viruses are most likely to be stored in those folders anyway…

      • Ali says:

        The problem is that I cannot see those folders in order to copy them. I know they are there using softwares like treeview and others.

      • Roy says:

        Only other suggestion – open Folder Options (type it into W7 search box then select it) and in the View tab select ‘Show hidden files and folders’ to see the hidden folders. Then follow guide in my first reply to unhide specific folders like Docs etc

  2. Arun87 says:

    Hi,

    Thanks a lot its very helpful for. Your saved my system format option.

    Regards,
    AB

  3. Nitesh Kumar Gautam says:

    Hey It worked..Thank u very much..By by mistake I put e drive but my usb was in k drive..So is there any way to undo that for e drive only..

    • Dave says:

      unless your e: drive is the windows system drive, not sure why it would matter if you had unhidden all files/folders?

      but if you want to rehide specific folders on e: just right click the folder and select Properties then select Hidden and then Apply – then choose whether to hide all subfolders and files within that folder

  4. manoj kumar says:

    many many thanks for solution

  5. Irfan KK says:

    Thank u very much for your help…. The points mentioned will be very helpful for our future usage of PC.\

  6. Jud says:

    hey thanks so much for the info.
    it worked!

  7. Nat says:

    Great!! This worked for me

  8. Debbie says:

    I ran your command on my external hard drive, and yes I can now see the hidden folders, but not their contents. I know the contents are definitely there because of the amount of space used up as well as when I run a virus scan I can see them being scanned. Help!!

    • Roy says:

      Try showing hidden files – Folder options \ show hidden files – if they appear now then yes, they’re still set to hidden which is odd.

      Are you 100% sure you ran attrib on the correct (actual) drive letter of your external drive?

      Only reasons I can think of for it not working are either you still have a virus (that is hiding them again after) or you didn’t copy the attrib command right?

  9. Kevin says:

    Wow..thank you I haven’t had that external drive for a year now …so glad you posted the solution and I was able to find you…thanks again…
    Kevin

  10. Jawed says:

    Thanks a lot buddy.

    Your method of understanding the people is very good.

    I got in one time. thanks dear

  11. suhas says:

    thnx.. very helpful. nyc work

  12. Ramesh says:

    I am pasting the text from the file created on desktop after running the app;

    Unhide by Lawrence Abrams (Grinler)
    Copyright 2008-2012 BleepingComputer.com

    Program started at: 07/11/2012 10:29:43 AM

    Your operating system, Unknown Version, is not supported.

    Using N360beta and was successful in removing all the virus from pen drive. But unhiding was sucessful with the command mentioned by you, but without the string “E:\*.*”. With * string Win8 can’t recognise the command

  13. Fernando says:

    Thanks!!! It Works

  14. Ramesh says:

    Hi, this command is not working in windows8 consumer preview. Can you give other command for pen drive. i tried individual command which works but still not visible. using ur command returns attrib is not a batch command or recognised internal …….

    Oh now worked with out *.*

    • Roy says:

      Attrib is still supported in W8 – it sounds like you still have a virus which could disable batch commands and/or re-hide the files

      • Roy says:

        Ok, good.

        I thought you meant attrib wasn’t working, not unhide.

        For W8 (not released until October) you can force unhide.exe to run on unknown versions by running it from an elevated Command Prompt (CMD) and adding the option of -f after it.

        e.g. unhide.exe -f

        Note that this is unsupported so might cause a problem – probably best to just use attrib

  15. anna c says:

    This is very helpful. Thank you very much for coming up with this solution. I was very close to panicking just a few minutes ago when my micro SD was infected by a trojan that hid 8GB worth of data. Admittedly, I was a bit skeptical at first but when I saw the files reappear one by one, I was truly relieved.