All My Files and Folders are Hidden after Rogue Virus attack

Lately there has been a constant stream of rogue antivirus software that hides all the files and folders on your hard drive, including everything in the users directory like documents, pictures, etc. as well as all the shortcuts on the Start Menu and more. The virus adds the hidden attribute to every file and folder on your system, so it appears as if everything has been deleted from your hard drive. If you've been hit by one of these viruses, follow the instructions below to unhide your files and regain control of your computer again.

If your system is still infected with a rogue antivirus, please follow the instructions on how to remove these rogue malware programs. After the malware has been removed, follow these steps to unhide your files and folders.



First, let's unhide your files by changing the system settings of Windows.

For Windows XP

1) Open My Computer
2) Click on Tools
3) Click on Folder Options
4) Click on the View Tab
5) Place a dot on the option "Show Hidden Files and Folders"
6) Click Ok

For Windows Vista

1) Click on the Windows Orb (Start button)
2) Click on Computer
3) Click on Tools
4) Click on Folder Options
5) Click on View
6) Click the option for "Show Hidden Files and Folders"
7) Click Ok

For Windows 7

1) Click on the Windows Orb (Start button)
2) Click on Computer
3) Click on Organize
4) Click on Folder and Search Options
5) Click on View
6) Click the option for "Show Hidden Files and Folders"
7) Click Ok

Now you should be able to see all of your files and folders. However, they still have the hidden file attibute set. When we remove the hidden attribute on the files and folders, all of your files should reappear normally.

To Unhide files and folders that Windows Diagnostic, Windows XP Restore and other malware hide


For Windows XP

1) Click on Start, Run
2) Type CMD and press Enter
3) At the command prompt type the following and press Enter

CD \

4) Now the command prompt should show the root folder of the hard drive. Most likely C:\
5) At the command prompt type the following and press Enter

ATTRIB -H *.* /S /D

This command will unhide the files that are currently hidden. Because the important system files have a system attribute attached to them as well, the above command will not work for them and they will be skipped and kept hidden from prying eyes.

This command will take some time, so dont be afraid if it takes anywhere from a few minutes to half an hour to finish. What the command does is simple. It removes the hidden attribute from all files on the hard drive. The /S parameter tells it to search the current folder and all subfolders, while the /D parameter processes tthe folders as well.

6) Type Exit and press Enter when the procedure is complete. Then reboot your computer

For Windows Vista/7

1) Click on Start, All Programs
2) Click Accessories and Find Command Prompt
3) Right click on the Command Prompt option and choose Run as Administrator
4) At the command prompt type the following and press Enter

CD \

5) Now the command prompt should show the root folder of the hard drive. Most likely C:\
6) At the command prompt type the following and press Enter

ATTRIB -H *.* /S /D

This command will unhide the files that are currently hidden. Because the important system files have a system attribute attached to them as well, the above command will not work for them and they will be skipped and kept hidden from prying eyes.

This command will take some time, so dont be afraid if it takes anywhere from a few minutes to half an hour to finish. What the command does is simple. It removes the hidden attribute from all files on the hard drive. The /S parameter tells it to search the current folder and all subfolders, while the /D parameter processes tthe folders as well.

7) Type Exit and press Enter when the procedure is complete. Then reboot your computer

Alternative to CMD Prompt Commands


As as alternative, there is a program that was created by the folks at Bleeping Computer that unhides these files as well. They have their own tutorial on how to use unhide.exe You can download unhide.exe to your desktop and run it to do the same thing as the above procedure.

Fix Problems with Hidden Start Menu icons and Taskbar/Quick Launch Icons

Many times after removing these new rogue programs and unhiding files, I find that the Windows XP/Vista Quick Launch icons, and the Windows 7 taskbar icons are not working. Also, icons in the Start Menu are either completely gone or not working. These new rogue malware programs take these files and move them to a temporary directory, so when the computer is restored to working order these shortcuts still don't work.

Follow the steps below to fix these shortcuts on the Taskbar and Quick Launch toolbar

For Windows XP

1) Open My Computer
2) Double click on
  • Drive C
  • Documents and Settings
  • Your User Name (this is replaced with the actual user name)
  • Local Settings
  • Temp
  • SNTMP or SMTMP
3) You'll find several folders here labeled with numbers (1, 2, 3, 4).
4) Open Folder 1
5) Folder 1 contains the All Users Start Menu shortcuts. Click on Edit, Select All, and Copy the files in this directory
6) Leave this folder open and Reopen My Computer again
7) Go to the following location
  • Drive C
  • Documents and Settings
  • All Users
  • Start Menu
8) Click on Edit and Paste in this folder to copy the Programs folder and other shortcuts back to their appropriate location
9) Go back to Step 3 and open Folder 2. Folder 2 contains the Quick Launch shortcuts
10) Copy these files by selecting all and choosing Copy again (see step 5 for more info)
11) Open the following location
  • Drive C
  • Documents and Settings
  • Username
  • Application Data
  • Microsoft
  • Internet Explorer
  • Quick Launch
12) Paste the files from Folder 2 to this location

13) Folder 3 appears to contain Windows 7 Taskbar icons (not needed in Windows XP)

14) Folder 4 does have Desktop  icons that you could copy and paste as well. Using the procedure outlined above, copy the contents of Folder 4 to the location

C:\Documents and Settings\All Users\Desktop 

For Windows Vista

1) Open Computer
2) Double click on
  • Drive C
  • Users
  • Your User Name (this is replaced with the actual user name)
  • AppData
  • Local
  • Temp
  • SNTMP or SMTMP
3) You'll find several folders here labeled with numbers (1, 2, 3, 4).
4) Open Folder 1
5) Folder 1 contains the All Users Start Menu shortcuts. Click on Edit, Select All, and Copy the files in this directory
6) Leave this folder open and Reopen My Computer again
7) Go to the following location
  • Drive C
  • Program Data
  • Microsoft
  • Windows
  • Start Menu
8) Click on Edit and Paste in this folder to copy the Programs folder and other shortcuts back to their appropriate location
9) Go back to Step 3 and open Folder 2. Folder 2 contains the Quick Launch shortcuts
10) Copy these files by selecting all and choosing Copy again (see step 5 for more info)
11) Open the following location
  • Drive C
  • Users
  • Username
  • AppData
  • Roaming
  • Microsoft
  • Internet Explorer
  • Quick Launch
12) Paste the files from Folder 2 to this location

13) Folder 3 contains Used Pinned Task Bar icon. So you'll want to copy those files to the following location:

C:\Users\<your login name here>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

14) Folder 4 contains Desktop icons for all users. Copy these icons to the following location:

C:\Users\Public\Public Desktop

For Windows 7

1) Open Computer
2) Double click on
  • Drive C
  • Users
  • Your User Name (this is replaced with the actual user name)
  • AppData
  • Local
  • Temp
  • SNTMP or SMTMP
3) You'll find several folders here labeled with numbers (1, 2, 3, 4).
4) Open Folder 1
5) Folder 1 contains the All Users Start Menu shortcuts. Click on Edit, Select All, and Copy the files in this directory
6) Leave this folder open and Reopen My Computer again
7) Go to the following location
  • Drive C
  • Program Data
  • Microsoft
  • Windows
  • Start Menu
8) Click on Edit and Paste in this folder to copy the Programs folder and other shortcuts back to their appropriate location
9) Go back to Step 3 and open Folder 3. Folder 3 contains the Windows 7 Taskbar shortcuts
10) Copy these files by selecting all and choosing Copy again (see step 5 for more info)
11) Open the following location
  • Drive C
  • Users
  • Username
  • AppData
  • Roaming
  • Microsoft
  • Internet Explorer
  • Quick Launch
  • User Pinned
  • Taskbar
12) Paste the files from Folder 3 to this location

13) Folder 3 contains Used Pinned Task Bar icon. So you'll want to copy those files to the following location:

C:\Users\<your login name here>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

14) Folder 4 contains Desktop icons for all users. Copy these icons to the following location:

C:\Users\Public\Public Desktop

Final Step: Set Files and Folders to Hidden Again

Now that we have reset the hidden attribute, you'll want to follow the instructions at the top of this page to hide the hidden and system files again. The purpose of doing this is to protect the system files from being shown and possibly being deleted from the system by someone.
Now reboot your computer and double check the Start Menu shortcuts and Quick Launch and Taskbar icons to make sure they all work again.


Written by Mark Hasting





Links to Other Important Information

Support for Windows XP and Windows Vista without latest service packs ends in 2010

How to Fix 500 Internal Server Error in PHP 5.4 scriptnew

Computer shows Stop error and Continously Reboots after SP3 installed.

Product Key Does Not Match Current Windows SKU Errornew

Review of FastAgain PC Booster and How to Uninstall itnew

How to Remove MSBLAST.EXE worm

How to Remove Content Advisor Password in Internet Explorer

How to Remove Incredimail Automatically

How to Fix Problem of Limited or No Connectivity After installing Windows XP Service Pack 2

How to Recover From a Corrupted Registry in Windows XP

How to Speed Up Windows Boot Time

Acer ERecovery Service is Not Available

Acer Recovery CD Restore Failed Reason: 0xf0000051

How to Fix Problem with No Active Mixer Devices Available in Windows XP

Parents Guide to MySpace.com - a report every parent should read

Save and Restore Desktop Layout of Icons

What is Windows Genuine Advantage and How to Overcome Problems With It

Change Forgotten Administrator Password in Windows XP/2000/Vista

Not Enough Server Storage Error When Connecting to Computer on Network

Installing Windows Vista Upgrade on a Blank Hard Drive

How to Delete Your Windows Vista Logon Password

Remove Unwanted Icons from the Windows Vista Welcome Center

Cannot Connect to Network Printer with Windows Vista

How to Wipe, Delete, Degauss, and Destroy Data on a Hard Drive

Fixing RTHDCPL.EXE - Illegal System DLL Relocation Error in Windows XP

How to Fix Blank or Missing Title Bar in IE9

Unable to Open New Tab in IE9 - Spinning Favicon

Fix 404 Errors for /apple-touch-icon-precomposed.png and /apple-touch-icon.png new

What is the Config.Msi folder and Can I Delete It?

Flash Player Installation Issues

How to Set Yahoo Mail as your Default Email Program

Unknown File in Winsock LSP - NWPROVAU.DLL - Can it be Removed?

How to Delete a Service in Windows Vista

How to Disable the On-Screen Keyboard in Windows Vista

Make Disk Cleanup Run Faster

What is CTFMON.EXE and How Can I Remove It

How to Export MSN Favorites to Internet Explorer

How to Fix Registry Editing Has Been Disabled By Your Administrator Error

How to Change Default Editor in Windows and Fax Viewer

How to Fix Problem when Windows Security Center reports multiple antivirus programs installed

How to Fix Problem when Windows Updates will download but will not install

How to Fix Problem when Windows Automatic Updates Service wont Start

Cannot Download Files With Internet Explorer

How to Keep Your Computer Up-to-Date

How to Fix the Prompt for Click to Run an ActiveX Control on this webpage

How to Remove "This Page Contains Both Secure and NonSecure Items" Warning Message

How to Fix Problem with Blank Add/Remove Control Panel

How to Fix Windows Vista Update Error 80244019

Troubleshooting An Error Occurred During Directory Enumeration

How to View and Decipher Minidump files created by Blue Screen error messages

How to Fix BLService Error on HP Computer in Vista

Google Adsense Hijacking - How to Respond

Windows Defrag Does Not Complete

Review of BigString Recallable Email

Fix Incorrect Time Stamp on Hotmail Messages

Deleting or Editing Typed URLs in the Internet Explorer Address Bar

Belarc Advisor - Quick Computer Inventory Software

How to Get Out of Full Screen Mode in Internet Explorer

How to Correct Missing "Copy to CD" option in My Pictures Tasks

How to Fix Code 39 error with CD or DVD Drive

How to Fix Problems When Windows Installer Popups Error With Missing .MSI Files

How to Fix Problems When Network Setup Wizard and Network Connections Won't Open

How to Fix Problems with Windows Help Errors

How to Delete Individual Entries from Run Command History

Foxit - Adobe Reader Alternative

How to Fix Autochk Program Not Found error

Difference between Master/Slave and Cable Select on a Hard Drive

How to Use Microsoft SyncToy to backup your important files

How to Delete Temporary Internet Files, Cookies, and History files

Review of PCDecrapifer Software Removal Tool

How to Fix Security Flaw in Adobe Reader

Computer Speakers Sound like Chipmunks

How to SVCHOST.EXE Application Error 0x745f2780

Troubleshooting the Unmountable Boot Volume Error in Windows XP

How to Disable, Uninstall, and Remove Windows Messenger instant messaging from Windows XP

How to Remove Windows Messenger in Windows XP

Free DVD Decoder Software and Help

Free CD Burning Software and Help

How to Use Remote Desktop to Access Multiple Computer on Your LAN

HijackThis Tutorial for removing Spyware

Review of Adsense Detective, Getting Stats and Results from Adsense

How to Disable System Restore in Windows ME or Windows XP

How to Uninstall Internet Explorer 7

How to Install NetBEUI in Windows XP

What is the KB891711.exe file in Windows 98 or Windows ME?

How to Troubleshoot and Solve USB Device Error Code 10

Spooler Subsystem App has encountered a problem and needs to close Error and How to Fix it

How to Fix Problem opening Microsoft Outlook

How to Disable News Headlines in Netscape

How to Bring Back Missing Folders in Netscape Communicator

How to Fix Access Denied Error when Using MSCONFIG

How to Fix HPQKBFiltr.Sys Keylogger Error in Kaspersky Antivirus

How to Backup and Restore Outlook Express Mail, Address Book, Blocked Senders List and other Settings

How to Fix Error 501 Permission Denied when changing fonts in Outlook Express

What is the Tilde (~) File on my Desktop?

What is the thumbs.db file and can I remove it

Password is Not Saved in Outlook Express or Outlook in Windows XP

Allow Viewing of Attachments in Outlook Express 6

How to Fix Problem of No Spell Check in Outlook Express

How to Fix Problems Viewing or Accessing Secure Web Sites

How to Start or Boot Windows into Safe Mode

What is the Winmail.dat file attached to emails?

How to Correct Unreadable Fonts in Norton Antivirus or Norton Systemworks

How to correct issue with No Visible Menu Bar or Tabs in Windows XP Task Manager

How Disable/Enable the Windows XP Welcome Screen

How to Fix RTLGINA2.DLL error with Windows XP Welcome Screen and Netgear WG111

How to Fix Windows Update Error 0x80070420

PopUp Ad Removal Software and Help

Review of ErrorNuker program to identify and fix problems with the Windows Registry

Spyware and Adware Removal Help

Review of Netflix Online DVD Rental

Recommended Software for PC Hell Visitors