How to restore files hidden by viruses or malwares?

December 2016


How to restore files hidden by viruses or malwares?


Your computer was infected by a virus and you successfull clean the infection.
Issue: Files or folders are missing!
This trick can help. Is important to check for the presence of infected files which may still be present on your computer (hidden). You should also delete temporary files as some of them may be infected!

Enable this display of hidden files:

  • Right-click on your desktop > Arrange icons by.
  • Check "Show desktop icons".

If the problem persists:
  • Go to My Documents> Tools tab.
  • Click on Folder Options > View tab.
  • Check "Show hidden files and folders".

The "Show hidden files and folders option is missing".
  • Open the registry editor:
  • Go to:
  • HKEY_LM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\Showall
  • Edit the following entries :
    • CheckedValue = 1
    • DefaultValue = 0
  • HKEY_LM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\Nohidden
  • Edit the following entries :
    • CheckedValue = 0
    • DefaultValue = 0

Softwares

RogueKiller

  • Download RogueKiller on your desktop.
  • Quit all running programs.
  • Under Vista/7, right click > Run as administrator.
  • Otherwise just run RogueKiller.exe (in some cases you will need to rename RogueKiller.exe as winlogon.exe).
  • When prompted, select "Racc. RAZ" to restore your missing shortcuts.
  • A report will be generated at the end of the procedure (RKreport.txt).

UsbFix

  • UsbFix can restore legitimate files being hidden by a malware or virus on your USB drives
  • It can also clean your PC and USB drives if the infection is still present.
  • Download from: http://www.usbfix.net/

Pre_Scan

  • Download Pre_Scan on your desktop,
  • Before launching the software you will need to disable your current antivirus protection.
  • Here is a report with Pre_Scan reassigning objects:


¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤

External drives : 23564 Objets reassigned
Local drive : 125 Objets reassigned
Users: 0 Objets reassigned
ProgramFiles : 12629 Objets reassigned
Music : 14522 Objets reassigned
Pictures : 13332 Objets reassigned
Videos : 544 Objets reassigned
Downloads : 0 Objets reassigned
Desktop : 3665 Objets reassigned
Links : 0 Objets reassigned
Searches : 0 Objets reassigned
Contacts : 0 Objets reassigned
Saved Games : 0 Objets reassigned
Favorites : 118 Objets reassigned
Documents : 0 Objets reassigned
Windows : 1822 Objets reassigned
StartMenu : 0 Objets reassigned
Librairies : 0 Objets reassigned
Quick Launch : 0 Objets reassigned
%AppData% : 2854 Objets reassigned
¤

End: 5:31:04

¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ (EOF) ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤ ¤

ZHPFix


ZHPFix can also restore files hidden by infections via the HiddenFix option:
  • Download ZHPFix
  • Run it.
  • Click on the HiddenFix option.

FindyKill

  • This software can repair the safe mode and restore hidden files after infection ...
  • Download FindyKill.

Unhide

  • Unhide is a utility that will scan for hidden files and restore them.
  • Download Unhide.

Virus Effect Remover

  • Virus Effect Remover is a software that allows you to negate the effects of virus infections from the Windows registry and system files.
  • It can also detect the registry errors caused by viruses and unlock the utilities that have been disabled by the virus: Registry Editor, Task Manager, Folder Options or the command line .

Fix errors using the Windows installation disc

  • Errors resulting from virus infection can be repaired using the Windows disc (repair registry, restore hidden files....).

Reinstalling Windows

  • In some cases a complete reinstallation of Windows is required.

Related :

This document entitled « How to restore files hidden by viruses or malwares? » from CCM (ccm.net) is made available under the Creative Commons license. You can copy, modify copies of this page, under the conditions stipulated by the license, as this note appears clearly.