Saturday, January 22, 2011

Simple guide on how to unhide directories in your USB drive hidden by a worm virus

One of the problems that most end-users encounter after inserting their USB drive to an infected pc is that, they thought their directories/folders were deleted by a virus. Most of the time, their folders were just hidden by a virus and created an .exe or .scr files that have the same name with your hidden folders and mimicked the appearance of your folder so the user could be fooled to click them. Another problem is that, you can't just simply unhide your files by choosing "Show hidden files and folders" from your Folder Options. Why? It's because the virus modified the folder's attribute into System and Hidden. By default, protected operating system files are hidden even if you choose to show hidden files.



Now, let’s assume that your usb drive was already cleaned by an anti-virus. So let’s start to unhide files/directories by following these simple steps.

1. Open Run dialog box by clicking Start Menu, then Run. You could also just simply press window key + R on your keyboard.

2. Type cmd then press enter to load MS-DOS Prompt.


3. Change drive by typing the drive letter of your removable drive with a colon, then press Enter key.


4. (optional) You might also want to know what files or directories were hidden. You can view them by typing dir/ah.


5. Now let’s clear the attributes of files, folders, and subfolders by typing attrib *.* -s -h /s /d then press Enter. This will take some time to unhide depending on the number of files in your storage.

You could also type the same command into a Notepad then save in your storage device as batch file (ex: unhide.bat). In that way, you don’t have to start from step 1 in-case it happens again. Instead, you just have to execute by clicking the batch file.

I hope you find this simple instruction helpful. Try to visit my page after maybe a couple of days. I will be posting a blog that solves the same problem but in a more convenient and faster way using windows scripting.

Much faster script written on VBS copy and paste it on notepad and save it as VBS. To run Just right click and select command prompt.

pc_drive = InputBox("Input drive letter" & vbnewline & "example: E:\", "Drive","E:\")
ryt = Right(pc_drive,2)
   If Len(pc_drive) <> 3 or ryt <> ":\" Then
   Call MsgBox("Either your input was invalid or the drive you specified doesn'texist",vbokonly,"Error")
End If


Set FSO = CreateObject("Scripting.FileSystemObject")
ShowSubfolders FSO.GetFolder(pc_drive)


Sub ShowSubFolders(Folder)
   str =""
   For Each Subfolder in Folder.SubFolders
      str =str & " " & Subfolder.Path
      subFolder.Attributes = 0
      ShowSubFolders Subfolder
   Next
End Sub



Reference1:
Reference2:

No comments:

Post a Comment

If you have any suggestion or clarification you send it via on this form.