Files and folders inaccessible

Question

It’s a sad day for me. Logging on to my Windows 7 system, I found I had no task bar icons, no desktop icons and no files in my start folders. Definitely not good!! Upon investigation, I found that the files and objects were there but hidden, and found that I could not unhide them. After many hours of attempted to repair, I chose to rebuild my system. In order to save my data, since I am the only user on this desktop I bought a new 1TB drive, formatted and partitioned it, and “rolled” off all my data to the new HDD.

My problem is all the data on the new drive is in the same state, read only and hidden.

Since we are talking about 100,000 files, mostly images, docx and xls files, is there a way, using takeown and icacls to set these files back to “factory” ownership and permissions.

---

Upon waiting for an answer to that question, I've further complicated the issue by "monkeying around" with the attrib command and trying to set permissions/and ownership using the Windows Explorer properties GUIs. Now in my folder My_Stuff, the Properties > General tab indicates that I have 5000 files and 400 folders (which I do have), but when I click to the My_Stuff folder, there are no files or subdirectories shown. My bad!

When I run the icacls . /T command on the My_Stuff directory, it shows ACEs for the 5000 files and folders, but when I run attrib, or dir, it shows no files or folders. I believe that the objects are still there, but I am no longer able to "see" them. How can I reset my permissions and/or ownership to have access to those files and directories?

The ACE for the folder My_Stuff is:

/My Stuff
D:AI(A;OICI;FA;;;S-1-5-21-1901188621-1686581908-1501539319-1000) (A;OICIID;FA;;;LA)(A;OICIID;FA;;;AU)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;BA)(A;OICIID;FA;;;BU)

The ACE to one of the subdirectories is:

My_hardware
D:AI(A;OICIID;FA;;;BA)(A;OICIID;FA;;;SY)(A;OICIID;FA;;;AU)(A;OICIID;FA;;;BU)

Any ideas! Help!

Bob B.

Answer 1

I had the "hidden file" issue once on a notebook that was hit by a fake diagnostic utility.

After the regular clean-up I couldn't get the visibility back even though I tried EVERY WAY imaginable.

I found this little utility http://www.bleepingcomputer.com/forums/topic405109.html called unhide. It may take care of the hidden files and folders, but I had to do a system restore to get shortcuts back in the start menu (though I could have just recreated them, sys restore saved time).

Answer 2

Sounds like malware(fakeAV or similar) as indicated by @Rob. Last I saw it it installed a rootkit that required a boot disk with anti-malware to remove. As @Rob found, the Unhide utility helped a lot but there were still issues. I reinstalled the last two times.

Answer 3

The fastest way to restore your files is to hook up the drive to another computer. That allows you to completely ignore the current security descriptors and reset them using a template.

Answer 4

Yes, I think it was an "Hiding all files" Virus/Malware.

Prior to seeing Rob and Dave's comments, I learned more that I cared to about the "icacls" command and reset all my files to full permissions on that disk. Sadly, that didn't do anything. That is a great command though... once you fully understand it.

Here is what did the trick:

attrib -s -h <partition/disk root> /S /D

The important thing here is the /S AND /D if you leave off the /D, the command will run through all files but NOT change directories. And while you think you've completely unhidden all everything, the directories are still hidden. I think the syntax is counter intuitive and not consistent w/ other DOS commands.

An alternative way is to use the Properties screen's General Tab and propagate through all folders. Here a point to note is that if you see that a directory is not hidden, that doesn't mean that lower folders and files are not still hidden. The trick here is to make this unhidden directory hidden and then immediately unhide it but check "apply changes to all all subfoldes and files"

I've read also that a virus like this also changes the Windows Explorer view option which allows viewing to hidden files. That's what got me in this mess in the first place.