Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm working on a Windows XP computer that had the unfortunate experience of being infected by mal-ware that pretty much disabled everything. I was able to clean the computer using a combination of offline tools (MS Defender Offline, etc...) Although the computer is clean, I can no longer see any files, right click on the desktop, start task manager, etc... I know how to fix all these problems by hand including setting the file attributes and editing the registry but I am hoping to save myself hours of searching for every problem. Not to mention the unwanted problems that can occur when you unhide and unsystem files that weren't meant to be visible. Is there a tool somewhere that will reset all the restrictions in the registry to default and unhide only those files that shouldn't be hidden all in one crack?

share|improve this question
    
Was it this malware? If so then i've encountered it and can give you some pointers relating to the thread linked :) –  HaydnWVN Jan 11 '12 at 16:22

4 Answers 4

up vote 2 down vote accepted

For the hidden files: run ATTRIB -h c:\*.* /s /d. It won't reset system files though. I would then run Malwarebytes AntiMalware to get the task manager, desktop and other security settings working properly again

share|improve this answer

This free tool solved for me the problem. It needs to be copied in the folder of the hidden files. https://sourceforge.net/projects/fixhiddenfilesmalware/

share|improve this answer
    
Please quote the essential parts of the answer from the reference link, as the answer can become invalid if the linked page changes or the target site is unreachable/permanently offline. In any case this program is for issues with a USB thumb drive so is not an answer to the question. –  DavidPostill Oct 19 at 5:53

Under step 19 from cleaning the "System Fix" infection (which is one that hides everything) from Bleeping Computer:

19.This infection family will also hide all the files on your computer from being seen. To make your files visible again, please download the following program to your desktop:

Unhide.exe

Once the program has been downloaded, double-click on the Unhide.exe icon on your desktop and allow the program to run. This program will remove the +H, or hidden, attribute from all the files on your hard drives. If there are any files that were purposely hidden by you, you will need to hide them again after this tool is run.

I've used it and it worked as expected.

Here's a direct link to the Unhide.exe download, ensure that ALL infections/rootkits are removed first, or it maybe prevented from running. :)

share|improve this answer

I would start here Malware repair

I have seen this infection and even using all tools mentioned in a number of articles, each infection resulted in a format and re-install. In one case I recovered data, in the other data was lost.

I had this from an online source. I have not been able to try it yet and can't find the source again

•Lives usually in “all users’ directory. Sometimes in the root of ‘all users’ and sometimes under \application data\temp, and sometimes both. Go to folder options to show all files and hidden OS files to see them again. This does NOT change their ‘hidden’ value. That gets taken care of later in the attrib below.

•The registry entries usually don’t exist. It appears to be controlled from a malicious copy of ‘c:\windows\system32\shell32.dll. Rename it to .old to start fixing things else it will reappear every reboot. The quicker you do this the better it seems to be. When you start viewing the \system32 directory structure it seems to trigger some unusual activity.. either re-hiding the files again or propagating other trojans. I got Jason’s renamed within about 5 or 7 seconds and it appeared to be ok..

•The startup program name (i.e. npl3749fqld.exe) and directory location is usually only referenced in ‘docs\all users\start menu\programs\startup’ and msconfig. Here you will see your startup file name ‘whatevername.ini’. Edit the file to view the location and name of the actual Trojan file. Editing the file does not seem to trigger anything. I think this is only a reference for startup for propagating the virus.

•Once you find the location info the actions are just like all the other virii. Rename it. Search for it in registry. Delete it. Delete all temp folders for ‘all users’, ‘default user’, the actually user, and any other profiles on the machine. This virus will set the whatevername.ini file for each and every user on the box. You must clean them all including the temp files.

•The attribute to unhide all files is ‘attrib -s -h -r c:/. /s /d’. It will take some time to run, but must be run under an administrator account or it will fail. It can be run in safemode or normal startup

•You can run mssec under safemode to search but it must be done manually as your startmenu items will be hidden until restart, which you don’t want to do unless you’re sure. This one is a bitch..

Sidenote... If, in c:\docs\users\all users\ you see a folder called “Microsoft Anti-Malware’ or some variation, delete it. This is NOT MS Anti-malware product. I don’t know if it was related to this virus or not, but it was on one system box. The proper location for anti-malware is under c;|program files\microsoft security client\ which is where you will also find the msseces.exe file to to a virus scan before restarting.

share|improve this answer
    
- The startup program is random. Also, if you don't specify the -s and -r switch in the Attrib, you don't unhide system files (i.e. all the Desktop.INI files) –  Canadian Luke Jan 11 '12 at 17:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.