3

When I enable hidden files and folders option on my personal computer it gets disabled immediately.

I have done some research and I have tried:

  • Changing it from the folder options menu

  • Editing the registery:

    • Changing in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" "Checked Value" to 1 and "DefaultValue" to 2 (everything was already fine)
    • Changing in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN" "Checked Value" to 2 and "DefaultValue" to 2 (everything was already fine)

    • Changing (without success) in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" "Hidden" to 1 (was/it is still to 0)

      I can't change that. I get this error: Screenshot (I can't embed yet)

      Permissions are fine (Screenshot) and I can edit everything else in this key.

      What can I do?

NOTE: It is not a duplicate of this

Edit: Fixed it. My Antivirus saved me by deleting a virus on boot!

| improve this question | |
  • Personal machine, or this is office / work machine (that may have group policy applied to it)? – Darius Aug 6 '17 at 21:54
  • Is this a personal PC or corporate? Group Policy may have been set intentionally by IT staff to prevent what you're trying... if it's not you own PC, ask IT. – DrMoishe Pippik Aug 6 '17 at 21:55
  • @Darius Personal. Also I have group policy – 1nikolas Aug 6 '17 at 21:55
  • @DrMoishePippik Personal. I don't know what's wrong – 1nikolas Aug 6 '17 at 21:57
  • The registry database may have been damaged. Try creating a new user account and testing it there. – Daniel B Aug 6 '17 at 22:00
3

This is not normal behavior. A 3rd party program is changing this setting--possibly a malicious one.

To determine what program is undoing your setting change, use Process Monitor to watch changes made to the system when you modify the Show Hidden Files option.

The basic process will look like this:

  1. Determine what setting is changed when you enable Show Hidden Files. You can probably do this by filtering the events ProcMon displays to only those actions performed by explorer.exe, then changing the setting in the UI.

    Note: Alternately, you could just start by monitoring the Registry value you've already determined you're being prevented from changing.

  2. Once you know what actions are triggered by changing the setting, adjust ProcMon's filters to watch for any changes made to the setting. For example, if the setting is a value stored in the Registry, set the filter to only show actions that modify that Registry value.
  3. Enable the setting and see what processes touch the setting. You should see the legitimate process followed by the unwanted process.

OR you could go with the likely guess that it's a malicious change and run a full virus scan.

| improve this answer | |
2

Because it works with the newly created user account, I arrive at the conclusion that the per-user registry database for your user account (NTUSER.DAT) is damaged. This could’ve been caused by defective RAM or your storage device (HDD/SSD), so you should check those for errors. Other causes include power loss, resetting the PC or BSOD crsahes.

You should create a new user account and transfer all settings to it. I’m not aware of an automated method to do so.

I also haven’t found a method to verify the integrity of a registry hive, let alone repair it.

edit No longer applies with the addition to the question, I’ll leave it here for others.

| improve this answer | |
1

I really had the easiest way to get rid of this virus i.e. just log into safe mode of your windows then go to file and folder option from there got to view tab and then press restore defaults and congo you successfully got rid of that virus now restart your pc

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.