How to unhide folders hit Win32/Dorkbot.D worm?

Question

After Win32/Dorkbot.D worm the folders become hidden and have system attributes (marked as critical system files). Cannot unhide folders using standard File Option dialog window. How to restore previous folders' attributes?

Answer 1

You cannot uncheck the Hidden attribute because the affected files/folders also have the System attribute enabled.

Steps to fix

1. Right click in the root folder/drive of the affected items while holding the Shift key and click Open Command Window Here
2. Enter the following command in the command prompt:
   for /f %F in ('dir /a:hs /b') do attrib -h -s %F

When the command finishes executing, your files should be restored and the Hidden attribute checkbox will also be enabled.

Answer 2

You may also try this simple windows script for unhiding files and directories. It only prompts the user to input the drive letter then executes the vbscript.

Run your notepad, copy the code below, then save it as unhide.vbs

pc_drive = InputBox("Input drive letter" & vbnewline & "example: E:\", "Drive","E:\")
ryt = Right(pc_drive,2)
   If Len(pc_drive) <> 3 or ryt <> ":\" Then
   Call MsgBox("Either your input was invalid or the drive you specified doesn'texist",vbokonly,"Error")
End If

Set FSO = CreateObject("Scripting.FileSystemObject")
ShowSubfolders FSO.GetFolder(pc_drive)

Sub ShowSubFolders(Folder)
   str =""
   For Each Subfolder in Folder.SubFolders
      str =str & " " & Subfolder.Path
      subFolder.Attributes = 0
      ShowSubFolders Subfolder
   Next
End Sub

You could save it in your USB drive for more accessibility. Instruction how to use it can be found in the link below.

Windows Script For Unhiding Folders Hidden By Worm Virus

Answer 3

The following command line executed on the affected folder works:

for /f %F in ('dir /a:hs /b') do attrib -h -s %F

...but this is not unhiding any folders with space in folder name e.g. "All Music" folder.

Answer 4

Go to the Command Prompt, then type attrib -s -h /s /dx:\*.*

Then presto!! 100% fixed :)