Yesterday I traded some files with a friend by hooking up an external hard drive to his computer. I had created a folder with some files in it for him and likewise created another folder for him to copy miscellaneous audio and video files into. Everything seemed to work normally.

When I got back home and plugged the drive back into my laptop, my virus protection picked up something strange, but was able to remedy it immediately. The drive is working normally, and everything else on it is as it should be, but the folder that my friend copied files into is completely empty. Also, the folder I had created with stuff for him is missing entirely, including the folder itself. However, I can see from the amount of memory being used that all the files in both folders are still there somewhere. To make matters even weirder, a separate .rar file he had copied onto the drive containing some picture files is there and working completely normally, so not everything we copied was affected. And, as I said, everything else on the drive appears as it should be.

I've tried making hidden files visible in my "View Folder" configuration, and also tried to do so through the Command Prompt, but neither had any effect. Has anyone encountered something like this before and, if so, how did they fix it?

  • 1
    Which AV software, what does the AV software log say, were the items quarantined/deleted? – Tog Aug 3 '13 at 12:44
  • You make hidden files and folders visible: don't forget the system hidden files. You can do it easily with this: bleepingcomputer.com/download/show-hidden instead of Windows GUI or command line. – climenole Dec 25 '14 at 13:10

You may need to "take ownership" of these folders. If you are using NTFS it has a security feature which can lock you out of folders.

My computer select the affected drive. Right click and click on properties. Goto the security tab and click "Advanced" Click on Owner edit Select either your username,Administrator, or Everyone check the box "Replace owner on subcontainers and objects" Click OK

Wait patiently for the operation to complete. Then check and see if that helps.

  • It would be unusual for external media to use NTFS, Fat32 or exFat are much more common in external storage devices for cross-platform compatibility reasons. – Cliff Armstrong Jul 14 '17 at 2:10

This is a VERY common virus which reproduces itself by making a copy of itself onto any USB device plugged to the infected computer. I bet the antivirus would have deleted these files - 'New Folder.exe' , 'autorun.inf' and 'Recycler'.

Your friends folder has not been deleted. It has simply been hidden.
To view hidden folders,
On an explorer window,
GO to Organise --> Folder and search options --> View --> Select Show hidden files and folders --> Apply.

Now the folder will become visible.
Right click on it --> Deselect Hidden checkbox and click apply.

  • Thanks for answering, but as I wrote, I already tried making hidden files visible, and the files are still not there. – John Morgan Aug 3 '13 at 12:20
  • The newer version of this virus regenerates itself as soon as the antivirus deletes it. Update your antivirus and run a full system scan. To access the folder, try remembering the folder name and access it by directly writing its path in the path bar. – user241704 Aug 3 '13 at 12:23
  • I have Kaspersky and it hasn't detected anything with quick scan. A full scan will take a while. In the meantime, the files still are not visible even if I enter its path. – John Morgan Aug 3 '13 at 12:34
  • Use command prompt and see if the folder exists. Use dir command. – user241704 Aug 3 '13 at 13:06
  • One of them is there. The other is still not. – John Morgan Aug 3 '13 at 13:32

Go to "Start" and type "cmd" in the search bar, . Command prompt will show up in the search - right-click on it and choose "Run as admin". Now, enter the following in the command prompt: attrib -h -r -s /s /d x:*.* where "x:" is the letter of your external hard drive.

Check your hard drive for the hidden folders

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.