We do believe that everyone has experience with computer viruses and most of it is a bad experience. Today I will share 3 simple steps to show hidden files corrupted by virus Infections in windows PC. This tips and trick purpose is to help you who have difficulties showing hidden files because of virus infection.
This tips and trick are for Windows users because the most virus in the wild is targeting the Windows operating system since they have the largest users in the world.
How to Show Hidden Files Corrupted by Virus Infection
Step 1. This is the screenshot of my USB content after I plug into infected computer.
The virus hides all my files and folders as well and changes everything into a shortcut that calls Documents.vbe when executed.
The virus changes the files and folders attribute by using the system user, so when you try to change the attribute by right-clicking it, you can’t change a hidden attribute.
Step 2. Open your command prompt and go to your USB drive. In our case the USB is in E: drive.
attrib -H -S E:* /S /D
Here is what an attribute stands for and what it does in command prompt.
- H: Hidden file attribute
- S: System file attribute
- E:*: Drive of the USB with * as a wildcard that means process all files.
- S: Processes matching files in the current folder and all subfolders.
- D: Processes folders as well.
Step 3. Turn off Autorun for all of the removable media. And remember Do not double-click your USB folder to prevent the virus from spreading into your system.
To delete the virus manually, you can open REGEDIT, choose EDIT tab and click Find (Ctrl + F).
In the search box type “documents.vbe”. If your search result returns nothing it’s mean that you’re not infected by this kind of virus if your search result returns some value like the picture below:
Write down the Documents.vbe path location, and delete the Documents.vbe manually from that folder. If you cannot delete the Documents.vbe because it is used by another program, go to task manager(CTRL+ALT+DEL) and find Wscript.exe.
Right-click and choose “End Task” to stop the Wscript.exe process and try again to delete the Documents.vbe. Don’t forget to delete the registry containing Documents.vbe too.
That’s it you have successfully recovered hidden files caused by virus infection in the PC. In this way, you can show hidden files corrupted by virus in PC.