Recovery hidden files after the virus is a common problem that PC users have to deal with. IN lately many suffer from malware, which causes all files and folders on the hard drive to disappear, including personal content such as documents, images, etc. Malicious software may hide all shortcuts in the Start menu. The virus does not delete the data, but adds a hidden attribute to all files and folders on your system, and as a result it looks as if all the data has been deleted from hard drive.
If you need to recover files from a virus, you can use the instructions below to display all the data that was lost again and regain control of your computer. In the case when operating system still infected with malware, you need to use antiviruses. After removing the viruses, you can proceed to display files and folders that have disappeared. To display the missing files, you need to change the Windows system settings.
How to display hidden files
If you have an operating system installed windows system XP, you can recover data that is lost by performing the following steps:
- open My Computer;
- select Tools;
- click on Folder Options;
- select the View tab;
- check the box next to the Show Hidden Files and Folders option;
- click OK to return the missing data from the hard drive or flash drives.
To recover data that was lost on Windows Vista, you need to follow these steps:
- press the Start button;
- choose Computer;
- click on Tools;
- select Folder Options;
- use the View button;
- select the option Show Hidden Files and Folders;
- click OK.
If you are interested in how to recover hidden files on Windows 7, you must do the following:
- press the Start button;
- choose Computer;
- click Organize
- use the Folder and Search Options button;
- select View;
- activate the option Show Hidden Files and Folders;
- click OK.
After performing the above steps, you will be able to see all your files and folders for office programs and other applications, but they will still contain a hidden set of attributes. If you remove the extra parameters for files on a USB flash drive or hard drive, then all of them will be displayed in normal mode.
How to remove hidden attributes
If you are using the Windows XP operating system, you need to perform the following steps:
- Click Start and Run.
- Type cmd and press Enter.
- IN command line type CD \\ and confirm with Enter.
- Enter ATTRIB -H *. * / S / D and press Enter. This command will display files that have become invisible. Because important system files have a corresponding attribute attached, the above command will not affect them. System settings skip them and hide them from prying eyes, so that the most important content will not be lost. The execution of the command will take some time, so do not worry if the process drags on for several minutes or even for half an hour. The team will perform simple actions - remove hidden attributes from all directories on the hard drive and folders on the USB flash drive after the virus. The / S switch means that the current folder and all its subdirectories will be searched. The / D switch processes all other folders.
For Windows Vista or 7, do the following:
- Click Start and All Programs.
- Select Accessories and Find Command Prompt.
- Right-click on the Command Prompt option and select Run as Administrator.
- At the command prompt, enter CD \\ and press Enter.
- Now, the root folder of the hard drive (probably C: \\) should be indicated on the command line.
- Enter ATTRIB -H *. * / S / D and press Enter.
- Enter Exit and press Enter when the procedure is complete. To restart a computer.
Alternatively, you can use the Unhide application created by Bleeping Computer. This is a program to recover hidden files from a USB flash drive and hard drive. On the official website of this developer there is a whole tutorial on using unhide.exe for deleted data after a virus invasion. With it, users received necessary information and successfully restored their PCs. You can download this application for hidden folders and files to your desktop and run it, so that the above steps to remove attributes from a flash drive after a virus are automatically performed by the system.
Troubleshoot shortcuts in the taskbar and Start menu
To display shortcuts on the taskbar and in the Start menu after a virus attack, you need to perform the following actions:
- Open Computer.
- Go to Drive C, Users, Your User Name, AppData, Local, Temp, SNTMP or SMTMP.
- Open the directory with the number 1.
- Select Edit, Select All and Copy.
- Leave the directory open and go back to My Computer.
- Select Drive C, Program Data, Microsoft, Windows, Start Menu.
- Click Edit and Paste to copy the Programs folder and other shortcuts to the appropriate location.
- Open the directory with the number 3.
- Select all files and copy them.
- Go to Drive C, Users, Username, AppData, Roaming, Microsoft, Internet explorer, Quick Launch, User Pinned, Taskbar and paste files.
After performing the above steps, all labels should return to their places.
Recently, I encountered such a problem. It was necessary to prepare a bunch of documents on the informatization of OS. Spent a lot of time on this, created provisions acts, etc. I threw the information on a USB flash drive, I forgot to save a copy on the screw. Because I have one flash drive, according to the specifics of my work, I have to drag it to different places where various anti-virus programs are installed. And then one fine day, I come to the organization (on the computer of which NOD32 is installed), insert the USB flash drive and frantically observe how the files and folders from my flash drive quickly disappear, and Nod32 maliciously smiles and makes unpleasant sounds with enviable persistence deletes everything, with the information accumulated by me by labor. Can you imagine my expression? What to do? 75% of the information, dear to me, flew into tar-tarara.Reprint everything? Bad idea! So I started to make up the Internet in search of recommendations for data recovery.Imagine my surprise when, after a 2-hour search, I did not find anything worthwhile. He sat down and began to think. And he found the same way, or rather two ways, how can I get my information back.
Method number 1
Download MiniTool Power Data recovery 6.5. This is a data recovery program not only with hard drives, but also various memory cards. Power Data Recovery will help you in cases of data loss due to disk formatting, virus attacks, power failures. Able to work with different systems, from FAT of all types to NTFS. There is a wizard in the program that will help you recover all your lost data step by step. I have not experienced any difficulties with the program. But still I will describe a certain procedure. Download the program from the link below. Install. Run the program. In the main window, select the image of the basket with the inscription Undelete Recovery. In the next window, select the one we need hard section disk, or the flash drive from which the information was deleted and on the left click the Recover button. And lo and behold, in the window that appears, we see both the contents of our flash drive and the folders and files that were deleted. Further, the algorithm of actions is intuitive. We select the files we need and folders, put checkmarks near them and press the Save Files button. We indicate the path for the recovered files and enjoy the resurrection of our treasured information. But there are pitfalls! Some files, especially Word, are restored, but when opening, an error occurs in the encoding of files, because of which all text inside the file is displayed broken. There is nothing to be done, but there is a second way.
To download the program, click on the picture!
Method number 2
The essence of the second method is to recover lost (deleted) files using the same antivirus that deleted them. To do this, go to the antivirus settings and find the "Quarantine" tab. There you will see all files deleted by a malicious antivirus. Select the file we need, right-click and select "restore". A file is usually restored to the same place from which it was deleted. But, it is worth noting that the restored file still contains the body of the virus and is potentially dangerous. In order to avoid this, you must open the file to copy its contents. Next, create a new document (with regards to text documents) and using paste, paste the previously copied information into it. After that, save the file under a different name. The old (virus) file can be safely deleted.
If after hard check If you find that the necessary information is missing, then do not rush to remove the protective software. Hidden files can be restored without resorting to utilities such as Recuva or TestDisk.
Restore from quarantine
The anti-virus program did not delete the data, but only hid it, placing it in a special storage - quarantine. You can recover hidden files using the antivirus utility interface. For example, if you checked the system with the Kaspersky Virus Removal Tool, then do the following:
The deleted file will be returned to the folder from which it disappeared after scanning the system. Make sure that there is no virus inside the data you recovered. The antivirus program may also be wrong, but it is better to check the files with several utilities. If the files disappeared after cleaning the computer with ESET Smart Security antivirus, then you can restore them like this:
In the list you will see all hidden files that were marked by the program as suspicious. Perhaps there is no virus among them, but you should only return the file of which you are sure of security. Right click on it and select “Restore”. 
The file deleted after the anti-virus operation will be returned to the folder in which it was before the virus was searched on the computer. If this folder does not exist, a Windows Explorer window will appear, through which you need to specify a new location for storing data.
Other antiviruses offer a similar procedure for recovering mistakenly deleted data. The only difference is the location of the quarantine: sometimes it is not possible to get to isolated information via the graphical interface of the program. If you encounter such a problem, try looking for a folder with a name like “Quarantine” in the anti-virus directory.
To see hidden folderscreated by antivirus:
If there is no quarantine in this folder, go back to AppData, but go not to Roaming, but to Local. There will also be an antivirus directory. Inside it should be a folder “Quarantine”, which contains hidden data.
Add to Exceptions
Restoring data is not enough - you still need to add them to the exceptions. Otherwise, the antivirus software will send the file to isolation again after quarantined data. Consider the algorithm for adding to exceptions using the ESET Smart Security example:
After saving the changes, the recovered files will not be prosecuted and deleted by the antivirus program. The order of adding to exceptions varies on different antiviruses, so you will have to look for this function in the settings yourself.
