Some users are faced with an unpleasant situation: files that were on a USB flash drive disappear after connecting to a computer. If the user did not erase them on their own, then there is only one conclusion - there is a virus on the USB flash drive that did not delete, but only hid the data. Information can be restored in several ways.
Show hidden files
After detecting the loss of information, the first thing you need to do is configure the system to display hidden files.
Open removable drive and see what data is now displayed on the flash drive. Most likely you will see shortcuts and unknown virus executable files.
Virus removal
After setting up the display, you must remove the virus that hides the data from the USB flash drive. To check the drive, use the installed antivirus or healing utilities such as Dr. Web CureIT and Kaspersky Virus Removal Tool.
You can also clean the flash drive manually by deleting unknown files with the * .exe extension and shortcuts from the media.
Information Recovery
After setting up the system and removing the virus, you can begin to recover lost data. Typically, a virus simply changes the attributes of files, making them hidden. Your task is to restore the attributes to initial state or completely reset them so that the data is displayed in Windows Explorer. Let's try to restore the attributes through the command line:
The process can be automated by creating a .bat file. Copy the following text into notepad:
echo Please wait ...
attrib -s -h -r -a / s / d
Name text Document view and save it with the extension * .bat - you get view.bat. Transfer the resulting file to a removable disk from which data was lost. Run the bat file. After changing the attributes, the data that the virus supposedly deleted will be returned to the removable disk.
Work with FAT32
If the flash drive is installed file system FAT32, the virus could go further and not just hide the data, but move it to the hidden directory E2E2 ~ 1. In this case, the procedure for recovering information after its loss changes slightly:
After completing these steps, the Folder folder will appear on the USB flash drive; it will contain the files that you were able to recover.
Recovery through file managers
If after working with the command line the data on the USB flash drive could not be restored, then try to find them through the file managers. First use Total Commander:
If Total Commander does not help, use Far Manager to change the attributes. It does not have such a convenient interface, but it performs its functions correctly:
After disabling unnecessary attributes, the data in the file manager window will change color from dark blue to white. This means that the files are no longer hidden, and you can open them on a USB flash drive.
Special Utilities
Since the problem of missing files after the action of the virus is quite common among users, there is a special software that allows you to quickly recover information.
The network has a new kind of virus that infects flash drives and external drives. I first encountered a similar virus about six months ago, when one of my clients had a similar virus that hid all folders on flash drives, and created shortcuts in their place. Since the case was an isolated one, I thought that we should not worry and describe this problem. But soon calls for help “help restore data from a flash drive” rained down and this virus turned out to be the reason!
If you notice that the folders on the USB flash drive have become shortcuts
Suppose you notice that when you open folders on a flash drive, “crashes” system error and only then does the folder open. See if folders have a shortcut icon - this is a small arrow on the folder icon in the lower left corner.
If there are a lot of similar shortcut folders, or even all, then the system is probably infected with a virus, and your flash drive serves as its distributor.
We clean the flash drive from viruses
1. I recommend using several antiviruses to search for and remove such a virus: first do a full scan of the computer with the antivirus installed. In my case, this is Avast (see Fig. 2). Scan system disk C: and removable media, i.e. inserted flash drive.
If viruses are found, then remove them. Of course, with infected files from the system windows folders you need to do it carefully: treat it first or quarantine it. All the rest - you can safely delete.
2. Regardless of whether or not a virus was found, check the system with any other anti-virus utility. I recommend using CureIt. (http://www.freedrweb.com/download+cureit+free/).
Scan this utility for the C system drive and USB flash drive. Other logical drives can be scanned another time, otherwise deletion simple virus may take a long time.
3. After several anti-virus programs have analyzed the system and maybe something was found, or maybe not, it's time to proceed to recovery hidden folders on a USB flash drive, and at the same time clean the USB flash drive from viruses that antivirus scanners might not have noticed.
How to display hidden files and folders on a flash drive
I’ll say a few words what’s the matter and why the folders become hidden and invisible, and their place is taken by shortcuts.
The logic of such a virus is simple, but at the same time extraordinary. Once on a USB flash drive through an infected computer, it registers itself in a hidden RECYCLER folder, which it hides using the “Hide” system attribute. It places an instance of malicious code (virus) under any name. In this way he disguises himself. The virus sets the “hidden and system” attribute to all files and folders that are on the USB flash drive, as a result of which they become invisible, i.e. hidden.
Then, the virus creates shortcuts to all hidden files and folders and makes them visible, substituting them for the originals. Well conceived, right?
As soon as you insert such an infected USB flash drive into the computer, open it and click on the shortcut folder, the system command will work to launch the virus from the RECYCLER folder and then open the hidden original folder. If the antivirus does not respond to the virus, your computer will be infected and the consequences can be different: from password theft to installing a backdoor to control your computer.
There are several options for how to remove the virus from a flash drive, and hidden files make visible:
- Via command line
- Using a bootable Live DVD (or bootable USB flash drive)
- Using file managers (Total Commander, Far, etc.)
Personally, I use in my work boot disk and a flash drive. But since this method requires availability special drive or a special flash drive that you need to mount for a simple user - it's hard.
Therefore, I will show you another simpler way - using the file manager Total Commander.
Restore folders to a flash drive
1. Go to http://www.ghisler.com/850_b15.php and download the 32 + 64-bit version of the program (Combined installer Windows 95 up to Windows 8, 32-bit AND 64-bit!).
2. Install it. Even if you already have a similar program installed, update it. An icon will appear on the desktop (in some cases, as many as two).
3. Open the program by clicking on its icon. In the program window, click on the start button at the desired number (1, 2 or 3). This slight inconvenience allows us to use this program for free.
4. In the left window of the program, select your flash drive from the drop-down list.
5. At first glance, the flash drive is all right, the folder is in place, there are only no files, but it only seems so. If you look carefully, you can see that folders are shortcuts because they have an .Ink extension, but in fact folders have no extension.
Open section Configuration - Setup ... In the settings window, select the Content of the panels section and check the right side of the checkbox next to the following parameters:
- Show system files
Now the picture has changed. We displayed hidden, system files (at the same time, they may not be system files, because they just got such an attribute).
6. Delete all Ink shortcut folders. To do this, hold down the CTRL key and select with the mouse needed files. Press the DELETE key on the keyboard. Agree to delete.
7. It remains to restore the previous type of folders. To do this, just remove the attributes “hidden, system, etc.” from them. Standard tools operating system Windows XP, 7 or 8 cannot do this, and using the Total Commander file manager is easy.
Point (one-time left-click on a file) to any file and select all folders and files using the keyboard shortcut CTRL + A.
Open section Files - Change Attributes. Remove all points opposite the values:
- Archival
- Only for reading
- Hidden
- System
And click on the OK button. Now the files on the USB flash drive can be viewed using a simple Explorer.
8. Another small detail. It remains to delete the RECYCLER folder, which possibly contains the virus. Highlight the RECYCLER folder with the right mouse button and press the DELETE button on the keyboard. Agree to delete all files in this folder. If a warning appears when deleting that the file cannot be deleted so easily, then select the “with administrator rights” button.
That's all! The virus will be deleted, and the files will be restored successfully.
At the end of this review, I want to warn you in advance if you suddenly notice that files on the flash drive are missing or, as in this example, shortcuts appear instead of folders and files, DO NOT HURRY TO FORMAT your flash drive! Try using this method return everything to its place.
After a virus attack. Consider the ways. I had to deal with such a problem more than once. And I solved it in different ways. The situation is like this. The user, having worked at the computer, throws off the information on the USB flash drive. Later, when checking the flash drive, it detects that the folders are gone, although the volume is still busy with something. This happens as a result of the actions of some viruses. In fact, the folders did not disappear, they became invisible. The virus creates a directory in the name of which there are invalid characters. Then it transfers the real folders to this hidden folder. Consider how to recover hidden folders on a flash drive.
Method number 1
Step 1. Turn on the display of hidden files and folders in Explorer. On Windows 7, this is done like this: (Start\u003e Control Panel\u003e Folder Options\u003e View) .
Now in the tab(Extra options) activate the line (Show hidden files, folders and drives) .
Uncheck the box against the line: Hide protected system files (recommended) . A warning appears, click (Yes) .
Step 2 Cleaning flash drives from viruses. We do the cleaning of the drive using the antivirus installed on the system. Delete the shortcuts on the flash drive ( .lnk ), unnecessary executable files ( .exe ), and be sure to file autorun.inf , in case of his presence. Clean the folder RECYCLER .
Step 3Do bat file to recover hidden folders.
Algorithm of actions:
Create a text document, for this on a free area of \u200b\u200bthe desktop, right-click ( RMB ) and select, in the context menu that appears ( Create\u003e Text Document ).
Copy the script for the bat-file into the created text document.
: lable cls set / p disk_flash \u003d "Vvesti buky flash drive:" cd / D% disk_flash%: if% errorlevel% \u003d\u003d 1 goto lable cls cd / D% disk_flash%: del * .lnk / q / f attrib -s -h -r autorun. * del autorun. * / F attrib -h -r -s -a / D / S rd RECYCLER / q / s explorer.exe% disk_flash%:
: lable set / p disk_flash \u003d "Vvesti buky flash drive:" cd / D% disk_flash%: if% errorlevel% \u003d \u003d 1 goto lable cd / D% disk_flash%: del *. lnk / q / f attrib - s - h - r autorun. * del autorun. * / F attrib - h - r - s - a / D / S rd RECYCLER / q / s explorer. exe% disk_flash%: |
Save. Change the file extension txt on the bat . We write the name of the file to choose from.
Download the finished bat-file
The same thing can be done through the command line:
Open (Item\u003e Run) . Enter the command ( cmd), click ( ENTER) A black command window will open in which you need to enter the following commands:cd / d f: \\ press ( ENTER), where - this is the letter of our flash drive (may differ from the example)attrib -s -h / d / s press ( ENTER) - this command will reset the attributes and the folders will become visible.
Method number 2
USB Hidden Folder Fix.In my opinion this is the easiest way torecovery of hidden folders on a flash drive. The lack of a Russified interface in the program does not create discomfort in its management. We launch USB Hidden Folder Fix. Click ( Browse) and select the infected flash drive. Next, click (Yes! Unhide the folders!) . And just that! Hidden folders on the flash drive are restored. It remains only to scan the media for viruses.
Download USB Hidden Folder Fix 1.1
Step 1.We launch USB Hidden Folder Fix and through the button ( Browse) indicate the path to the infected flash drive.
Step 2Restore hidden folders.
Step 3We launch Total Commander.Open the infected USB flash drive in it and remove the viruses.
Step 4 We do the final scan of the USB drive with an antivirus program.
HiddenFilesRecover
Work with the program HiddenFilesRecoversimilar to working with the utility USB Hidden Folder Fix. Select the flash drive and press the button (Reestablish) .
Download Hidden Files Recover 2.0 32/64 bit
USB Hidden Recovery
The program is easy to use. After launch USB Hidden Recovery automatically scans connected to
computer USB drives. When hidden objects are detected, displays them in a window List of objects . Then you you can restore the files and folders you need by clicking the button Reestablish .
Download USB Hidden Recovery 0.1.3
Download USB Hidden Recovery 0.1.5
Limflashfix
Small, free program to recover hidden data from flash drives. It often happens that the flash drive does not have the necessary folders, but you know for sure that they were there, and the size of the flash drive has not decreased, and there are no files, all this is a trick of a computer virus that hides folders on the flash drive and creates a bunch of shortcuts with file names. Many antiviruses will clear the flash drive of viruses, but no antivirus will restore folders, but how to restore folders, it’s very simple, you just need this program. With the LimFlashFix program, you can easily restore access to all folders and files on a USB flash drive with one click. Everything is done easily, quickly and does not require special knowledge.
Using the program LimFlashFix, it is possible with one click to restore hidden folders and files on a USB flash drive. Run the program.
Click Fix
Download LimFlashFix 1.2
Download LimFlashFix 1.3
USB Protection & Recovery - a small free utility that provides protection against malicious programs that try to penetrate the computer via USB - drives, as well as the restoration of hidden and hidden files on USB - drives as a result of the effects of virus programs.
The utility is designed to solve two interrelated tasks simultaneously:
- The main task of detecting and removing malware trying to infect a computer via USB - drives. USB Protection & Recovery automatically scans all USB drives connected to the PC and displays malware in the main program window when malware is found. In this case, the user only needs to determine what to delete and what not.
- Recovering hidden and hidden folders and files on USB sticks as a result of exposure to virus programs. Some malicious virus programs can change attributes and hide folders and files on a USB flash drive. Manual is not always possible ordinary user restore the folder with your information, as the attribute is set to "system hidden". Restoring folders and files hidden by a virus to an ordinary user makes it practically impossible and creates many problems.
Hello, friends! For 6 years now, a virus has been raging that hides folders on removable media and creates copy shortcuts. Surely each of you has encountered a similar problem when you insert a USB flash drive into someone else's computer, and after that all the content disappears somewhere. But the volume of the flash drive remains unchanged.
Content:
1) The virus hid the folders on the USB flash drive
2) Make folders visible through the system
3) Make folders visible using TotalCommander
4) We write our program - the rescue
5) We treat the flash drive using third-party programs
The virus has hidden folders on a USB flash drive
I have identified three varieties of the problem when. The first, when the flash drive with the files is virgin empty or contains one file of an unknown extension that does not open standard programs on the computer. The second, when behind the place of normal files, shortcuts appear. Shortcuts are mostly working, and when you click on a shortcut folder, a new window opens with the contents of the folder. And the third, most common in our time, when the shortcut copy has the extension.lnk. Everything is much more complicated here, because even if you make hidden folders visually visible, you cannot uncheck the “hidden” attribute.
I used to do this, copy the contents of the folder and paste it into a new folder. Then the flash drive was treated with antivirus. But when there are more than ten folders, it takes time to do this, which in itself is not very effective.
In this article I tried to collect enough full information on how to make hidden folders visible and get rid of the virus on a flash drive. The information is relevant and very popular among computer owners, especially those who often use flash drives and other removable drives.
Making folders visible through the system
In order to make hidden folders visually visible, you need to follow the path:
1) START - Control Panel - Folder Options - View
this way fits in advanced windows versions 7.
2) START - Control Panel - Appearance - Folder Options - View
We look at the picture: 
In the folder settings window, select the VIEW item, and configure the display of hidden files.
We look at the picture: 2
This completes the process of visibility of folders by the means of the system.
IMPORTANT: After the done actions, we scan the drive. We delete the shortcuts with the extension.lnk, we also delete the unnecessary and unfamiliar files with the extension.exe, then we delete the autorun.inf file and the RECYCLER folder.
Making folders visible using TotalCommander
Here the process is much simpler and faster than in the first embodiment. For this, of course, you need to have the TotalCommander file manager program. We start the program, select the drive display in one of the windows.
The program is configured very easily. In the top menu, select the item “Configuration” - Settings ... - The contents of the panels - Display files - check the box “Show hidden / system files”.
We look at the picture: 
After that, we can freely see all the hidden files, by default they will be marked with a red exclamation mark.
Then we make hidden folders visible, that is, remove unnecessary file attributes.
We look at the picture: 
If the degree of infection of the second level folders, then the folders will all become visible, it remains to do the item marked IMPORTANT from the first part. If it was not possible to remove the file attributes, then we proceed to use heavy artillery.
We are writing our program - rescue.
What I will tell you now really works and really valuable information, at least in solving our problem. I will show how to create a small program that treats flash drives from a virus in two ways that makes folders hidden.
To do this, you need to create a text document with the extension .txt. I suggest this is a standard notebook document. Next, copy and paste the text into it, the following content:
: lable
cls
set / p disk_flash \u003d "Vvedite bukvu vashei fleshki:"
cd / D% disk_flash%:
if% errorlevel% \u003d\u003d 1 goto lable
cls
cd / D% disk_flash%:
del * .lnk / q / f
attrib -s -h -r autorun. *
del autorun. * / F
attrib -h -r -s -a / D / S
rd RECYCLER / q / s
explorer.exe% disk_flash%:
We look at the picture: 
Change the file extension. We click in the document in the upper menu FILE - Save As ... - Choose the file storage location - We write the file name after the point we write.bat.
We look at the picture: 
After all the actions done, it should turn out:
It was: 
It became: 
We proceed directly to the operation "cleaning the flash drive." To do this, we need to run the file on behalf of the Administrator. We right-click on the file, select the item in the context menu, Run as administrator.
We look at the picture: 
In the window that appears, write the letter that corresponds to the drive, and press the Enter key on the keyboard. The program will automatically start the treatment process. Upon completion, a window with the contents of the flash drive will open. After which you will have to do the operation marked IMPORTANT in the first part of the article.
The program really works. In my case, it is stored on a USB flash drive and is always at hand.
We treat a flash drive using third-party programs
1) USB Hidden Folder Fix
The program has a fairly simple appeal, but the interface is in English. That would not get lost in two buttons, we look at a screenshot of the program:
2) HiddenFilesRecover
The second program of the series personal assistants for the treatment of flash drives. The program does not require installation; just select the version of the program for the bit depth of your operating system. The program also has a Russian interface.
See the screenshot: 
3) LimFlashFix
And finally, the third program to recover hidden folders. Installation of the program is sufficient, insidious, be careful when choosing the installation mode. IN auto mode Yandex kit will drop onto your computer from the browser and unnecessary applications. The program interface also has a Russian language.
See the screenshot: 
This software of the three programs is absolutely safe and confirmed its work for the assessment is excellent. So download the link - software treats hidden folders.
After all that has been done, repeat the paragraph marked IMPORTANT in the first part of the article.
Dear friends, I tried to collect the most relevant and full version all tools in the treatment of hidden folders on removable media. Nevertheless, I recommend to be careful when using flash drives on other people's computers. And do not panic if you have a similar incident, and the flash drive is very important information. After reading this article to the end, you are convinced that there are no unsolvable problems, there is only the choice of the right tool for the solution.
Sincerely, Oleg Nekrom!
In the past few years, a virus has been very popular that blocks the entire contents of flash drives. Moreover, the user does not need to do anything special for this. Just give your flash drive to someone to use.
If after using the USB flash drive on another computer, the size and fullness of the USB flash drive did not change, but all the files suddenly disappeared, then there is only one conclusion - the virus was picked up.
Moreover, the presence of a virus on a flash drive, its contents may look different:
- there are folders on the flash drive, but they are all in the form of shortcuts;
- folders on the flash drive is not visible, but it is impossible to add any information to the flash drive;
- folders are empty inside and size free space on a flash drive has not increased.
- the appearance of an unknown file on a flash drive with the extension lnk.
If the flash drive shows the following information, then it must be treated.
Sometimes the user may not notice anything, as when you click on the shortcut, the folder opens and there all its contents are in place. But this is not for long, then the virus hides it too. Folders with the lnk extension are treated much more difficult. They block the ability to remove the "hidden" checkbox in the settings.
See me - make the folder visible
Treatment of a flash drive can be started by using the capabilities of the OS itself.
In order to make everything hidden visible, you need to click "start", then "control panel". In the window that opens, select the "Appearance" tab and select the folder options there by selecting "View."
In the small dialog box that appears, you should check the option - display hidden files. After that, click OK.
Be sure to uncheck the option to hide system files. Although this was done intentionally so that the user does not spoil anything in the operating system itself, but if there is a virus, this is necessary.
Be sure after all these manipulations you need to scan the flash drive with antivirus. If the computer does not have an antivirus, then it can always be downloaded on the Internet. Here are some of the most popular paid and free resources where you can download trial demos:
- Norton Security Antivirus - ;
- Avast - can be installed free version (not DEMO) -;
- Kaspersky - .
You can run a flash drive scan with antivirus through simple manipulations. Right-click on the option "check for viruses"
Total Comander - flash drive folder savior
Another option at hand to display hidden by the virus Folders - Using Convenient Total Comander. Many users use it to quickly navigate through files and folders. You can download the commander at the following link.
Working in the commander is much simpler and faster than using the same Windows interface. The program dialog box opens. On the top panel you need to click the option - "Configuration".
Next, select “Content of the panels”, then “settings” and select “display files”. After putting a daw on the option - "hide / show hidden files", you can also put a check in the next item "show system files". And click OK.
For user convenience, all displayed new files are marked with a red exclamation mark.All files marked in this way should be made visible on an ongoing basis. To do this, right-click, when you hover over the damaged file itself. Selected in the menu - "Properties". In the window that opens, remove all the daws on the file parameters.
If after these manipulations all the files in the folder were restored, the shortcuts were removed and the flash drive worked fine again, then everything is fine. You just need to check it with antivirus again. If you failed to correct the file attributes, you will have to use a mini-program written by you yourself.
Save your flash drive yourself - write a program
In severe cases when standard methods file displays no longer save, you have to resort to tricks. Further, the flash drive savior program presented to them applies.
Programs, as you know, are written in this form:
- in .txt format;
- in the Notepad file.
To create this program, it will be enough to save the text below in a notebook.
After that, they save the file as standard, call it by any name. The file must have the extension .bat. In a new storage location given file Now it should be displayed as a document for editing (there will be wheels and gears in the icon).
The sequence of saving the program in a new format
Next, hovering over this file with gears, you need to right-click and select the option “run as administrator”. A standard black window will appear, which is always used when reinstalling the OS, programs, etc. After that, the program will require you to enter the flash drive letter. You need to make it and press enter on the keyboard. The program will start working.
Flash drive name introduction
At the end of treatment of the "sick" drive, a window with its contents will open. After that, you will definitely need to run the antivirus again to check the flash drive for harmful effects. For convenience, a file with such a program is always better to have on a flash driveso that in any case it is possible to treat the drive from viruses.
Third-party flash drive treatment
You can treat drives and other third-party resources, only in this case you have to rummage around and look for these programs. Yes, and they need to install and figure out what and how it works.
The most famous:
- LimFlashFix - you can download;
- HiddenFilesRecover - you can download;
- USB Hidden Folder Fix - you can download.
What are the features of each program? It should be noted that all programs are small and light, do not take up much disk space and all are checked for harmful viruses. There will be no problems on this side.
English LimFlashFix
This program has one frustrating property. Its entire interface is in English. For those who do not know the language it will be difficult. But since the program is simple, it’s enough to go through the whole procedure of flash drive recovery for the first time. And then it will be easy.
Sequence of actions, press only two buttons - select removable media - click Browser and click Yes! Unhied the folders. This means starting and disinfection of the selected drive.
Personal Assistant HiddenFilesRecover
This program does not even need to be downloaded. all that is needed from the user is to select the bitness of his operating system -32 or 64, and directly select the USB flash drive for treatment and click "ok". Of the amenities you can note the Russian language of the interface.
The simplest Limflashfix
This type of program has only one drawback - when you download and run the program itself, you need to concentrate. Otherwise the old fashioned way can spoil the user the entire interface of web pages. By default, the download involves installing all Yandex services - from start page, before the default search. Therefore, the ticks from the proposed Yandex need to be removed if there are no plans to use this service.
To clean and treat a flash drive, just select it and click the fix button. The program does not require anything else.
