Some virus affecting our Windows System by replacing our document with infected files, hidding the real document and changing the document attribut to system files. It will cause this document can't be see with normal windows explorer view. We have to make option change on folder option to make the document viewable.
But in some case, virus has do many thing as well to prevent us from doing anything againt the virus like disabling regedit and msconfig, hidding folder option and etc. Even that the virus was remove from our System they still leave that problem behind.
Re-showing the hidden files is easy, it's done using dos with attrib command. But did you know what is the option after the attrib command means?
Attrib is a command, in MS-DOS and Microsoft Windows. The function of attrib is to set and remove data attributes (read-only, archive, system and hidden). These attributes are used by a wide variety software to protect and classify files (Source :Wikipedia).
Let's typing "ATTRIB /?" in MS-DOS prompt.
A couple option information are listed, there are:
+ Sets an attribute.
- Clears an attribute.
R Read-only file attribute.
A Archive file attribute.
S System file attribute.
H Hidden file attribute.
/S Processes matching files in the current folder and all subfolders.
/D Processes folders as well.
For example, a flash driver with all files and folder are hidden by a virus, and assume the drive was F
c:\>F: //Changing to drive F
F:\>ATTRIB -S -H /S /D *
It's mean changing attribute on drive F, Clear File System attribute (-S), Clear Hidden attribute (-H), Process for matching files in the current folder and all sub folder (/S), and Process the folder as well.
