Windows 7 Folders are not showing after successful virus cleanup

[Behnam Vahdati]

Greetings everyone!

Well my computer was infected with a strange virus recently which I managed to get rid of with help of various antiviruses and anti spywares, and my pc is all clean again. But the problem I have now is that great number of folders have disappeared! I have already checked if they were hidden or even deleted, but when I manually access those folders from browser address bar it works just fine. (I.E theres no way I can see my "program files x86" in the browser, but yet when I type in C:\program files x86 it would take me there just fine"). This has caused me a lot of difficulties so I would appreciate if someone comes up with a suggestion.

Thanks.

 

[davehc]

It is not clear from your post, so can you confirm you have looked in Windows explorer - Tools - Folder options - View, and "unhidden" the four options there?

If yes, you may need to edit the registry.
Type regedit in the Start, or run box.
Export a back up of the registry first!


Open:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\folder\Hidden\SHOWALL
Double Click CheckedValue and enter 1 in the text box.
If the CheckedValue is not there, right click in the empty space and create a new DWORD value and name it as CheckedValue and Apply the "1" as above.
If you now close the regedit, you should be able to see the folders.

 

[Behnam Vahdati]

Hey Dave,

thank you for the reply, I did what you suggested. first, again I made sure my folders are set to be not hidden in the folder option menu, then went to registry and checked if the value was on 1, and it was, found nothing strange there

I did some disk checks, registry fixes and lots of junk clean ups, still those folders show no sign of existence, but they're physically there and can access them like how I described it.

 

[Saltgrass]

I know there are folders on a Windows 7 install you cannot see unless you know where they are. One is called visualization or something similar. I will have to see if I can find the path to it. If I do, maybe I can figure out how the folders are set up to keep them from being seen by a user. But you are allowing system files to be shown as well as hidden?

The setting is probably in the hidden registry entries!

 

[Saltgrass]

Well, I found something you might try. I will have to research some commands using an Administrative Command Prompt to be able to see folder names longer than 8 characters and other such things, but maybe someone else already knows, like Dave.

But I am thinking if you can open an administrative command prompt, you can probably check and then change the attribute for the folders. Not sure if this would be the same thing as the registry entry you checked, but maybe. One reason you cannot unhide the folders is you cannot click on them to check their properties.

I will be back after I do some testing....

 

[Behnam Vahdati]

That'd be super Saltgrass. Keeping my fingers crossed

 

[Saltgrass]

OK, baby steps....

Let us know what you find.

Open an Administrative Command Prompt.

Go to the C: directory (cd \)

type dir

Note what folders show.

type dir /a

and note what folders.

Next type attrib foldername

If one of the folders shows an H as an attribute, we can try to remove it. I am still having problems with the long names. I know you might be able to use a _ to fill in spaces, but I will have to try depending of what folders you have problems with, if any of this helps at all. The virtualized folder I am looking at has not shown up after removing the attribute, so we will have to see.

 

[Saltgrass]

There are some more possibilities in this thread. The first one seems to be the same as Dave recommended. The one the Original Poster said was a fix does not show the registry entry in my system. But if yours is having the problem, you may show it, or a search for the "NoFolderOption" might find something.

Hidden Folders Can't be unhidden - Microsoft Answers

 

[Saltgrass]

I have been looking at what some of the viruses can do. The fact they are able to inject code into other processes would cause me to suggest you run a system file check. Open the Admin command prompt and type SFC /scannow to check your files. Not sure if the situation is the same with Windows7 as with earlier versions, but it wouldn't hurt to check.

Do you happen to remember a name or designation for the virus?

 

[Behnam Vahdati]

Hey, I couldnt do the attrib foldername command, said parameter format not correct.
anyway I'm doing the cmd system check right now,
and name of on of the viruses was suspicious.xx, and only symantec was able to detect it, I will do some log checking to post other viruses names and btw, this, the whole folder dissapearing thing had happened before at work now that i can remember by some brand new virus like 6 months ago. They had to install new windows to be able to see their folders again

 

[Saltgrass]

You may be able to do a repair install and get you system back. I would just be worried about part of the virus still being present.

If you can see your folders in the Command Prompt, it would lead me to believe something was done to Explorer to keep it from showing them. Not really sure what that might have been. But if you have 2 Windows machines, you might check some of the registry entries to compare. The NoFolderOption seems promising, but virus writers change their attacks frequently, so it may be something else.

Edit: Seems suspicious.xx is not a virus, but a technology. Symantec is trying to detect viruses without a previously known signature and whenever that technology discovers something they say it has suspicious.xx type activity. If your company really had it 6 months ago, something may still be hanging around, or your folks need to stay away from those websites!

 

[Saltgrass]

Can you find any desktop.ini files in one of your hidden folders? If you can, would you post what it says and which folder it is from. This is a system file so you will need to show system files in folder options if you have not already.