Can't see hidden filesSolved/Closed

Question

Hello, 

i got a monstrous problem concerning my hidden files, I can't see them anymore and when I enter in tools, folder options so as to click and see my hidden folders...it returns back to "do not show" any clue????Configuration: Windows XP Firefox 2.0.0.12

san · Accepted Answer

Ii performed the following Steps but the modify key value reverts back to 0.
Go to Start --> Run, then type Regedit 
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL 
3. Find a key called CheckedValue. 
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.) 

Suggest me step for further.

mrslash · Answer

hello mate I'm pretty sure it's a virus, so my advice is that you format completely your pc. I might be wrong but scan your pc before formatting.

cheers

mr slash ;)

percy8 · Answer

How come ??

It can be only a virus.. it may be an error on drive C:\

Are you sure you've followed the following steps :

The documents you want to view your hidden files  - Tools - Folder Options - View - View hidden files?

If this dont work, it might be really a virus, try scanning your drives.

C ya

Percy

yogui7 · Answer

OMG, it's a virus I remember I got this problem and I couldn't do anything about it because my anti-virus didn't see anything so the best way is to format your pc...

jason the tech · Answer

The issue is caused by a virus
I have been seeing a mass amount of cpu @ my shopr with this issue
Its a hidden file virus under autorun.ini and its a trojan
It puts out all sorts of bad files like 0wk2.com, kavo.exe, tavo.exe 1i.com, njc.com
What you need to do is look @ the hidden files from comand prompt by entering the drive you want to scan c:
then type attrib -h this will show you the current hidden files for tha drive copy the file names down (copy paste on notpad) the download tweak ui power tools from microsoft install the stop the auto runs w tweak ui download kill box and enter the hidden files that you found in kill box theis will delet them and stoping the auto runs will stop it from reloading the only ones you dont want to delet or ntdetect.ini, ntuser, bootmgr, pagefile.sys andhiberfile.sys also go to the reg and search and delet tany keys found relating to the viruses  I will be posting a better step by step directions later but if your smart enough you should figuer it out

crazy_phoebe · Answer

No other solutions, its a "Delete Hidden Folders" VIRUS ... Got this problem with my porn folders... ALL FORMATTED now :)

srinivasan · Answer

i can't open the drives  too.(for ex: c: d: e:)

i can' see the hidden files too....i followed the procedure in the net...i think that will clear the error...

libin · Answer

i can't see the hidden holder

used this setps and I can see the all hidden folder but now can't see the hidden folder in other pc, I use this steps but 

can't help this steps

 (Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.)

Libin

elfenchanter · Answer

Good day to you guys.

Days ago I had formatted my comp when it's infected with kavo thingy shit virus and something else that disable your hide files and doesn't allow you to double click on your local drive. I appreciate if someone can tell me how to get rid of this problem.

AV · Answer

Guys I have also got same problem I can't see them anymore and when I enter in tools, folder options so as to click and see my hidden folders...it returns back to "do not show" any clue????..

Also ,u "regedit" command is not working in "RUN".. please give me the possible solution

sawasawa · Answer

i made all above steps & changed the values and it return back again to  0  ..
so I can't see the hidden files at all & the virus have files on all partitions :(((

pls help

jamshid · Answer

thank you libin. I can see my hidden files with your steps. It`s a good and easy way.

gramms · Answer

Thanks, it sorted mu problem,gramms

satan · Answer

I do not get the option "Show Hidden Program or System Files" in folder option .. plss hlp

siti hajar · Answer

great!!! thanks a lot..now I can see my hidden files.. :)

Thorin · Answer

I had the same problem. the answer of Libin is correct.
Too easy to do it and it works.
Thanks again Libin.

DeVIL_GuY · Answer

look guys I had same problem what I did was 
1 - used norton antivirus to know what files infected on my pc
2 - then I opened with the safemod and deleted them all 1 by 1 and make sure I didnt forget any thing
3 - downloaded disk heal program *google it* this fix the drives which dont open double click and folder option dont show
4 - for the hidden problem I followed **libin** direction throu Run and it fixed it self by it self much thanks to u libin

libin's Methode
=========
(Go to Start --> Run, then type Regedit 
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL 
3. Find a key called CheckedValue. 
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.) 

that should be it guys.. formating wont solve nothing on the begining cauze I tried ti 5 times and every time I get same error so good luck for all :)

percy8 · Answer

Hello ,

Ive experienced the same problem ! This is definitely a virus.

I'll advise you to download avira! It gonna track these shitty stuff for ya ;) But in the mean time be sure to make a back up of all your stuff or save partition !

ziggy7 · Answer

Problem solved ? or had you formated the pc ? :S This is so disgusting to have to loose all info !

muzu · Answer

I got the same problem too.. can't view my hidden file...I have windows crystal. Recently I have formatted my pc and I dont have any anti virus programs installed yet. When I inserted my pendrive and tried to see the hidden files I found this problem in my pc. If its a problem of a virus, will it delete the hidden files in the pendrive? PLEASE help. The hidden files are so important so that I hid them. PLSSSSSSSSSSS reply

crazy_devil · Answer

finally I had no choice but to format the pc !!! :( snif snif

crazy_phoebe · Answer

Hello guys 

Have you done all necessary steps?? 

When I can't view them I go to Tools--> Folder options--->View---> Show hidden files or folders! Or maybe it is your pc configuration?! Just check this well and maybe you will be able to find a solution! Cheers!!

bhu · Answer

Thanx bro the hidden file problem is solved but my search folder button on tool bar is not working , neither I am able get search screen while going through  start>>Search.

Taimoor · Answer

Today morning I was working on my pc, an error occure on my pc,than I ok it after this my hidden files does not show on my pc.Wordings at the end of error were as(memory can not read it).plz tell me the solution of this .Thanks from Taimoor

karine555 · Answer

i dont think that you should re format your pc for such problem!

mala · Answer

Hi, I do not have this \Hidden in \Folder... what can I do to see my hidden files? I got Win32.Bagle, and I really need to see those files so that I could get rid of the virus.

chetan · Answer

hi......... I followed all steps but at the end there is no such thing called checked value key... there is "value name key,default value key, h key root" bt no "checked value key"... wat to do??

niti · Answer

hi I had the same problem where my hidden folder option never used to work and additionally my yahoo stopped working later on I had issues with opening of other drives as well like C:\ or D'\ or even a pen drive

i got my system reformated and lost all my data I thought it's better than loosing my system it worked well for two days then it came back to the same problem

i finally got rid of it with the help of combofix.exe u can find it on www.myantispyware.com

i think from what I herd this virus is being transmitted over broadband's

anyways I thought it might help

--Niti

jyotibon · Answer

i cant open my c or d drive. when I double clickn my drive its not open,only autoplay screen come.how can I solve this problem without formatting the pc.

niti · Answer

well it's the same virus i'll again suggest combofix.exe

download it and run it

Vikki Khar Tay · Answer

Thanks for your solution. I am pleasure it!

Hatetheseproblems · Answer

Same problem than san: it revert back to 0...

I have a virus in C:\2y8la.exe  It's a trojan.

I can't see the file, and I don't know if I can delete it without further problem... and if you answer me, try to be clear, i'm bad with these stuff :P

Thanks a lot

jhe · Answer

ITS MALWARE NAMED KXVO.EXE it is very dangerous program because even you format your pc it is still there actualy there is stil no cure about that malware it is the new main problem. I hav this new software called reg run try them I heared it cleans even your bios try it.

-jhe

zefenix · Answer

hi theres no need of formating your pc for this mate !

madman · Answer

wow, nice guy its very effective the suggestion of two guys jason and bans it working in my pc 

thanks guy,

sam · Answer

hai,

My system is affected by Viruses autorun.inf, 1wod1.com, c9.com. These three viruses are making the files to be hidden always.Even though when doing 

(Go to Start --> Run, then type Regedit 
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL 
3. Find a key called CheckedValue. 
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.) 

Its the files are not able to be viewed. It has now affected all of my audio and softwares files and making disruption in any process it does . 


Click Start => Run type in Regedit press OK.
Click:

    * HKey_Local_Machine
    * Software
    * Microsoft
    * Windows
    * CurrentVersion
    * Explorer
    * Advanced
    * Folder
    * Hidden
    * SHOWALL

Now right click on CheckedValue and click Delete.
Right click and hover over New then select Dword Value call it CheckedValue.
Right click on CheckedValue and choose Modify, under 'Value Data' type in 1.
Exit Regedit


So do reply me in solving the issues. thanks a lot.

ssss · Answer

[quote]i can't see the hidden holder

used this setps and I can see the all hidden folder but now can't see the hidden folder in other pc, I use this steps but

can't help this steps

(Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.) [/quote]

THIS ONE help me SOLVE my problem... thanks a lot

hoanghaXD · Answer

thanks you so much mr Devil

kaycee · Answer

Hello

I have very bad problem with my pc, I thing its a virus show me tavo.exe what can I do to it right now need a solution please from you guys

mrslash · Answer

i lost all of my info once and dont want this to happend to me again, its really disgusting !

Mazhar · Answer

I have hide some important file in d drive which I could not find. and also I am unable to see the show hidden files and folder in my computer tools option. I solved this problem but still I did not get my hidden files.
help me pls.

Mazhar

sunny · Answer

dear Sir.........
                     atomatic is file& folder hiden 
                    
 
                                       pls sir probalam  shol me  '

                                                       thank you

niti · Answer

okay do one thing go to google and search for hijackthis software it's free u dont have to pay for it scan ur computer with it and check the log entry it give in last (it's a txt file) and search if u find asnything like amvo.dll or amv0.dll

LeStaT · Answer

the problems will continue cause microsoft is fucking all the xp so it force the people to use vista so if you figure it out will think same I do so better try the way to crack vista

vinod · Answer

hello all pls advice me pls I cant see my see my hidden file or folder jab bhi mein tools me jakar folder option mein ja kar view mein jakar show all hidden file or folder karta hoon fir bhi woh show nahi hote pls advice me yaar ...........pls its

yogui7 · Answer

hi vinod if you foloew one of those ideas given above am sure u will be able to view them !! check 1st page

sarah · Answer

My desktop items dont show on my computer screen and I dont know how to fix this so it looks like a normal computer screen.My tool bar at the bottom with start has also dissappared.

lucia4love · Answer

Hello, 
My name is lucia I see adress at(ccm.net) I am a lovely and caring girl.I love to establish a relationship with you.Please reply me through my private e-mail box;(Email Id removed for security)l promise you when l see your note l will send you my pictures, Thanks and am waiting to hear from you soonest, 
lucia.

Gore · Answer

I have the same problem but I can't found
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL 

my "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\" have't any "Hidden" and "SHO WALL"
What can I do now?

Gore · Answer

I think it's deleted by the virus
After I check the correct registry and add them back, all hidden files show again
I paste the registry below, hopefully it's useful for someone

-----------------------------------------------------------------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
"Text"="@shell32.dll,-30499"
"Type"="group"
"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
  00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
  48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
  00
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000002
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"RegPath"="Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
"Text"="@shell32.dll,-30500"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"

chhagan suthar · Answer

tell me soulition for hidden file and folders in c:
  
 
Thanks,
         chhagan

raj · Answer

thanx bddy I got a solutions from u.im facing problem with hidden files. im a admin in blore. I wan a clarification that which is d best Antivirus with which we can deal with???????????
                                                                                       Rajanikant mishra
                                                                                            B-lore

ftgr · Answer

my local disk is not autoruning

rsk · Answer

plz help me I can't find hidden files

Esteban · Answer

I am experiencing something similar and my PC is very very very slow. Can this be causing it?

dost · Answer

i had the same problem yesterday..started with a virus called semo2x.exe..(its a new virus as far as I know)...i downloaded pc tools antivirus it detedted it and deleted it but then my drives didnt open so I downloaded disk heel used it worked...then my hidden files didnt open so I followed the steps of the registery solution and it worked :)

dost · Answer

ooo forgot to write it in my previous post...slow pc is mostly caused my trojens and viruses...many times my viruses that doplicate them selves or make a lot of backgroud processes...open ur drives with winrar and look for unusual files that shouldnt be there..

biotch · Answer

hello yaar ..a very serious problem with my pen drive and I need ur kind help...my pen drive is filled with regsvr virus and they r all hidden and cant delete them..wen I open it , shows the disk is full but I cant add more datas to it and its showing an empty page without any folders on it..plz reply me as early as possible.............

biotch · Answer

hello yaar ..a very serious problem with my pen drive and I need ur kind help...my pen drive is filled with regsvr virus and they r all hidden and cant delete them..wen I open it , shows the disk is full but I cant add more datas to it and its showing an empty page without any folders on it..plz reply me as early as possible.............

ahh · Answer

still I cant see hidden files and folders

swati · Answer

Hi guys,


I tried with all the steps instructed but all in vein.......
Please help...........
where is execute panel. please guide.

Swati

PC do · Answer

its working man thanks

steve · Answer

My friends,

I had same problem and followed above steps but in my regedit registry there is 
Hidden\Showall entry but it has no entry called CheckedValue.  I changed the
default value to 1 but that did not help.

Problem:
1.  Cant see hidden files and no 2nd choice shows up in file options to set it to show
2.  The fix below doesnt work cause there was no CheckedValue field under Showall

Solution if you dont have CheckedValue entry:
1.  Simply add the new entry carefully with same name as DWord entry under \Showall
2.  Then set to one as above.
3.  Then go to file folder options and now you can see 2nd choice to show hidden files
4.  Now click on the 2nd choice to show hidden files and click apply.

Thank you to the original wizard who figured this out.

from,
www.ewayco.com   - Land of $100 PC and low cost systems

ninja · Answer

the file is there its not show

wase · Answer

u may b using portugal's version dat contain virus

jpr · Answer

i followed all steps in regedit, but at the end there is no such thing called checked value key... there is "value name key,default value key, h key root" bt no "checked value key"... wat to do??

jenu · Answer

no still i'm not able to set the folder properties to show all...Email Id removed for security

Lokesh-Laxkar · Answer

HI
I have that solution u can donwload amvo.exe virus script in 5 minute u can see ur hidden files (Kill amvo.exe)

wd786 · Answer

yeh great its working

Thanks

jay · Answer

sarah,

try right clicking on your destop screen and uncheck 'hide folders'. Hope that works.

Manoj · Answer

No Dear It is not working :-(

chotu · Answer

hai friend!  can you just "repare" the os

Lou · Answer

Thanks I was just looking for the soltion I found this but it has helped me 
Big up to all the guys who contibute to it

sam · Answer

hey man thanks I have done it, its solv my prob.

Inch · Answer

Hey man

It's definatly a virus, even if you run anti virus, this will not solve your problem necessarily. you may have got rid of the virus, but your registry files are damaged, in fact its a file in your registry called hidden. Replacing this file has helped me, but forgot where the registry location is. Start/ run/  regedit. its always wise to make a back up of you registries for times like these.

Kingmaker · Answer

CAN ANYONE TELL ME HOW TO REPAIR REGISTRY  FILE...!!! Is this is the solution to del the virus????

manu · Answer

Hi 
I follow all the steps of regedit but nothing is to be done right. I have no hidden files but I now this is virus. and if an time I hide the file it will not shown. please help me.
pls do yaar

murali · Answer

thanks alood

Apple · Answer

[[[[[(Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.)


and hen do this method

and also use repairing cd for registry]]]]]]]]]

I had the same problem and I followed the instructions, but when I set value to 1 (hexadecimal) in "Checked Value" and close registry editor, and go to any folder and enable to see hidden files and folders I still dont see them. And they I returned to the registry editor and I saw that the Checked Value is set to 0, and if I try to change it after I close registry editor it automatically sets the value to 0.

Any help would be greatly appreciated....

kamel · Answer

thank you for all information

hyperstone6 · Answer

Hi every1...
I read every single post about this problem in here & did the registry modification but it just doesn't help.
I even went to "REGEDIT, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\explorer\Advanced" but mysteriously everytime I change the value of "Hidden" to 0 then go to folder, select "Show Hidden Files & Folders" & come back to the registry & refresh, the value is back to 1
I just scanned my computer with Norton (Latest definitions) got lots of virus nuked, but I think my registry is damaged.
I even downloaded & scanned my computer with "Hijackthis" but did not find any amvo. big problem ha?!
p.s.when I copied the registry entry made by gore & merged it to my registry, guess what, now the "Hidden" in "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Current Version\explorer\Advanced" started to show the value "2" instead of 1 !
any help would be highly appreciated.

hyperstone6 · Answer

HEY EVERYONE I THINK (I HOPE) I GOT A SOLUTION FOR ALL OF US!!!!!!!!!! 
GO TO THIS SITE & DOWNLOAD THE PROGRAM & USE IT. IT'S CALLED SMART VIRUS REMOVER. ALTHOUGH ITS ABOUT 500 KB ! BUT IT LITERALLY SOLVED MY PROBLEM:
https://www.technize.com

gaurav sharma · Answer

1. performed the following Steps but the modify key value reverts back to 0. 
Go to Start --> Run, then type Regedit 
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL 
3. Find a key called CheckedValue. 
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.) 

5. restart my computer but my problem still u have any new solution pls send me
 thankas

shad · Answer

hey the hidden files resolution is really cool..................
it worked instantly ............
thanks a lot

hassal · Answer

please resend my problem

LJ · Answer

I deleted the "checked value" key and then recreated it as in a previous post.

I had the "kavo" trojan. It make an autorun file and copies itself to any drive that you use on your computer including flash and backup driver.


Here is a link with more info:

http://64.233.169.104/search?q=cache:t42aicUnNxUJ:www.trendmicro.com/vinfo/virusencyclo/default5.asp%3FVName%3DWORM_ONLINEG.EPA%26VSect%3DT+tmf3w3g0.com&hl=en&ct=clnk&cd=2&gl=us

Danong48 · Answer

I solved this problem using this method on my coumputer. First scan your computer for malware (spyware) using CounterSpy V2. Download at http://www.sunbelt-software.com/Home-Home-Office/Anti-Spyware/ It's free for 2 weeks. It can detect and remove most malware. I believe it is a Trojan horse cos' the software detect a hidden file folder on my computer which link it to a porn url. After I remove that particular trojan horse and using this method to change the registry, I am able to show my hidden files. I don't think it is a virus.
Go to https://www.precisesecurity.com/antivirus/ for a clearer understanding of changing your registry using regedit.

negi · Answer

hello friend ]

i am not able change registry checked value whan I change value but it is not changing plz help me how th change value

sakthi · Answer

use this step




                      Updated on 9th FEB 2008:
If still folder options is reverted back to don't show hidden files and folders then it could be due to some virus still in action.
Navigate to the following path: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
NOHIDDEN 
In the NOHIDDEN folder, select CheckedValue and set the value to 1 
 
4. Go to Tools > Folder options. This will show a folder options menu.
5. Go to View tab and select the option "Show hidden files and folder"
The above fix to the trouble came from one of our readers Chris under a virus post comment.

mrslash · Answer

hi crazy devil,,,yeah I hope that you have everything alright now but this was surely due to a virus and the solution is that you should already have formatted your pc and this would have solve the mighty problem....but it is never too late so if it persist try it and whether it happens next time you know now the solution but you must have a backup storage in order to keep all your data...

jimboy · Answer

I'd performed the suggested Steps but the modify key value reverts back to 0, no matter how I tried to change the value to "1"

narinder · Answer

i have d same prob but I followed ur method ofcourse I got folder options and show hidden files but actually it doesn't wrok I can't see my hidden files.plz help

niazi · Answer

i have a virus autorun.ini in my p.c. how can remove it from in my computer with out installing the anti virus. 

what is the best antivirus to remove it.

surindera · Answer

Hello boss I am not able change registry when am I changing the show all cheked value 1 then automatic it is changing 0 pls help what should I do
surindera

ottello · Answer

thanks a lot

kaansha · Answer

thanks a lot sourabh !! my hidden files are no longer hidden ! thanks a lot :)

give me some suggetion · Answer

dear sir
I have problem with my hidden file in my computer that not showing while i'm clicking on show hidden files through tools, folder option.
when ever i'm clicking it will became same that do not show hidden file

Dritzz · Answer

C:\autorun.inf
C:\WINDOWS\recover.reg
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\fool0.dll
C:\WINDOWS\system32\fool1.dll
C:\WINDOWS\system32\ieso0.dll
C:\yphhsp.cmd


this are the files that make your hidden files don't show , if this files are in your pc, nuke them out. don't know what kind of virus it is I just manage to nuke them out.

LJ · Answer

Hi everyone.
I reinfected both of my pc's with a removable usb flash drive by carelessness.

The "kavo.exe in one of the files (Trojan) that causes this "hidden files" fiasco.
On the following repost from a previous poster, note that it's probably better if you delete 

the "CheckedValue" key, and 
then recreate again, as outlined in the following:

Go to start Menu -> Run -> Type in "Regedit"
Navigate to the registry folder 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHO WALL
Right Click on the "CheckedValue" Key and delete it.
Now, in the pane under all of the other values, right click in an empty area and you will see 

"new". Highlight "DWORD  Value"
When you create it, it will probably have "New Value  # 1" in the box. Rename it 

"CheckedValue". Then click on it and put "1" in the "value data" box.

Now go to a file folder and up top and click Tools ->Folder Options->View. Scroll down to 

"Hidden files and folders" and click "Show hidden files and folders".
Also, make sure that the following are unchecked:
Hide extensions for known file types.
Hide protected operating system files.

Click "Apply".
Now, go to Start ->Search->For Files or folders.
In the "all or part of the file name", type in Kavo.
Delete any files that you get related to this file.

In addition, go to your main root directory "C:\ and look for the file "q83iwmgf.Bat". This is 

the baby that is the main cause of this "hidden file" fiasco, besides the "spyware" 

possibilities.
Also, in the root directory, there may be an "autorun.inf" file that starts the "q83iwmgf.bat.  

You can open the "autorun.inf with the notepad program. If you see references to the 

"q83iwmgf.bat", then I would delete it.  You can also just rename the "autorun.inf" to 

"autorun.bak, just to play it safe.

I had Norton Antivirus, and then PC tools. Norton didn't detect the virus at all. PC tools 

found some files, but Avast cleaned my computer real well. I also used cc cleaner.

Below is some info on the Kavo trojan from a  tendmicro webpage:

Details:


Arrival, Installation, and Autostart Technique

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites. 

It drops the following file(s)/component(s): 

%System%\kavo.dll - detected as WORM_ONLINEG.TCZ 
%System%\kavo.exe - copy of itself 
%User Temp%\2.dll - detected as TROJ_AGENT.HCB 
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)

It creates the following registry entry(ies) to enable its automatic execution at every system startup: 

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
kava = "%System%\kavo.exe" 

Other System Modifications

This worm modifies the following registry key(s)/entry(ies) as part of its installation routine: 

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
Hidden = "2" 

(Note: The default value data for the said registry entry is 1.)

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
ShowSuperHidden = "0" 

(Note: The default value data for the said registry entry is 1.)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\
Hidden\SHOWALL
CheckedValue = "0"

(Note: The default value data for the said registry entry is 1.)

Propagation via Physical/Removable/Floppy Drives

This worm drops copies of itself in all physical drives. It drops copies of itself in all removable drives. The dropped copy is named Q83IWMGF.BAT. 

It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed. The said .INF file contains the following strings: 

;faKwLJDsLkw329ok33asfLo8kid4ed2
[AutoRun]
;rsaa6swepL3240KIJwoaprD
open=q83iwmgf.bat
;lddw7wA4k2wZk8Sdaralaw2Seo2ijKqk3lsi5Aldir2r4swksJe3k
4i2kfKksfs4JDk0
shell\open\Command=q83iwmgf.bat
;SLs7KdassilkaDckAak30owkKisks4idk0wd4aiijsi5LlfrKfa7eoaSl
523iK6DLlqaLw3Fa2Dw4AJ
shell\open\Default=1
;dAoi
shell\explore\Command=q83iwmgf.bat
;AKis2K3ad8aoDUaswLrcAKl13K2wwZaaswdD0Jp0oLjKoj3mroD
Fkjilw3s841qwKf4rsJa02lArsiLKS532snsJ5AkLq30wjo73deirLa4
Swwal9DfqqasqDd 

Affected Platforms

This worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003.

Good Luck!

LJ

LJ Nova · Answer

Hi everyone again.

I came accross some more info on the trojan from threat expert.

I'm going to paste it instead of putting a link just in case the link gets broken.

Remember to run some spyware cleaners and antivirus programs in addition to making manual changes.

As I mentioned before, I finally used "Avast" antivrus. What I like about this program, is that it first does a

"pre - bootup" virus scan with options to move, delete, or repair a suspected file (before windows boots up).

Good Luck again.

LJ Nova

Here is the other info:

Submission Summary:
Submission details:
Submission received: 24 July 2008, 22:11:06 
Processing time: 4 min 10 sec 
Submitted sample: 
File MD5: 0x23060C63F9DA773A0C7B6F602C6374F5 
Filesize: 114,138 bytes 
Alias: Trojan.Lineage.Gen!Pac.3 [PCTools], Worm.Win32.AutoRun.cgm [Kaspersky Lab], Infostealer.Gampass [Symantec], PWS-LegMir.gen.k [McAfee], TROJ_AGENT.USZ [Trend Micro] 
Summary of the findings:
What's been found Severity Level 
Downloads/requests other files from Internet.  
Modifies some system settings that may have negative impact on overall system security state.  
Creates a startup registry entry.  
Contains characteristics of an identified security risk.  


 

Technical Details:
 

 Possible Security Risk 

Attention! Characteristics of the following security risks were identified in the system:
Security Risk Description 
Trojan-PWS.OnlineGames.ARun Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives. 
Rootkit.Agent.QV Rootkit.Agent.QV injects rootkit components into Windows processes and attempts to hides itself from detection. It also made changes to Windows Explorer settings and download other malicious files from external servers. 


Attention! The following threat categories were identified:
Threat Category Description 
 A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment 
 A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.) 
 A network-aware worm that attempts to replicate across the existing network(s) 


 

 File System Modifications 

The following files were created in the system:
# Filename(s) File Size File MD5 Alias 
1 c:\autorun.inf  466 bytes 0x2404A88FABFF35F1B244CDEE5664C073 Generic!atr [McAfee] 
2 %Temp%\jrq4x8.dll  30,578 bytes 0x734A054AC2EC5C0C0F551E96CE5D3C56 Trojan-PWS.OnlineGames.ARun [PCTools]
Trojan-PSW.Win32.OnLineGames.qqj [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k.dll [McAfee] 
3 c:\q83iwmgf.bat 
%System%\kavo.exe 
[file and pathname of the sample #1]  114,138 bytes 0x23060C63F9DA773A0C7B6F602C6374F5 Trojan.Lineage.Gen!Pac.3 [PCTools]
Worm.Win32.AutoRun.cgm [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k [McAfee]
TROJ_AGENT.USZ [Trend Micro] 
4 %System%\kavo0.dll 
%System%\kavo1.dll  96,768 bytes 0xDA7E52628CD4A22C1E97179B0CD7C0C4 Trojan.Lineage.Gen!Pac.3 [PCTools]
Trojan-PSW.Win32.OnLineGames.pui [Kaspersky Lab]
Packed.Generic.61 [Symantec]
PWS-LegMir.gen.k.dll [McAfee]
TSPY_GAMESONLI.C [Trend Micro] 


Notes:
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP). 
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP). 
 

 Memory Modifications 

There were new processes created in the system:
Process Name Process Filename Main Module Size 
kavo.exe %System%\kavo.exe 233,472 bytes 
[filename of the sample #1] [file and pathname of the sample #1] 233,472 bytes 


There was a new memory page created in the address space of the system process(es):
Process Name Process Filename Allocated Size 
explorer.exe %Windir%\explorer.exe 131,072 bytes 


The following module was loaded into the address space of other process(es):
Module Name Module Filename Address Space Details 
kavo0.dll %System%\kavo0.dll Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x20C0000 - 0x20EA000 


 

 Registry Modifications 

The newly created Registry Value is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
kava = "%System%\kavo.exe" 

so that kavo.exe runs every time Windows starts

The following Registry Value was modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
CheckedValue = 0x00000000 

so that hidden files and folders are not displayed in explorer when browsing the file system

 

 Other details 

The following Internet download was started (the retrieved bits are saved into the local file):
URL to be downloaded Filename for the downloaded bits 
http://www.tw7890.com/pp/aa.rar %Temp%\aa.rar

LJ Nova · Answer

Attn: Moderator!!!!!!!

Please deliete my previous post.

There is a possibility that someone could clidk on the link at the bottom of my post -  the part that was pasted for referece - a link was included in the info about the trojan - this web  page created a clickable link.

Do not click on the link at the bottom  of my previous post !!!!!!!!It was contained only for reference!

LJ

honeynutos · Answer

I normally don't reply to these threads, but I am so glad that I found this one. I'm not sure what to do after changing the key to "1" but I feel like I'm finally getting somewhere. Thanks a bunch! This is really exciting, really.

Yvrac · Answer

1. Go to Start --> Run, then type Regedit
   2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
      CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
   3. Find a key called CheckedValue.
   4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.

courtesy from...the internet also... hehehe

nickoftime · Answer

Here is a simple solution - complete with a brief explanation and a .reg file to fix the problem!  Once you merge the .reg file, the option to show hidden files will work again.
https://www.winhelponline.com/blog/show-hidden-files-and-folders-option-missing-or-does-not-work/

Kool_Ravian · Answer

Some malware can modify Windows settings to disable or prevent users to change setting of Show Hidden Files and Folders under folder options. These steps will help you regain access or modify and save the settings.

PROCEDURE A:
1 . Go to Start > Run
2. Type regedit on the box
3. On Registry editor navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\
Folder\Hidden\SHOWALL

4. On the right pane, delete the value with

    * Name: CheckedValue
    * Type: REG_SZ
    * Data: 2

5. Create a new DWORD. Right-click on the right pane > New >DWORD Value

6. Value should be:

    * Name: CheckedValue
    * Type: REG_DWORD
    * Data: 1

Note: If procedure A does not work, please use Procedure B.

Kool_Ravian · Answer

PROCEDURE B:
1. Open Notepad
2. Copy and paste the following :

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]
    "Text"="@shell32.dll,-30499â€³
    "Type"="group"
    "Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\
    00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\
    48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\
    00
    "HelpID"="shell.hlp#51131â€³

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
    "RegPath"="Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    "Text"="@shell32.dll,-30501â€³
    "Type"="radio"
    "CheckedValue"=dword:00000002
    "ValueName"="Hidden"
    "DefaultValue"=dword:00000002
    "HKeyRoot"=dword:80000001
    "HelpID"="shell.hlp#51104â€³

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
    "RegPath"="Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced"
    "Text"="@shell32.dll,-30500â€³
    "Type"="radio"
    "CheckedValue"=dword:00000001
    "ValueName"="Hidden"
    "DefaultValue"=dword:00000002
    "HKeyRoot"=dword:80000001
    "HelpID"="shell.hlp#51105â€³

3. Go to File > Save As
4. Save it in your Desktop with File name: folderoption.reg
5. Close Notepad
6. Go to your Desktop
7. Double-click the folderoption.reg
8. If it prompts if you want to add the information on the registry, click YES
9. It will confirm that information was successfully entered into registry, click OK
10. You should now be able to modify Show Hidden Files and Folders settings.

Kool_Ravian · Answer

this will definately gonna work.....

rajesh · Answer

so said yaar,

sorry to say but now I dont have nay other solution. becoz I tried it on more than ten system and it worked as charm.
i think ur problem is a little critical. ok don't worry I will look into the matter and if find any solution I wiil reply u.

but don't format ur pc yaar bcoz it is last solution.

regards
Rajesh

DoomCrier · Answer

Its a virus which cause that.
You can try scan your computer using anti-virus software.

If you can't solve the problem, try download Ad-aware (Lavasoft) and use it to scan.
I'm sure you can view back your hidden files.^^

Akhil · Answer

Hi! eveybody

i was having the same problem for last few days, but then I installed WinRAR in my pc and then open it and extracted the desktop into WinRar and as a result I got all my hidden files back and copied them and save to another disk.....try it it will definately work......

manmeet bhatia · Answer

first scan all ur system..

1.(Go to Start --> Run, then type Regedit 
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\ 
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL 
3. key called CheckedValue. 
4. Double Click CheckedValue key and modify it to 1. 
This is to show all the hidden files
 





otherwise mail me at manmeet.bhatia@rocketmail.com

Rood · Answer

Hi ...
it happened with me. u can download a software "RRT.exe" it solves ur problem.

enzo · Answer

https://www.howtogeek.com/howto/windows-vista/restore-show-hidden-files-and-folders-option-in-vista/
If this registry entries is deleted - normally by some spyware or something like it - just go to another computer that have the same OS and export the entire folder of registry entries (right click on the "Hidden" folder). Than pick that REG file and just double click on your computer. VoilÃƒÂ¡

FERPY · Answer

To delete the Registry Hack do the following:
1- Open the Comand Prompt - Start-RUN-cmd
2- Finish the Explorer Task:  taskkill /f /im explorer.exe
3- Check the following archives in C:  a1.bat and autorun.inf  Dir /ah
4- Change attributes --  atrrib -h -r -s a1.bat and atrrib -h -r -s autorun.inf
5- Delete this files -- del a1.bat  del autorun.inf
6- Change settings of hidden folders like usuall ENJOY!!! Its done

Lebaman · Answer

fo to run then type regedt32

the go to hkey_current_user  software  microsoft   windows   currentversion  explorer  adcanced

then on the right side u'll see word hidden double click on it and change the valuedata  to 1...and the go c:\ for example and click refresh....

hope that I helped you.....

another method is to go to cmd

and type there " attrib -h *.* c:\..... " the path u want" 

and all hidden files will not be hidden any more.

lebaman · Answer

do not mention it man...i suffered from such a problem for several days :)

sina khosravi · Answer

hi 



i have a monstrous problem concerning my hidden files, I can't see them anymore and when I enter in tools, folder options so as to click and see my hidden folders...it returns back to "do not show" any clue????
window xp media center
thank for your help

Akhil · Answer

I have faced the similar problem of hidden files.....therer two ways to solve this proble

1)  I just used winRAR and extracted the desktop in this s/w and all my hidden files of desktop was visible to me.....it   works definately

2) Just follow the following steps:-
i) go to the start button and select Run 
ii) type cmd in the pop up box and come to the dos prompt
iii) To see the hidden files and folders type command:- dir/ah and press enter
iv) To unhide the file type:- attrib filename.extension -h -s and press enter
                                                        OR
                                       attrib * -h -s and press enter
vi)                                    attrib foldername -h -s

Believe me these two methods will help u a lot without formatting ur pc

lucifer8780 · Answer

thanks for the reg help but I had another question, most of my program links in start->all programs are gone. when I use ccleaner it finds them in a folder HKCU\software\microsoft\windows\currentversion\explorer\menuorder\start menu 2\programs.  and I see them there. is there anyway to restore the whole folder of icons so I dont have to reass the shortcuts such as disk defrag and such. thanks

evolution · Answer

thanx buddy .
finally I can access my hidden files.
thanx a lot...

GameOverNenoIsHere · Answer

hey all just use this programe it's will take 10min
GameOverNenoIsHere say--->(ComboFix)

Sun · Answer

Hi Everybody.

        I can't able to see the hidding files on windows xp. When I will click the Tools-Folder Options-Show Hide Files then it will not showing the hidden files.Y? What happen? I dont know. Plz give me any idea for this .....????????

Kiindly help like this type of problem in system.

trkkr · Answer

1) I just used winRAR and extracted the desktop in this s/w and all my hidden files of desktop was visible to me.....it works definately

2) Just follow the following steps:-
i) go to the start button and select Run
ii) type cmd in the pop up box and come to the dos prompt
iii) To see the hidden files and folders type command:- dir/ah and press enter
iv) To unhide the file type:- attrib filename.extension -h -s and press enter
OR
attrib * -h -s and press enter
vi) attrib foldername -h -s 

This worked for me - thanks tilman

akhil · Answer

Hi Rajni

1) I just used winRAR and extracted the desktop in this s/w and all my hidden files of desktop was visible to me.....it works definately 

2) Just follow the following steps:- 
i) go to the start button and select Run 
ii) type cmd in the pop up box and come to the dos prompt 
iii) To see the hidden files and folders type command:- dir/ah and press enter 
iv) To unhide the file type:- attrib filename.extension -h -s and press enter 
OR 
attrib * -h -s and press enter 
vi) attrib foldername -h -s 

Believe me these two methods will help u a lot without formatting ur pc

badrabuli · Answer

Hi,

I have seen all the post and used all tricks that were discussed in this board but My issue is still there. My folder and files are hidden. When I click on my drive properties it shows me 680MB used but its doesn't show me anything.. I used all the solutions that were discussed on this board but no luck at all. I guess it is a virus and I found my register but its values are ok and scan my pin drive with many antivirus softwares but nothing.

Is there anybody there who can help me and solve my issue? I will be very thankful!

Thanks

mrslash · Answer

Thanx for all these replies I should keep this in mind

P · Answer

Ure unbeleivable...Thanx a million

gen · Answer

THANKS AMIGO, WORKED LIKE A CHARM!

gaurav · Answer

mention not bro..
aur koi help chahiye ho toh bata dena...
byee n tk cr

raghu41986@gmail.com · Answer

log in through administrator then try same thing and u need to remove check points in hidden system files

Jack · Answer

http://www.pcmagics.com/category/virus-removal/ 
Provides step.. Worked for me :P

Gaurav · Answer

look guys I had same problem what I did was

(Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHO WALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.)

that should be it guys.. formating wont solve nothing on the begining cauze I tried ti 5 times and every time I get same error so good luck for all :)

RedPlasma22 · Answer

Thanks so very much. This saved me having to reformat and reload!!! Worked like a charm.

Denm · Answer

If you want an easy solution for your problem visit this site: http://techrena.blogspot.com/2008/11/how-to-show-hidden-files-and-folders-in.html A detailed explaination is given there and anyone can solve the problem in seconds..

beh_555 · Answer

taAanXxXxXXXXXXXXXXXXXXXXXXXxxxxxxxxXXxxxXXXX
tan_QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ

Can't see hidden files

135 responses

Similar discussions

Subscribe To Our Newsletter!