Problem with “Show Hidden Files & Folders” in windows Folder Option – WORM_AUTORUN.RW

I encountered a very tricky problem with hidden files and the option in the “Folder Option” menu in Windows. A virus spreaded from and external pen drive and ultimately slowed down the windows so much and at a certain point the windows wasn’t even starting and eventually I had to reinstall the Windows. But the problem wasn’t over even after reinstalling the windows. Another symptom was that when I double clicked on any of the Drives a new window opened everytime, and later on double clicking was’t working at all. I had to navigate through the browser. Later I had to follow a set of instruction to get rid of this problem:

PART: A (Removing the Virus/worm/trojan) 

1. Install AVG antivirus solution and update it.

2. I  had NC (Norton commander)a very old dos based explorer, . I opened NC from the command prompt, and through it I could browse through my drives and could see what damages the virus did. There was a file named u.bat  and also autorun.ini in all my drives. I deleted those. Then I made sure that the file named amvo.exe (C:\windows\system32\amvo.exe) was deleted (stop it from the taskbar if it is running in the process tree). Then I deleted almost all the files in the “system volume information” folder (restore point files). Remember, I used NC to do the above jobs as the files I mentioned above were in hidden format and wasn’t visible through normal explorer. But through NC you can browse and delete these.

The above method worked in my case, but cannot be guaranteed in all the cases.

PART: B (Fixing “Show Hidden Files & Folder” problem)

Go to the following registry key: (go to Start >> Run >> type “regedit” and then press “ok”)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

DELETE the value CheckedValue in the right window. (Its type should be REG_SZ and data should be 2.)

Now create a new DWORD value called CheckedValue (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0x00000001).

This should let you change the “Show Hidden Files and Folders” option now.

Be safe, be careful, use protections, ensure prevention and avoid cure hassles. 😉 😉