Problem with “Show Hidden Files & Folders” in windows Folder Option – WORM_AUTORUN.RW

I encountered a very tricky problem with hidden files and the option in the “Folder Option” menu in Windows. A virus spreaded from and external pen drive and ultimately slowed down the windows so much and at a certain point the windows wasn’t even starting and eventually I had to reinstall the Windows. But the problem wasn’t over even after reinstalling the windows. Another symptom was that when I double clicked on any of the Drives a new window opened everytime, and later on double clicking was’t working at all. I had to navigate through the browser. Later I had to follow a set of instruction to get rid of this problem:

PART: A (Removing the Virus/worm/trojan) 

1. Install AVG antivirus solution and update it.

2. I  had NC (Norton commander)a very old dos based explorer, . I opened NC from the command prompt, and through it I could browse through my drives and could see what damages the virus did. There was a file named u.bat  and also autorun.ini in all my drives. I deleted those. Then I made sure that the file named amvo.exe (C:\windows\system32\amvo.exe) was deleted (stop it from the taskbar if it is running in the process tree). Then I deleted almost all the files in the “system volume information” folder (restore point files). Remember, I used NC to do the above jobs as the files I mentioned above were in hidden format and wasn’t visible through normal explorer. But through NC you can browse and delete these.

The above method worked in my case, but cannot be guaranteed in all the cases.

PART: B (Fixing “Show Hidden Files & Folder” problem)

Go to the following registry key: (go to Start >> Run >> type “regedit” and then press “ok”)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

DELETE the value CheckedValue in the right window. (Its type should be REG_SZ and data should be 2.)

Now create a new DWORD value called CheckedValue (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0x00000001).

This should let you change the “Show Hidden Files and Folders” option now.

Be safe, be careful, use protections, ensure prevention and avoid cure hassles. 😉 😉

 

Bookmark the permalink.

10 Comments

  1. Thanks dude very useful information to me. I was facing same problem..

  2. grtttttt
    it worked

  3. thanks a lot… it was a great help… 🙂

  4. I hav a problem….i went to the destination folders…but the file CheckedValue is not REG_SZ and data is not 2. instead it REG_DWORD and data is zero

  5. i solved the problem……even if that data is DWORD, u have to change it to 1….and thts it…

  6. gr8 solution thanks

  7. thank u so much for ur superb information..

    nw my problem get solved

  8. Hello ? have same problem but the solutions doesnt work.
    CheckedValue is not REG_SZ and data is not 2. instead it REG_DWORD and data is zero
    and ? change only the data with 1.
    but it isint save when ? open again it return 0.
    and ? couldnt see my hidden files…

  9. Hello ? have same problem but the solutions doesnt work.
    CheckedValue is not REG_SZ and data is not 2. instead it Shows REG_DWORD and data is zero
    and I changed only the data with 1.
    but it isint save when I open again it return 0.
    and I couldnt see my hidden files…

    and in the folder options it shows Number 1 instead of show hidden files option.

  10. Pingback: Can’t unhide files / folders after being infected by virus?

Leave a Reply

Your email address will not be published. Required fields are marked *