Windows - Attrib - Showing hidden files by virus

Some virus affecting our Windows System by replacing our documents with infected files, hiding the real documents and changing attribute to system files. It causing documents can't be seen on normal windows explorer view. We have to set show hidden enabled on folder option to make the document viewable.

But in some case, virus also prevent us from using windows system tools to fix the problems caused by virus like disabling regedit, msconfig, hidding folder option and etc. Even if the virus has been removed from our System they will still left those problem behind.

Re-showing the hidden files is easy, it can be done easily using dos with attrib command. But did you know what is the option after the attrib command means?

Attrib is a command, in MS-DOS and Microsoft Windows. The function of attrib is to set and remove data attributes (read-only, archive, system and hidden). These attributes are used by a wide variety software to protect and classify files (Source :Wikipedia).

Let's typing "ATTRIB /?" in MS-DOS prompt.

A couple option information are listed, there are:

+ Sets an attribute.
- Clears an attribute.
R Read-only file attribute.
A Archive file attribute.
S System file attribute.
H Hidden file attribute.
/S Processes matching files in the current folder and all subfolders.
/D Processes folders as well.

For example, a flash drive with all files and folder hidden by a virus, and assume the drive was F
c:\>F: //Changing to drive F
F:\>ATTRIB -S -H /S /D *

It's mean changing attribute on drive F, Clear File System attribute (-S), Clear Hidden attribute (-H), Process for matching files in the current folder and all sub folder (/S), and Process the folder as well.

Links:
http://en.wikipedia.org/wiki/Attrib