|
FileHider Virus is still active, is your Anti Virus up to date? If not then
do it before trying to repair the damage... |
Before you reset the attribute you have to eradicate it, does that make sense?
A question that has a lot of popularity in my old Q & A forum is about
the
filehider virus that sets the "Hidden" attribute on files and folders, then locks out the Explorer from removing the hidden attribute.
Then why can't some people understand this?
From: https://www.virus-database.com/description/1186-filehider.1067.html
about the this virus.
This web site is no longer available.
The current FileHider Virus is an updated version of the old DOS FileHider.1067, the updated version not only hides files it also modifies the Explorer program to keep it from removing the hidden attribute of files and folders by intercepting INT 21h
(interrupt 21h is the instruction to read file attributes). Then it writes itself to the end of any executable file that is opened or executed while the OS is running. Although not destructive it is annoying and may display messages such as:
Good machine you have!
Monochrome is out! Try VGA graphics!
Making day out of night again?
Give me a rest!
Your disk is quite full, isn't it?
Insure your AV programs are up to date. To eradicate this virus from a computer running the Windows OS you should be in the 'Safe Mode'.
A file attribute is the setting that tells the Operating System what a user can do to a file, it is a set of bits that are attached to the file name in the MFT (Master File Table) when the file is created, changed, or when security is applied.
The attribute bits are:
- Read Only
- System
- Hidden
- Archive
- Compressed
Although Explorer will only show the Read Only and Hidden attributes.
For more information on Anti Virus programs see the
Self Computer
Repair Unleashed 2nd Edition Manual.
The 5 Steps to high quality and cheap
DIY Computer Repairs
Get It Today...
|
|
The easiest way to reset the attribute is to use Explorer (you should be in
the 'Safe Mode') and right click on the folder that was affected by the virus, go to Properties, remove the check box from "Hidden" then click apply. When the window opens asking if you want to remove the attribute from the folder or the contents click the radio button that says "Apply changes to this folder, subfolders, and files".
Do not do this to the Root of the Boot drive, this will remove the hidden attribute from the system files and you really don't want to do that.
If you are comfortable with the command line - you should be in the 'Safe Mode'
- (DOS box) you could use the attrib.exe command (from the C:\Windows\System32\ folder) in each folder that has had the hidden file attribute set, this would take a little longer than using the Explorer program but will have the same results.
If you suspect that there are hidden files in a folder use the attirb.exe program to find them, check the help file by typing attrib.exe /? or attrib.exe /help at the command prompt to see a list of options and commands for the program.
|
Proudly Made in The U. S. A.
www.diy-computer-repair.net