Tuesday, December 11, 2012

Recovering Hidden Files on Server 2003 after virus / malware

Recently, one of our clients got hit by a virus and several malware. Even after cleaning the virus and malware from the server (running Server 2003), the client machines (running Windows 7) were not able to see many of their files on their mapped drives. Even after restoring the files from backup, and verifying the files are on the server the client was not able to see them.

I took a deeper look at the folders and found that the HIDDEN and READONLY attributes were set. I found this by right clicking on the folder and going to properties.

For example, you can see from this screen shot that the folder "RECYCLER" is a lighter shade than the other folders.

When I right click the RECYCLER folder I see that the "Read-only" and the "Hidden" attributes are checked. You can also see that the "Hidden" attribute is greyed out. I can not uncheck the attribute.


Word of caution, some folders are SUPPOSED to be hidden and you should be sure that the folders you use the following "fix" on you WANT people to be able to see.

Next, I logged into the server (Server 2003) and opened a command prompt. I used the following command to clear the hidden attribute: >attrib -h -s foldername


As you can see, I just went down the line of folders. You can also create a batch script if there are a lot of folders and you don't want to type out each name.
Once this is done, the folder is no longer hidden, nor are the files inside of it and the clients can all see their mapped drive folders and files.