Show Hidden Files in Explorer (XP)

Topic

New Reply

I know it sounds strange but I do not see hidden or system file in Explorer; this worked before but I checked and in “Folder Options”, I have “Show hidden files and folders” selected; I also have “Hide protected operating system files” unselected.
Even switched them off, applied and switched them back on… no difference. Yes, I restarted Explorer and also tried rebooting.

Anyone?

Oh, by the way, I KNOW there are hidden files/dirs as Explorer tells me in the Status bar e.g. “13 objects (plus 9 hidden)”. I know what these hidden ones would be but again, I don’t see them.

Reply | Quote

Replies

Does Find Files (and Spyware) that are hidden even when Show Hidden Files is enabled help you see what you can’t see?

Reply | Quote

Thanks for the suggestion; I tried that, this is what I did:

Created a file “Hidden.txt” in a folder. Used Explorer to set the Hidden-attribute. Surely when I refreshed the view in Explorer it was gone (and I re-verified my ‘show hidden files’ settings).
Next I went into command mode (CMD) and type “ATTRIB”, luckily (?) it showed my file OK. So it seems to be something with the Explorer…

Reply | Quote

From the Help and support on my XP machine
[indent]

---

To display hidden files and folders
Open Folder Options in Control Panel.
Click Start, and then click Control Panel.
Double-click Folder Options.
On the View tab, under Hidden files and folders, click Show hidden files and folders.
Notes

Hidden files and folders will appear dimmed to indicate they are not typical items. Usually, hidden files are program or system files that should not be deleted or changed. To display other hidden files, clear the Hide protected operating system files (Recommended) check box.
If you know the name of a hidden file or folder, you can search for it . For more information, click Related Topics.
If you want to see all file name extensions, clear the Hide file extensions for known file types check box.

---

[/indent]

DaveA I am so far behind, I think I am First
Genealogy....confusing the dead and annoying the living

Reply | Quote

Well… that is just what my problem is (and what I described above) – I did all this and my hidden files remain invisible!!!

Reply | Quote

Is XP fully patched? Are you running as an administrator?

Joe

--Joe

Reply | Quote

Yes, I’m fully patched and logged on as admin

Reply | Quote

Don’t know if it helps, but there are “sneakier” ways to hide files/ folders in Windows. The three methods explained in How to hide files and folders in Windows XP might give some insights.

Alan

Reply | Quote

Checked that briefly; it talks about the ‘standard’ way via Explorer and then it continues to describe ATTRIB (and that was suggested before and I did check that). More is there but not (I think) relevant.

Basically, I’m still not clear what’s the cause of my problem. Could it be a registry and/or group-policy setting maybe?

Reply | Quote

I’d think it would be GP only if it is a work PC and you have restrictions set by an admin.

Joe

--Joe

Reply | Quote

Nope, it’s my private PC @ home. I am the (only) admin and I’ve never (intentionally) set any GP restrictions. Now a TOOL could have done that maybe, but if so and if that would be the case:

(1) how would I find out?

(2) Wouldn’t the options be dimmed in the dialog box then? (Mine SEEM to work, but in fact they don’t as reported).

Reply | Quote

Open Windows Registry, navigate to

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced

and change following DWORD values:

“(Default)” to 0
“Hidden” to 1
“HideFileExt” to 0
“ShowSuperHidden” to 1
“SuperHidden” to 1
“WebViewBarricade” to 1

There are per user settings.
Your account must have rights to change Registry settings. If it is not, use RUNAS command to open Regedit.

Reply | Quote

I hope you don’t mind a followup question, even though I’m waiting too to see what Erik finds when he checks your recommendation. Just for curiosity, I checked my registry and all the settings you mentioned are set the way you recommended except for the Default. In my registry it says Not Set. Can you tell me something about how or why one should set it to zero, please?

The obvious reason I ask is that I don’t have the problem Erik is trying to solve, my settings agree with your recommended and I don’t know what role the Default being either “Not Set” or a zero or one plays in the way this function operates. I don’t mind doing some reading if you want to point me to a link somewhere. Thanks!

Reply | Quote

Al,
Just to chime in, I checked my settings and they agree with yours, including Default Value Not Set.

Maybe he meant that set to 0, really meant “NOT SET”?

Reply | Quote

Sorry I didn’t answer earlier. I used Registry Monitor (which Joe mentioned already) when I made changes through Control Panel > Folder Options. Between values which were changed was (Default) also. I’m guessing it’s a sign that values were changed from factory defaults: basically 0 means “FALSE”, i.e. Default = false.

Reply | Quote

Cool, I’ll try later but this is what I have now:

“(Default)” >>> (value not set)
“Hidden” >>> 2
“HideFileExt” >>> 0 [OK]
“ShowSuperHidden” >>> 2
“SuperHidden” >>> 0
“WebViewBarricade” >>> 0

So I expect this will work; like Big Al, I’m curious to find out what these entries do specifically so before I’ll try this, I’ll do some searching on the Net to find out!

Thanks already!

Reply | Quote

OK, couldn’t find good explanations for what this all means (certainly not somewhere @ Microsoft) the “2” values are very strange as most of the time this should be ones or zeros, a two could indicate a virus or so… (but I have an active and up-to-date scanner loaded always). So I decided to just change the values to the ones given… that seems to work but after some checks it appears that the values are quickly re-set to the original ones I reported… isn’t that strange?

Reply | Quote

If you want to track down what is modifying those values you can use Process Monitor or RegMon for Windows.

Joe

--Joe

Reply | Quote

And again I can’t see my hidden files and folders… (XP – SP3)

In HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced

This is what I have…

“(Default)” >>> (value not set)
“Hidden” >>> 2
“ShowSuperHidden” >>> 2
“SuperHidden” >>> 1
“WebViewBarricade” >>> 1

working via the Explorer Tools menu doesn’t help.

I’m afraid there’s something fishy with my system but all seems normal; AVG is fully updated, so is Malwarebytes, HitmanPro. No one sees anything wrong with my system. I see no strange processes in memory and nothing strange is going on as far as I can see.

I have no clue what some of these registry entries do or mean, here’s what I (think I) know:

“Hidden” is to show hidden files (but what does a value of 2 mean??)
“SuperHidden” also shows hidden system files.

I can’t find a good description (yet) on Internet, also these seem to reset to these values if I change them in the Registry.

Any wizards out there who could shed some light on this??

Reply | Quote

And again I can’t see my hidden files and folders… (XP – SP3)

In HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced

This is what I have…

“(Default)” >>> (value not set)
“Hidden” >>> 2
“ShowSuperHidden” >>> 2
“SuperHidden” >>> 1
“WebViewBarricade” >>> 1

working via the Explorer Tools menu doesn’t help.

Have you tried re-setting all the setting in Windows Explorer, press “Apply to All Folders”, re-boot, use Windows Explorer to set as desired, apply to all folders, re-boot again?

Sometimes Windows just seems to forget this stuff and the only way is to reset and reboot.

Joe

--Joe

Reply | Quote

Tim: seems like you’ve posted without (new) text…

All: I’m still working on this one. I’m (still) suspecting there’s a virus somewhere… all my scanners tell me they can’t find anything (even when I scan in Safe-mode), but I see signs that make me worry…
For instance, there’s files being created in C:Documents and Settingslocal settingtemp. One is named IN2.tmp and seems locked (I can’t delete nor find the process locking it, not find any strange process – there’s not that many left in Safe-mode). I can read and even rename IN2.tmp… (of course I did rename it). Inside I see in the binary stuff a readable link to something like “rss-lenta-news.ru”.
Then every 15 minutes (exactly) a new file is created, with names IE6.tmp, IE7.tmp, IE8.tmp etc. all have size 0 and can be deleted. I looked for ADS (NTFS Alternate datastreams), but couldn’t find anything abnormal. I searched the Internet, did find some stuff but nothing really clear.
Tonight I plan to run SDFIX and COMBOFIX, tools described on “BleepingComputer”, see if that helps.

For the record: All my tools are up-to-date, I use AVG for virusses and spyware, ZoneAlarm as firewall (plus I am behind a router), Malwarebytes, SuperAntiSpyware, HitmanPro (who did see the files being bad, but only those TMP files, not the memory loaded module or the root-cause file) and some more stuff. I checked with HijackThis, and AutoRuns… all more or less normal…

Reply | Quote

Tim: seems like you’ve posted without (new) text…

All: I’m still working on this one. I’m (still) suspecting there’s a virus somewhere… all my scanners tell me they can’t find anything (even when I scan in Safe-mode), but I see signs that make me worry…
For instance, there’s files being created in C:Documents and Settingslocal settingtemp. One is named IN2.tmp and seems locked (I can’t delete nor find the process locking it, not find any strange process – there’s not that many left in Safe-mode). I can read and even rename IN2.tmp… (of course I did rename it). Inside I see in the binary stuff a readable link to something like “rss-lenta-news.ru”.
Then every 15 minutes (exactly) a new file is created, with names IE6.tmp, IE7.tmp, IE8.tmp etc. all have size 0 and can be deleted. I looked for ADS (NTFS Alternate datastreams), but couldn’t find anything abnormal. I searched the Internet, did find some stuff but nothing really clear.
Tonight I plan to run SDFIX and COMBOFIX, tools described on “BleepingComputer”, see if that helps.

For the record: All my tools are up-to-date, I use AVG for virusses and spyware, ZoneAlarm as firewall (plus I am behind a router), Malwarebytes, SuperAntiSpyware, HitmanPro (who did see the files being bad, but only those TMP files, not the memory loaded module or the root-cause file) and some more stuff. I checked with HijackThis, and AutoRuns… all more or less normal…

Did COMBOFIX, it did find stuff (a RootKit I believe). I’m now back online and guess what… the hidden files thing is solved!! I can now see my hidden files again. Guess my problems must have been caused by a virus and/or rootkit… I know what to watch for next time!

Reply | Quote

Did COMBOFIX, it did find stuff (a RootKit I believe). I’m now back online and guess what… the hidden files thing is solved!! I can now see my hidden files again. Guess my problems must have been caused by a virus and/or rootkit… I know what to watch for next time!

Congatulations!!! Rootkits can be nasty, difficult to find, and even harder to clean up. Glad you are back in business. Thanks for posting back.

Joe

--Joe

Reply | Quote