Tips and Hints

Return to LTCT 2012 page

Common USB viruses HIDE and set the SYSTEM flag on the directories, and replace them with infected EXEs that act like a folder. After your antivirus removes the EXEs you are left with lots of hidden stuff. Here is a quick and easy batch file to make them visible again.

--------- UnHideFolders-USBvirusRecovery.bat ---------
@REM Viruses like to HIDE folders on the root of a drive, and replace them with infected EXEs.
@REM       This batch file removes the system and hidden attributes from non-system folders.

set USBDrive=e:

@for /f "delims=" %%i in ('dir %USBDrive%\ /b /ashd') do @(^
if      /i "[%%i]"=="[RECYCLER]" (echo ignore_this > nul ) ^
else if /i "[%%i]"=="[System Volume Information]" (echo ignore_this > nul ) ^
else if /i "[%%i]"=="[$RECYCLE.BIN]" (echo ignore_this > nul )  ^
else (
  @echo Unhiding directory %%i
  @attrib -s -h "%USBDrive%\%%i"
  )
)
@echo.
@echo.
pause
--------- end of batch file --------------