Show hidden files and folders not working – after virus attack (heap41a svchost.exe)
I had this problem.
The best way to remove a computer virus is like a doctor treats viral infections.
A doctor’s approach to a USB drive viral infection
In Tools> Folder options > View – hidden files and folders
The
Show hidden files and folders not working – after virus attack (heap41a svchost.exe)
This is how you get the settings back to normal.
First take
Start > Run >
Type regedit in the Run box and click OK
The Registry editor opens up (See the image below)
Follow the steps in the animation below to get back the folder options to normal to see hidden files.
Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Change the value of CheckedValue from 0 to 1
Cleaning the pen drive right click options :
Browse to HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\MountPoints2
Delete all the long keys ( which look like {DGF53-353b3gg3-353523-3g523g} ) there.
Still having problems with this “Orkut is banned” virus ” ??
First make sure that the virus is completely removed from the computer.
How to remove “Use Internet Explorer you dope, I dnt hate Mozilla but use IE`r OR ELSE…” svchost.exe heap41a virus
http://www.fundazone.com/2007/06/how-to-remove-use-internet-explorer-you-dope-i-dnt-hate-mozilla-but-use-ier-or-else-svchostexe-heap41a-virus/
Then go to :
Start >Run >
Type regedit
Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Change the value of CheckedValue from 0 to 1
Take My Computer > Tools > Folder Options
Change the setting to show hidden files and folders
Apply and check again.
If it doesn’t work, there is another setting in the registry maybe in HKEY_USERS or HKEY_CURRENT_CONFIG or even HKEY_CURRENT_USER which overrides this setting.
I’ll try to find out where it is (I came across such a problem earlier and I found that key by luck) The key is in a similar place like this \Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
only that the beginning is different.
I’ll post it here when I find it. If anybody knows where it is, please do reply http://www.fundazone.com/2007/09/show-hidden-files-and-folders-not-working-after-virus-attack-heap41a-svchostexe/#comment-146
It’s a relatively new virus, so most antivirus softwares are not able to detect and delete it.
To remove the virus completely, first you have to end the process svchost.exe belonging to the current user (i think you were able to do that and it worked). But then, the virus files are still hidden in your computer in two places.
In C:\heap41a and in temporary folder.
A trick to get to these folders :
Start > Run
Type C:\heap41a . Click OK
Now, you should be able to see and delete the virus files
Second location (temporary files)
Start > Run
Type %temp% . Click OK
Here, you see the virus files it used to enter the computer.
September 17th, 2007 at 11:16 pm
this method works well but is temporary coz the problem remains after the pc is restarted, i have also bootscanned my pc so there does’nt seem to be any virus, so plz help me out
September 18th, 2007 at 10:49 am
First make sure that the virus is completely removed from the computer.
How to remove “Use Internet Explorer you dope, I dnt hate Mozilla but use IE`r OR ELSE…†svchost.exe heap41a virus
http://www.fundazone.com/2007/06/how-to-remove-use-internet-explorer-you-dope-i-dnt-hate-mozilla-but-use-ier-or-else-svchostexe-heap41a-virus/
Start >Run >
Type regedit
Browse to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Change the value of CheckedValue from 0 to 1
Take My Computer > Tools > Folder Options
Change the setting to show hidden files and folders
Apply and check again.
If it doesn’t work, there is another setting in the registry maybe in HKEY_USERS or HKEY_CURRENT_CONFIG or even HKEY_CURRENT_USER which overrides this setting.
I’ll try to find out where it is (I came across such a problem earlier and I found that key by luck) The key is in a similar place like this \Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
only that the beginning is different.
I’ll post it here when I find it. If anybody knows where it is, please do reply here.
December 30th, 2007 at 10:28 pm
Thank you very much all my problems are solved..wen i consulted my technician.he told me i should re-install the entire system.I was so worried about loss of data..thankyou..so much
April 18th, 2008 at 10:55 am
thank you..
i was worried that how can i remove this problem from my computer…
it has helped me a lot..
thank you..
August 4th, 2008 at 9:03 am
There’s a virus in my computer which is named r813.bat virus. My antivirus which is avast professional sees it but can’t remove it. It’s affecting my folder option. How can i remove it?
October 16th, 2008 at 7:57 am
uhmm..i’m new to this so i’ll try it..but i think it well help a lot..coz everything goz well if you can edit your registry..that’s your pc life..^^registry^^
October 16th, 2008 at 8:14 am
wow..i’ve tried it..it realy worked..the heap41a thus not exist already to i tried the temp..then i deleted all the temporary files..i can already see all the hidden files in my pc..tnx a lot..
February 19th, 2009 at 10:04 am
i scanned my pendrive using AVG n detected a lot of various trojan n worm. i cleaned it. the problem is when i opened my pendrive there are nothing to show..so i enabled “show hidden file” options. but it remains same. when i checked the capacity..there still used space there..bigger spaces which means the files and all my document still in my pendrive but i cant see it…plz help..
March 1st, 2009 at 10:42 pm
i ma gopi from india.
it is really super and it is work fine
Really a big thanks to you
pls tell what is ur name
March 19th, 2009 at 11:17 pm
[...] Search hidden files and folders (* see below if this doesn’t [...]
July 14th, 2009 at 4:14 pm
Download & Install Trojan remover.. You get a permanent solution..
August 1st, 2009 at 12:55 pm
Thank you for your solution.