Friday, March 28, 2008

How to retrieve document hide by virus

This guidance especially for virus attack which hide not destroy your document. Follow this simple step:
1. click start > run
2. type "cmd" to get in DOS environment
3. change your active directory and turn to where the folder or drive with your document hide by virus. It's ok if you leave this step.
4. type command "attrib" (without quotes of course). "attrib" is stand for attribute. this command purpose is to add or erase one or some attribute in one file. It could be understand if you know how the virus works to hide your document: The virus adds "h" and or "s" attribute! "h" attribute will make your file "hidden" and "s" attribute make your file be categorized as a system file, that the system will think this type of file now has to be hide. Now you know why your document disappear.
5. follow the command "attrib" with space and type "-h -s". example: c:\>attrib -s -h. The mark"-" means you are going to erase the "s" and "h" attributes added by virus. To do the opposite, you have to type "+s" or "+h".
6. continue the command with the hidden file's path. c:\>attrib -s -h f:*.* /s /d. this mean that your hidden files located at drive f, and you order the system to search any hidden files (*.*), to locate to current folders and sub folders (/s), and to do as well to any folders (/d).
7. press enter.

note: if you want to know the whole guide of use of attrib command, just type "attrib /?"

hope useful..

No comments: