[chajai]

this is my first time getting this problem. when i go to folder options and click show hidden files and press apply nothing happens and after i press ok still nothing happens and when i go bak to the options it's back to do not show hidden files...it's like it resets itself.
i've tried it about 7 times now and still no luck?
very strange..

[devil_himself]

Click Start/Run,type regedit then press Ok
Navigate to the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\SHOWALL

Now right click on,and delete the value "CheckedValue" in the right hand window.

Now create a new "DWORD Value" called exactly CheckedValue in the right hand window.
Double click on CheckedValue.
In the opening 'Edit DWORD Value' box,set the 'Value data:' to 1

Press Ok,exit regedit,restart your pc.

[chajai]

it tells me "Resgistry Editor cannot rename New Value #1. The specified value name already exists. Type another name and try again"
but i clearly deleted the "CheckedValue" and i even tried renaming it n then making a new checkevalue but it doesnt work
whenever i click something else and go bak to the SHOWALL folder the CheckedValue is back again even after i deleted it a couple times

[devil_himself]

Download the Attached File 'Perm.rar'> Unzip it > Double Click on 'Perm.bat' to Run it > A notepad will pop up > Copy and paste Everything Here

Do the Same with 'Regquery.bat'

[chajai]

Perm.bat
*************************************************************************** ****
Registrykey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\SHOWALL

Permissions:
*************************************************************************** ****
Username
Type Permissions Inheritance
*************************************************************************** ****
3C99F9ACEF0C4E6\Users
Allowed Read This Key Only (Inherited)
3C99F9ACEF0C4E6\Users
Allowed Special (Unknown) Subkeys only (Inherited)
3C99F9ACEF0C4E6\Power Users
Allowed Special (BA54321) This Key Only (Inherited)
3C99F9ACEF0C4E6\Power Users
Allowed Special (A) Subkeys only (Inherited)
3C99F9ACEF0C4E6\Administrators
Allowed Full Control This Key Only (Inherited)
3C99F9ACEF0C4E6\Administrators
Allowed Special (Unknown) Subkeys only (Inherited)
NT AUTHORITY\SYSTEM
Allowed Full Control This Key Only (Inherited)
NT AUTHORITY\SYSTEM
Allowed Special (Unknown) Subkeys only (Inherited)
\CREATOR OWNER
Allowed Special (Unknown) Subkeys only (Inherited)

No Auditing set

Owner: Administrators (3C99F9ACEF0C4E6\Administrators)


regquery.bat


SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 (C)

Error: Key: software\microsoft\windows nt\currentversion\policies does not exist!


SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 (C)

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Active Desktop

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Associ ations

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Explor er
NoDriveTypeAutoRun REG_DWORD 145 (0x91)
NoDriveAutoRun REG_BINARY ffffffff

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\Explor er\Run

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\System

SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 (C)

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explo rer

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explo rer\run

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\NonEn um
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} REG_DWORD 1 (0x1)
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} REG_DWORD 1073741857 (0x40000021)
{0DF44EAA-FF21-4412-828E-260A8728E7F1} REG_DWORD 32 (0x20)

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\Ratin gs

HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\syste m
dontdisplaylastusername REG_DWORD 0 (0x0)
legalnoticecaption REG_SZ
legalnoticetext REG_SZ
shutdownwithoutlogon REG_DWORD 1 (0x1)
undockwithoutlogon REG_DWORD 1 (0x1)

[devil_himself]

Post the Results from 'look.bat' and 'query.bat'

[chajai]

query.bat

SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 (C)

HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\advanc ed
ServerAdminUI REG_DWORD 0 (0x0)
Hidden REG_DWORD 2 (0x2)
ShowCompColor REG_DWORD 1 (0x1)
HideFileExt REG_DWORD 1 (0x1)
DontPrettyPath REG_DWORD 0 (0x0)
ShowInfoTip REG_DWORD 1 (0x1)
HideIcons REG_DWORD 0 (0x0)
MapNetDrvBtn REG_DWORD 0 (0x0)
WebView REG_DWORD 1 (0x1)
Filter REG_DWORD 0 (0x0)
SuperHidden REG_DWORD 0 (0x0)
SeparateProcess REG_DWORD 0 (0x0)
ListviewAlphaSelect REG_DWORD 1 (0x1)
ListviewShadow REG_DWORD 1 (0x1)
ListviewWatermark REG_DWORD 1 (0x1)
TaskbarAnimations REG_DWORD 1 (0x1)
StartMenuInit REG_DWORD 2 (0x2)
StartButtonBalloonTip REG_DWORD 2 (0x2)
TaskbarSizeMove REG_DWORD 1 (0x1)
NoNetCrawling REG_DWORD 0 (0x0)
FolderContentsInfoTip REG_DWORD 1 (0x1)
FriendlyTree REG_DWORD 1 (0x1)
WebViewBarricade REG_DWORD 0 (0x0)
DisableThumbnailCache REG_DWORD 0 (0x0)
ShowSuperHidden REG_DWORD 0 (0x0)
ClassicViewState REG_DWORD 0 (0x0)
PersistBrowsers REG_DWORD 0 (0x0)
TaskbarGlomming REG_DWORD 0 (0x0)
CascadeNetworkConnections REG_SZ YES


look.bat
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden]
"Text"="@shell32.dll,-30499"
"Type"="group"
"Bitmap"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,73,74,65,6d,33 ,32,\
5c,53,48,45,4c,4c,33,32,2e,64,6c,6c,2c,34,00
"HelpID"="shell.hlp#51131"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\NOHIDDEN]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced "
"Text"="@shell32.dll,-30501"
"Type"="radio"
"CheckedValue"=dword:00000001
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51104"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advan ced\Folder\Hidden\SHOWALL]
"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced "
"Text"="@shell32.dll,-30500"
"Type"="radio"
"ValueName"="Hidden"
"DefaultValue"=dword:00000002
"HKeyRoot"=dword:80000001
"HelpID"="shell.hlp#51105"
"CheckedValue"=dword:00000000

[devil_himself]

Download the Attached File 'Fix.rar'> Unzip it > Right Click on "fix.reg" > Choose "MERGE"

Now try Unhiding your Hidden Files

[devil_himself]

Any Replies chajai

If Your problem has been solved then you can use the "Thread Tools" at the Top to mark it as "Solved"

[sajidali]

Thank you devil_himself

Your fix.reg file, solved my problem.

You rock devil_himself.

[devil_himself]

Originally Posted by sajidali

Thank you devil_himself

Your fix.reg file, solved my problem.

You rock devil_himself.

Glad To Help And Welcome to TSG

[SergioFX]

Damn Devil_himself, I only signed up to tell you that I did what you said and it worked!!

You are god Thank you!

[Mosaic1]

If you execute this command:

regsvr32 /i shell32.dll

That will return the Default Local Machine entries which may have been changed back to their individual defaults so that when you select not to hide files, they are shown etc.

Then you can go into folder options and reset your options.


Some malware is using this ploy too. It would be a good idea for anyone with this symptom to post a hijackthis log and their story in the Malware Removal and Hijackthis Logs forum.

Especailly a couple of Falsh drive infections are using this ploy lately.


Don't post your logs here. The Malware removal forum is the place for that.

[devil_himself]

Welcome To TSG SergioFX

[devil_himself]

Mosaic1... Thanks Again For The Info

One Similar Thread Going On - http://forums.techguy.org/malware-re...t-showing.html