Hidden files sometimes can't be found to solve problems

Set the attribute of the target file to "Hide" first, and then select "Do not show hidden files" in the file view option. But sometimes after recovering from this operation, why can't I see hidden files?

Why can't hidden files be seen? Modifications have no effect, either in the "folder options" or in the registry. If so, open the "Task Manager" and check if there is sxs.exe or svohost.exe. If so, it is a ghost.

Is there any evidence that it is a ghost?

1. System, hidden files can not be displayed.

2. Double-click the drive letter without reflection. If it is not cleared, double-click the drive letter and execute the malicious program again.

3. In the "Task Manager" there is sxs.exe or svohost.exe (pretending system process svchost.exe) process.

4. Anti-virus software real-time monitoring automatically closes and cannot be opened.

Manually clear malicious programs and display hidden files

Note: In all file operations of the cleaning process, open the drive letter and right click on the drive letter to select "Open" to prevent malicious programs from executing again. .

Step 1: Close the malicious program process. Use "Ctrl+Alt+Del" to open the "Task Manager", look for "sxs.exe" or "SVOHOST.exe" in the process list, and if possible, force the process to end.

Step 2: Display hidden system files. Run regedit.exe to open the "Registry Editor", expand the branch [HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\explorer\\Advanced\\Folder\\Hidden\\SHOWALL], and change the CheckedValue key value to "1" in the right pane. ". Note that the correct CheckedValue key value here should be "DWORD value", it is possible for a malicious program to delete it and create a new CheckedValue with an invalid "string value", so directly modifying the key value is not necessarily valid, and also checking the key value type. is it right or not.

Step 3: Restore the key type. Delete the fake CheckedValue key value, right-click in the blank space on the right pane, select "New → DWORD Value", and name it CheckedValue, and change the key value to "1". After rebooting, you can select "Show all hidden files" and "Show system files" in the folder options.

Step 4: Remove malicious programs. Right-click the drive letter to open the root directory of each drive letter, and delete the "autorun.inf" and "sxs.exe" files in each root directory. Then open the "Registry Editor" again, expand [HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run], find the "SoundMam" key in the right pane, and confirm its key value is "C:\\\\Windows\\" Delete this key value after system32\\SVOHOST.exe. Finally, delete SVOHOST.exe or sxs.exe from the "C:\\\\Windows\\system32" directory. After the restart, although the anti-virus software can be opened normally, there may be problems with the automatic operation. It is recommended to use the repair items in the “Add and Remove Programs” to restore the components of the anti-virus software.