Ways to show hidden files in the USB Cause by Virus/Malware

1. Run the ToggleVBScript

2. Open Your USB

Then Click the Search

and Go to Search All Files and Folders

Click More Advance Options

And check Search Hidden Files and Folders And then click Search button

Select all the hidden files

And uncheck the hidden checkbox and click Apply and Ok Button

Then Go Back To Your USB Drive

All hidden files now are shown..

Activating regedit (Enable/Disable registry tools)

The value:

The following values lock the registry editing tools when they are set to 1 (they are DWORD values) : HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools for the current user and HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools for all users (doesn’t work on Windows XP though). However, once one of them has been set to 1, you can’t use regedit to simply remove them.

So, here are 2 methods.

The methods

1. A reg file ! Tested and working on Win 2k, not working on Win XP. You simply need to create and launch the following reg file : REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] “DisableRegistryTools”=- [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] “DisableRegistryTools”=-

2. A VBS (Visual Basic Script) Tested and working on Win 2k and XP.

In notepad, copy/paste the following script, and save the file with a .vbs extension,

then go to cmd.exe and run it :

‘Enable/Disable Registry Editing tools

Option Explicit ‘Declare variables Dim WSHShell, rr, rr2, MyBox, val, val2, ttl, toggle

Dim jobfunc, itemtype

On Error Resume Next Set WSHShell = WScript.CreateObject(”WScript.Shell”) val=”HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools” val2 = “HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools” itemtype = “REG_DWORD”

jobfunc = “Registry Editing Tools are now ” ttl = “Result” ‘reads the registry key value. rr = WSHShell.RegRead (val)

rr2 = WSHShell.RegRead (val2)

toggle=1

If (rr=1 or rr2=1) Then

    toggle=0

    If toggle = 1 Then

            WSHShell.RegWrite val, 1, itemtype WSHShell.RegWrite val2, 1,

            itemtype Mybox = MsgBox(jobfunc & “disabled.”, 4096, ttl)

    Else WSHShell.RegDelete val WSHShell.RegDelete val2 Mybox = MsgBox(jobfunc & “enabled.”, 4096, ttl)

End If