WinPatrol Help: Hidden Files

WinPatrol: Hidden Files

Hidden Files

The Hidden list will display files located in some specific system locations which are marked as "Hidden" by the disk operating system. In most cases, these files are legitimate system files. If however your system has been infected this list will show you the names of files which are associated with your current infiltration. Check the colum that says "First Detected" to see if Hidden files are recent additions.

Monitoring Hidden Files Not Recommended

By default, Hidden Files are not monitored in real-time by WinPatrol. Too many programs may exist which routinely created and delete temporary files which are set as Hidden. If Scotty monitors Hidden files in real-time it could drive some users of these programs crazy.

For instance, you may see many files that start as "etilqs_" followed by random names. These are database files used by the public domain database called SQLite. Both Chrome and FireFox use SQLite to store data including cookies. Another common hidden legitimate file will start with "api-ms-win-" or "ext-ms-win".

If your system is infected, the occurance of a hidden file won't be the only indication. Scotty will most likely alert you to new malware in your Startup Programs list or IE Helpers. If this happens it would be a good time to review the list of Hidden files.

Managing Hidden Files

WinPatrol provides additional information on Hidden files, including the company that created the program as well as the program version. Most legitimate program files will usually include copyright and company information that can be displayed by WinPatrol, but not always. Typically, hidden files are data files and will not include copyright or company information. PLUS members can double-click on a file to access PLUS Info... and search the online WinPatrol database for more information on the specific file.
Viewing the contents of a file may be possible by right-clicking on a file and selecting "View using Notepad."

Refresh

Use the Refresh button to update the current list of hidden files.

Unhide

The Unhide button can be used to remove the Hide attribute for a selected file. Before unhiding look to see where a file is located so you can use the Windows File Explorer to view it once it's no longer hidden. When you Unhide a file it will no longer appear in the WinPatrol list of hidden files.

Right-Click Menu

Delete File

This feature allows you to remove a hidden files on your system. Use special case when deleting any file. This should only be done if you're sure a file is part of an attack on your system. In some cases, malware may replace this file even after you have deleted it. In those cases, see our Delete File on Reboot.

Delete File on Reboot

If after trying to remove a suspicious or dangerous program you find it still will not go away, right-click on the name of the program Module and select "Delete File on Reboot." This action will not take place until the next time you boot, but the file will be deleted before Windows starts and any other programs that may attempt to prevent its deletion.

There is no way to recover the file once it is deleted, so use this feature only when you are absolutely sure you want to remove the file.

View with Notepad

This feature may not work with all hidden files. Many of your system files which are hidden will be readable as text files so viewing them with NotePad will help you know why they exist.

To close or Exit the WinPatrol tab interface click the X in the upper right hand corner or the Close button. WinPatrol will continue monitor changes but the main interface will be removed from memory.