Monday, December 1, 2008

Using DOS command : ATTRIB

Sometimes during malware analysis, you suspect there is/are file(s) created on your systems. But you don't seem to be able to find it with the normal search. That is because the file is hidden. You may be able to unhide it by selecting "show hidden files and folders" under Tools > Folder Options > View menu in the Windows Explorer.

Some cases, it will still be hidden after you made the changes. You may need to change the attribute of the file via DOS. Go to the command prompt, change to the directory in which the file is located. Type:

ATTRIB -H

That command will change all files in the directory becoming visible to your view. For more information on this command you may want to read here.

No comments: