RASH File Attributes

I remember when deleting malware and spyware there are some cases wherein you cannot see the culprit file that you wanted to be gone. Even if you show hidden files, it still doesn't show up. You can try this in the command prompt.

To open command prompt in Windows, you can click on start and click on run. Inside the box type cmd and click on Ok.

- Go to the directory of the drive and folder you want to access. Ex. C:\Windows

- type dir /ah , this will display files and folders with hidden attributes
- type attrib <filename> -r -a -s -h (Ex. attrib cats.jpg -r -a -s -h) Note: if the filename is more than 6 characters type the first 6 characters followed by ~1. (Ex for celebration.doc, attrib celebr~1.doc -r -a -s -h)

RASH File Attributes


R - Read Only attribute - A file having this attribute cannot be overwritten or erased by standard programs or mischievous users.

A - Archive attribute - A file possessing this attribute has been changed or created recently. DOS commands like  XCOPY use this attribute to keep track of which files changed since they were last copied or backed up. Similarly, backup programs like Seagate Backup Exec, Microsoft Backup, etc. all use this attribute to handle their bookkeeping on what files need to be backed up.

S - System attribute - A file with this attribute usually is a file that's an integral part of your operating system. The system attribute has a special meaning for DOS, Windows, Windows 9x, OS/2, etc. When the system attribute is associated with a file, that file is hidden and cannot be run from the command line in DOS or a DOS session. The only way such a file can be run is by another program loading and running the file. Under Windows 9x, try to perform an operation like deleting a system file, and you'll get a pop-up box telling you that the file is a system file and asking you whether you really want to delete it.

H - Hidden attribute - A file having this attribute cannot be seen by a normal DOS directory search (like using the DIR, CHKDSK, TREE, DEL, or RENAME commands). A file having this attribute cannot be seen if Windows 9x Explorer or similar programs aren't specifically set up to see them (e. g., Show all files hasn't been checked under View Options in Windows Explorer). Files with an 'H' attribute are effectively "invisible." This attribute is used to hide files from prying eyes. Note that most programs can still run a hidden file, but that the DOS COPY and XCOPY commands cannot copy a hidden file or copy to a hidden file.