Windows 10 - Why I can't change show hidden files/folders options?

Question

When I enable hidden files and folders option on my personal computer it gets disabled immediately.

I have done some research and I have tried:

• Changing it from the folder options menu

• Editing the registery:

  • Changing in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL" "Checked Value" to 1 and "DefaultValue" to 2 (everything was already fine)
  • Changing in "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN" "Checked Value" to 2 and "DefaultValue" to 2 (everything was already fine)

  • Changing (without success) in "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" "Hidden" to 1 (was/it is still to 0)

    I can't change that. I get this error:

    Permissions are fine and I can edit everything else in this key.

    What can I do?

NOTE: It is not a duplicate of this

Edit: Fixed it. My Antivirus saved me by deleting a virus on boot!

Solution 1

This is not normal behavior. A 3rd party program is changing this setting--possibly a malicious one.

To determine what program is undoing your setting change, use Process Monitor to watch changes made to the system when you modify the Show Hidden Files option.

The basic process will look like this:

1. Determine what setting is changed when you enable Show Hidden Files. You can probably do this by filtering the events ProcMon displays to only those actions performed by explorer.exe, then changing the setting in the UI.

   Note: Alternately, you could just start by monitoring the Registry value you've already determined you're being prevented from changing.

2. Once you know what actions are triggered by changing the setting, adjust ProcMon's filters to watch for any changes made to the setting. For example, if the setting is a value stored in the Registry, set the filter to only show actions that modify that Registry value.
3. Enable the setting and see what processes touch the setting. You should see the legitimate process followed by the unwanted process.

OR you could go with the likely guess that it's a malicious change and run a full virus scan.

Solution 2

Because it works with the newly created user account, I arrive at the conclusion that the per-user registry database for your user account (NTUSER.DAT) is damaged. This could’ve been caused by defective RAM or your storage device (HDD/SSD), so you should check those for errors. Other causes include power loss, resetting the PC or BSOD crsahes.

You should create a new user account and transfer all settings to it. I’m not aware of an automated method to do so.

I also haven’t found a method to verify the integrity of a registry hive, let alone repair it.

edit No longer applies with the addition to the question, I’ll leave it here for others.

Solution 3

I really had the easiest way to get rid of this virus i.e. just log into safe mode of your windows then go to file and folder option from there got to view tab and then press restore defaults and congo you successfully got rid of that virus now restart your pc

Comments

[Darius]

Personal machine, or this is office / work machine (that may have group policy applied to it)?

[DrMoishe Pippik]

Is this a personal PC or corporate? Group Policy may have been set intentionally by IT staff to prevent what you're trying... if it's not you own PC, ask IT.

[1nikolas]

@Darius Personal. Also I have group policy

[1nikolas]

@DrMoishePippik Personal. I don't know what's wrong

[Daniel B]

The registry database may have been damaged. Try creating a new user account and testing it there.

[1nikolas]

@DanielB Everything is fine with the other user but this setting is applied per user so my main user is not affected

[Ben N]

Do you have any third-party antivirus software? If so, does temporarily disabling it, or booting into Safe Mode, allow you to change the value?

[1nikolas]

@BenN the truth is that my antivirus is getting more and more false program blocks. Just tried but no difference. If regedit is getting blocked by the antivirus, I would be notified.

[1nikolas]

I have to thank anyone down here for your help.

[Daniel B]

If you found the answer, don’t just edit your question. Instead, answer it yourself. Don’t forget to accept that answer either, otherwise the question will keep getting pushed to the front page.