Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
A hidden folder that keeps returning is not automatically malware, but it does mean that something is recreating it. The cause may be legitimate software, cloud synchronization, a scheduled task, a startup entry, an infected USB drive, or active malware. Do not keep deleting the folder or opening suspicious files until you identify what is creating it.
This guide applies to current Windows 10 and Windows 11 interfaces and gives you a safe way to distinguish a harmless application folder from a persistence problem.
First, decide whether the folder is suspicious
Windows and installed applications routinely create hidden folders for settings, caches, recovery data, updates, and synchronization. Common legitimate locations include %AppData%, %LocalAppData%, C:ProgramData, Windows servicing and recovery locations, and cloud-sync metadata directories.
Free tools Windows power users keep installed
One-click scans. No signup required.
Hidden status alone is therefore not evidence of infection. Suspicion should increase when several of these clues appear together:
#1 Best Overall
- High-Resolution Scanning: Features a 38MP CMOS sensor with a resolution of 7168 × 5376 and 410 DPI, suitable for capturing clear and detailed images
- Patented Curve-Flattening Technology: Automatically flattens the curved pages of bound books and removes distortion for accurate, clean scans without the need to unbind
- Powerful OCR Functionality: Converts scanned images into editable and searchable files, including Word, Excel, and searchable PDFs. Supports 180+ languages. Please note that Thai and Hebrew are currently not supported. Arabic is only supported on ET Series scanners under Windows systems; other operating systems currently do not support Arabic OCR. If you need the complete OCR language support list, please feel free to contact us for more details
- Large Scanning Area: Supports documents up to A3 size (16.5'' × 11.7''). Note: Not recommended for glossy or highly reflective materials
- Fast Scanning Speed: Scan a page in just 1.5 seconds with practiced operation—ideal for high-efficiency, bulk scanning projects
- The folder has a random, misleading, or recently changed name.
- It contains
.exe,.scr,.dll,.bat,.cmd,.vbs,.js,.ps1, or.lnkfiles. - Files use double extensions such as
invoice.pdf.exe. - It appeared after a questionable download, cracked installer, email attachment, or USB connection.
- It returns immediately after deletion or whenever Windows starts.
- You also see browser redirects, pop-ups, unexplained CPU or network activity, disabled security controls, or missing folders.
- The same suspicious folder appears on multiple removable drives.
Malware can use hidden files and directories to evade casual inspection. MITRE ATT&CK documents this behavior as T1564.001, Hidden Files and Directories. That classification describes a technique, not proof that a particular folder is malicious.
Use the recurrence timing as a diagnostic clue
When the folder returns often reveals more than its name does. Treat the following as clues rather than definitive diagnoses:
| When it returns | Possible explanation |
|---|---|
| Immediately after deletion | A running process, file watcher, or script |
| After login or reboot | A startup item, Registry Run key, service, or scheduled task |
| Every few minutes | A recurring task, service, or active unwanted program |
| After opening a browser | A browser extension, downloaded payload, or browser-triggered script |
| After connecting a USB drive | Removable-drive malware or an infected drive |
| After cloud synchronization completes | Another device or account restoring the folder |
| Only in a shared folder | Another computer or user recreating it |
Protect your files before investigating
- Stop opening the folder repeatedly. Do not double-click unknown
.lnk,.scr, script, installer, or double-extension files. - Disconnect from the internet if compromise appears active. Disconnect Wi-Fi or Ethernet if you see credential-theft indicators, unusual network activity, ransomware behavior, or unauthorized remote access. On a work computer, follow your organization’s incident-response procedure before disconnecting.
- Disconnect removable drives. Leave USB devices disconnected until the computer is scanned.
- Avoid sensitive logins. Do not use the potentially compromised computer for banking, email, password-manager, work, or other sensitive accounts until it is cleared.
- Back up irreplaceable personal files carefully. Copy known-good documents and photos to a clean, trusted destination. Do not back up suspicious executables, scripts, shortcuts, cracked installers, or unknown files.
- Record evidence. Note the folder’s complete path, name, creation and modification times, what triggers its return, and any related symptoms. This information can help a technician or IT team.
Reveal hidden items without changing protected system files
For ordinary hidden items in File Explorer:
- Open File Explorer.
- In Windows 11, select View > Show > Hidden items. In some builds, the menus may appear slightly differently.
- For a deeper inspection, open File Explorer Options, select the View tab, and choose Show hidden files, folders, and drives.
- Clear Hide extensions for known file types so misleading filenames are easier to spot.
Leave Hide protected operating system files enabled unless you know precisely why it must be changed. Disabling it exposes critical Windows files and can make accidental deletion more likely. If you temporarily change it, restore the setting afterward.
To list hidden and system items in a known location, open Command Prompt and use:
dir /a "D:"The /a switch requests files with all attributes, including hidden and system items. Do not use this as a reason to delete unfamiliar files; it is an inspection command.
Scan the folder and the computer in the right order
1. Update Microsoft Defender
Open Windows Security > Virus & threat protection and install the latest security intelligence updates before scanning. Keep real-time protection enabled. Microsoft notes that files opened or downloaded while real-time protection is disabled are not scanned at that moment.
2. Scan the specific folder
Right-click the folder or a specific file in File Explorer and choose Scan with Microsoft Defender. In Windows 11, you may need to select Show more options first. Microsoft’s instructions are available in its folder and file scanning guide.
Rank #2
- Plug and play, This laser handheld barcode scanner has simple installation with any USB port and Ideal for businesses, shops and warehouse operations. Its function is unbeatable and easy to use, design is stylish
- Compatible with Windows, Mac, and Linux; works with Word, Excel, Novell, and all common software
- Scanning Speed: 200 scans per second. Scanning angle: Inclination angle 55°, Elevation angle 65°. Operational Light Source:Visible Laser 650-670nm.
- Decode Capability: Code11, Code39, Code93, Code32, Code128, Coda Bar, UPC-A, UPC-E, EAN-8, EAN-13, ISBN/ISSN, JAN.EAN/UPC Add-on2/5 MSI/Plessey, Telepen and China Postal Code,Interleaved 2 of 5, Industrial 2 of 5, Matrix 2 of 5, etc ; 300 configurable options for prefix, suffix and termination strings, support turn on/off the beep.
- Color: Black. Dimensions: 3.6 x 2.6 x 6.1 inches. Type of Cable: 2M or 6ft straight cable. Shock: 1.5m drop on concrete surface. Regulatory Approvals: FCC CE.
Do not open suspicious contents merely to make scanning possible.
3. Run a Full scan
Go to Windows Security > Virus & threat protection > Scan options, choose Full scan, and start it. Microsoft describes a Full scan as checking every file and program on the device. It may take considerable time, so save work first.
4. Run Microsoft Defender Offline
If the folder returns after reboot, malware is detected again, or normal scans do not explain the behavior, run an Offline scan:
- Open Windows Security.
- Select Virus & threat protection.
- Select Scan options.
- Choose Microsoft Defender Antivirus (offline scan).
- Select Scan now and save any open work.
Windows restarts and scans from the Windows Recovery Environment, before normal Windows processes load. That can make it harder for persistent malware to hide or interfere with removal. After Windows starts again, review Windows Security > Virus & threat protection > Protection history.
Microsoft specifically recommends Offline scanning when malware keeps returning or is detected again after a restart. It improves the chance of detecting persistent threats, but it is not a guarantee that every cause of recurrence has been removed.
5. Consider a second-opinion scanner
A second scanner may help when Defender finds nothing but the folder continues to return, browser hijacking is present, a detection is inconclusive, or the computer recently ran a questionable installer. Use a reputable vendor’s official download page. Microsoft’s Safety Scanner is an on-demand option.
Do not install multiple products with active real-time protection at the same time. Microsoft warns that simultaneous real-time antivirus products can cause conflicts and performance problems. An on-demand scanner should not be treated as a replacement for ongoing protection.
Rank #3
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
Find what keeps recreating the folder
A scan may remove a known malicious file without showing you the persistence mechanism, and a clean scan does not prove the cause is resolved. If the folder returns, investigate the creator.
Check Startup apps
Open Settings > Apps > Startup, or open Task Manager > Startup apps. Look for recently added or unfamiliar entries, especially those that:
- Have an unknown publisher or random name.
- Launch from
%AppData%,%Temp%,%ProgramData%, or a removable drive. - Match the folder’s creation date.
- Invoke
powershell.exe,wscript.exe,cscript.exe,rundll32.exe, or command shells.
Do not disable an item simply because it is unfamiliar or hidden. Check its full path, publisher, digital signature, installation date, and relationship to software you recognize.
You can open common locations directly by entering these paths in File Explorer’s address bar:
%temp%
%appdata%
%localappdata%
shell:startupInspect Task Scheduler
Open Task Scheduler and inspect Task Scheduler Library. Pay particular attention to tasks triggered at logon or startup, tasks that run every few minutes, and actions that launch scripts or interpreters from user-writable locations.
Recommended Free Tools
Not every scheduled task is malicious. Windows and legitimate software use Task Scheduler, including scheduled security scans. Microsoft’s Windows Security guidance illustrates this distinction.
Use Microsoft Autoruns for a broader view
Microsoft Sysinternals Autoruns shows more auto-start locations than the ordinary Startup screen, including startup folders, Registry Run and RunOnce keys, services, Explorer extensions, browser helper objects, Winlogon entries, and scheduled tasks. The Microsoft documentation lists Autoruns version 14.3, dated June 17, 2026; check the download page for the current release when you obtain it.
Rank #4
- STAY ORGANIZED – Easily convert your paper documents into digital formats like searchable PDF files, JPEGs, and more.Power Consumption : 2.5W or less (Energy Saving Mode: 0.7W). Suggested Daily Volume : 500 scans..Does it contain liquid: no
- CONVENIENT AND PORTABLE –lightweight and small in size, you can take the scanner anywhere from home offices, classrooms, remote offices, and anywhere in between
- HANDLES VARIOUS MEDIA TYPES – Digitize receipts, business cards, plastic or embossed cards, reports, legal documents, and more
- FAST AND EFFICIENT – No technical hurdles or complicated setups here; easily scan both sides of a document at the same time, in color or black-and-white, at up to 12 pages-per-minute, and with a 20 sheet automatic feeder
- BROAD COMPATIBILITY – Works with both Windows and Mac devices, be it laptop or computer
A cautious workflow is:
- Download Autoruns only from Microsoft Sysinternals.
- Run it as administrator.
- Enable Hide Signed Microsoft Entries.
- Review third-party entries in Logon, Scheduled Tasks, Services, Drivers, and Explorer.
- Inspect each item’s complete command line and file path.
- Check the publisher and digital signature before acting.
- Disable a questionable entry first; do not immediately delete its Registry entry or file.
- Reboot, observe whether the folder returns, and scan again.
Autoruns identifies auto-start mechanisms; it does not automatically prove that an entry is malware. Record the entry name, publisher, command line, path, and timestamps before changing it so the action can be reversed.
Autoruns includes Autorunsc, its command-line equivalent. For investigation, you can review the installed version’s syntax with:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →autorunsc64.exe -?One example of an output command is:
autorunsc64.exe -a * -c -h -sSwitch behavior can vary by version, so use the utility’s own help and do not run commands you do not understand. Be cautious with Autoruns’ VirusTotal upload option: uploading a file may disclose sensitive or confidential material. Do not upload work, medical, financial, or personal files without authorization.
Check services, browser extensions, and synchronization
If the folder returns after a browser opens, review recently installed browser extensions and remove only extensions you can identify as unwanted. If it returns after OneDrive, Dropbox, Google Drive, or another sync client runs, pause synchronization and inspect the same synchronized folder on other devices. A second device may be restoring the directory.
If the folder exists in a shared network location, another computer or account may be creating it. On a managed computer, involve IT rather than changing services or policies yourself.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Repair hidden attributes only after diagnosis
Some removable-drive infections hide the original folders by adding the Hidden and System attributes. Once the computer and drive have been scanned and you have identified the correct data path, you can reset those attributes on a known personal-data folder:
attrib -h -s "D:FolderName" /s /d-hremoves the Hidden attribute.-sremoves the System attribute./sapplies the operation to matching files and subdirectories./dincludes directories.
This changes visibility; it does not remove malware or repair persistence. Use it narrowly on a known data folder or removable drive. Do not apply broad attribute-reset commands to C:Windows, recovery partitions, the entire system drive, or unknown system locations.
Best Value
- WHAT YOU GET: FixMeStick Virus Removal Tool for Windows PCs (Windows XP, Vista, 7, 8, 8.1, 10, and 11. 512 MB RAM required), Getting Started Guide, our virus removal guarantee backed by our friendly Canadian based Customer Support Team.
“Access denied” also does not prove infection. It can result from protected Windows folders, another user’s permissions, a running service, file-system corruption, or modified access-control lists. Do not take ownership of system directories casually; doing so can weaken security or interfere with updates.
Special case: a hidden folder on a USB drive
A classic removable-drive shortcut-worm pattern hides the original folders and creates matching .lnk shortcuts. Opening a shortcut may launch a malicious script and then display the real folder, allowing the infection to spread to another computer.
Use this sequence:
- Do not open suspicious shortcuts.
- Disconnect the USB drive.
- Scan the computer first and update protection.
- Reconnect the drive only after protection is active.
- Scan the USB drive directly.
- Copy only verified documents, photos, and other known-good personal files.
- If suspicious files continue to regenerate, copy verified data and reformat the drive.
- Scan the computer again before restoring the recovered data.
Recovering visible files and formatting the drive can clean the storage device, but neither action proves that the host computer is clean. Scan the computer before and after the recovery process.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhen to stop manual cleanup
Stop experimenting and seek professional or IT assistance when:
- Defender Offline and a reputable second-opinion scan do not resolve the recurrence.
- The folder returns from multiple startup, task, service, or synchronization locations.
- Security settings are disabled, exclusions appear without permission, or scans cannot run.
- There are signs of credential theft, ransomware, remote access, or data exfiltration.
- The computer contains confidential business, financial, medical, legal, or client data.
- You cannot tell which files or services are legitimate.
- The computer belongs to an employer or school.
- Malware returns after cleanup or after an attempted reinstall.
For a managed system, preserve timestamps and logs and report the incident immediately. Do not upload confidential files to public scanning services or install consumer cleanup tools without approval.
For a personal computer that remains compromised, a complete reset or reinstall may be safer than endless manual deletion. Microsoft notes that reset or reinstall may be necessary when malware has caused irreversible changes; restore files only from backups made before the infection. Change important passwords from a separate, trusted device after the computer is secured, and enable multifactor authentication where available.
Prevent the folder from returning
- Keep Windows, browsers, and applications updated.
- Download software from official sources and avoid cracked installers.
- Keep file extensions visible in File Explorer.
- Use a standard user account for everyday work when practical.
- Be cautious with USB drives, especially shortcuts that replace familiar folders.
- Maintain offline or versioned backups that cannot be modified by an infected computer.
- Use Windows Security protections such as Controlled folder access where they fit your applications and workflow.
- Do not run multiple antivirus products with simultaneous real-time protection.
Paid antivirus is not required merely because a folder is hidden. A paid suite may be useful for family controls, cross-device coverage, identity features, or business management, while professional malware-removal help is more appropriate for persistent infections or sensitive systems. Start with Windows Security and careful diagnosis.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
