A .LNK file is a Windows Shell Link. It does not need to contain a traditional executable payload to be dangerous: it can direct Windows to start a program and supply command-line arguments, working-directory information, an icon, and other resolution data.
What a Shell Link can store
Microsoft’s Shell Link Binary File Format defines a 76-byte header followed by optional target identifiers, LinkInfo, StringData, and ExtraData. StringData can contain a relative path, working directory, command-line arguments, and icon location. Those fields are useful for ordinary application shortcuts, but they can also conceal behavior behind a familiar name and icon.
The distinction is important: “contains malware” and “launches unsafe behavior” are not always the same. A shortcut may point to a separate script or executable, invoke a trusted Windows utility with risky arguments, or reference a remote location.
Examples that deserve investigation
- A folder icon whose target is PowerShell, Command Prompt, Windows Script Host, or MSHTA.
- Arguments containing encoded PowerShell, a download command, a web URL, or a network path.
- A shortcut that starts minimized while supplying a long command line.
- An icon source that imitates a document while the target is a command-capable utility.
- A target on an unexpected removable drive, temporary folder, or remote share.
None of these single signals proves malicious intent. Administrators and legitimate installers use the same Windows components. Origin, expected workflow, publisher identity, target signature, and antivirus results provide the necessary context.
Inspect rather than execute
- Do not double-click an unexpected shortcut.
- Use Properties to read the target and arguments, or select it in the local .LNK File Safety Checker.
- If the target is a file, locate it without running it and inspect its digital signature.
- Scan the source folder or removable drive with Microsoft Defender.
- Prefer quarantine when you need reversibility or evidence.
Why a “clean-looking” shortcut is not proof of safety
A target can be replaced after the shortcut is created. A normal signed application can load a malicious document or plugin. Some target information can be stored in structures a lightweight parser does not fully resolve. Reputation data is also separate from the file format. A structural checker should therefore report what it observed and its limits, not issue an absolute safety certificate.
| Observed target | Interpretation |
|---|---|
| A known application with no arguments | Lower concern, but still verify origin and the target’s signature |
| PowerShell or CMD with an intentional administrative command | Potentially legitimate; compare the exact command with trusted documentation |
| Encoded command or remote script | High-risk pattern; do not run it |
| Missing target | May be broken rather than malicious; do not let a missing path erase other context |
How Shortcut Remover evaluates commands
Version 8.0.0 requires more than the name of a command-capable Windows utility before assigning high confidence. Its bounded launcher analysis looks for a launch action combined with dangerous semantics, such as encoded PowerShell, remote active content, script-host chains, or transfer behavior. The controlled release corpus contained 310 labeled malicious links and 600 labeled benign links; those results document the controlled corpus, not a universal real-world detection percentage.
Frequently asked questions
Can a .LNK file run PowerShell?
Yes. It can target PowerShell and supply arguments. PowerShell itself is legitimate; the command and origin determine the risk.
Does deleting a .LNK delete the target?
Normally no. It removes the shortcut, not the separate target. Verify the file type and preserve evidence when appropriate.
Can antivirus scan .LNK files?
Antivirus products can inspect shortcut files and related content, but results and coverage depend on the product, configuration, definitions, and accessible files.