A durable shortcut-virus cleanup treats the Windows computer and the removable drive as separate but connected scopes. Cleaning only the USB drive can leave the PC ready to infect it again; cleaning only the PC can leave deceptive shortcuts and hidden files on the drive.
Stage 1: contain the incident
- Disconnect the affected USB drive and other nonessential removable storage.
- Do not open folder-looking shortcuts. Do not email or upload suspicious samples through the contact form.
- Record which computers and drives were recently connected. This becomes the cleanup list.
- If the PC contains important open work, save it to a known-clean location before an offline scan that restarts Windows.
Stage 2: clean and verify the Windows PC
Open Windows Security, update security intelligence, and run a full scan. A full scan examines every file and running program in its scope. If the behavior persists or you are concerned that malware is hiding while Windows runs, Microsoft Defender Offline restarts into the Windows Recovery Environment and scans without loading the normal Windows session.
Review Protection History after the scan. A detection name alone is not the whole story: note the affected path, action taken, and whether remediation completed. Do not restore an item merely because an application stops working afterward.
Stage 3: scan the removable drive without opening it
- Reconnect only one affected drive to the cleaned PC.
- In File Explorer, verify its letter and volume label.
- Use Windows Security to run a custom scan of that drive.
- Use Shortcut Remover’s Full Scan when you need to enumerate shortcuts across the selected root. Check the final directory count, file count, access errors, reparse skips, and completion status rather than trusting elapsed time alone.
- Inspect unexpected
.LNKtargets and arguments. The browser checker performs a local single-file inspection; the desktop application is designed for broader scanning and reversible quarantine.
Stage 4: recover visible access to documents
After scanning and reviewing suspicious items, enable Hidden items in File Explorer. If legitimate folders are present but carry Hidden or System attributes, use the documented attrib command only against the verified removable drive. Remember that this repairs visibility; it does not clean the PC.
Copy verified documents—not unknown executables, scripts, or shortcuts—to clean storage. Open recovered documents only after scanning the destination.
Stage 5: decide whether to reformat
Reformatting can provide a clean filesystem starting point for the selected USB drive after important verified data is backed up. It is not a treatment for the Windows PC. Confirm the exact drive, confirm the backup can be read, and understand that formatting removes existing drive contents and evidence.
| Scope | Required evidence before declaring it handled |
|---|---|
| Windows PC | Updated scan completed, Protection History reviewed, no unexplained persistence after reboot |
| USB drive | Custom scan completed, shortcut targets reviewed, important files recovered, final rescan completed |
| Other PCs/drives | Each recently connected device processed separately rather than assumed clean |
| Backups | Restore source predates the incident and restored files are rescanned |
Frequently asked questions
Should I clean the PC or USB drive first?
Clean and verify the PC first so it does not immediately rewrite the removable drive when reconnected.
Does formatting the USB drive clean Windows?
No. It affects only the selected drive. Any active process, startup entry, or scheduled task on the computer remains separate.
Can I copy my documents before scanning?
When data is at risk, preservation may come first, but copy to isolated storage and scan before opening. Avoid copying unknown scripts, executables, or shortcuts.