The Windows attrib command can make hidden USB files visible again, but it does not identify, stop, quarantine, or remove malware. Use it only after isolating the drive and scanning both the USB device and the Windows computer.
attrib changes file and folder attributes. A successful command does not prove that the shortcut virus is gone.What ATTRIB actually changes
Windows stores attributes such as Hidden, System, Read-only, and Archive on files and folders. Shortcut-virus activity often hides the original folders and places deceptive .LNK files where the folders used to appear. Microsoft documents -h, -s, and -r as switches that clear the Hidden, System, and Read-only attributes; /s applies the change through subdirectories and /d includes directories.
That is a visibility repair operation. It does not examine a running process, scheduled task, startup entry, script, executable, or malicious shortcut target.
Use the command only after verifying the drive letter
- Disconnect the USB drive from other computers and stop opening shortcuts on it.
- Reconnect it to the Windows PC you intend to clean. In File Explorer, confirm the removable drive’s letter and volume name.
- Run a Microsoft Defender custom scan on that drive. If you suspect the PC itself is infected, run a full scan and consider Microsoft Defender Offline.
- Open Command Prompt only after confirming the correct letter. Replace
X:below with the removable drive—not a guessed drive:
attrib -h -s -r X:\*.* /s /dMicrosoft’s ATTRIB documentation explains each switch. Do not paste a drive-wide command until you have verified its scope.
What a successful result means
If the original folders appear, you have evidence that their attributes changed. You do not yet have evidence that the computer or USB drive is clean. Check whether suspicious shortcuts remain, whether hidden scripts or executables are present, and whether the problem returns after reconnecting the drive.
| Observation | Likely meaning | Next step |
|---|---|---|
| Folders reappear and stay visible | The attribute repair worked | Rescan, review unexpected files, then copy verified documents to clean storage |
| Folders disappear again | An active process or reinfection source may still be changing them | Disconnect the USB drive and investigate the PC, startup items, and other recently connected devices |
| Only shortcuts appear | The originals may still be hidden, deleted, corrupted, or stored elsewhere | Compare used space, enable hidden-item viewing, and avoid writing new data before recovery |
| Defender detects a threat | The problem is more than an attribute setting | Follow the quarantine guidance, update security intelligence, and rescan both PC and drive |
Why deleting every shortcut is not the first step
A .LNK file can be legitimate. Before deleting one, inspect its target and arguments through Windows Properties, the local .LNK File Safety Checker, or Shortcut Remover. Deleting the visible shortcut also does not remove a separate executable or script referenced by it.
A safer recovery order
- Isolate the removable drive.
- Update Microsoft Defender security intelligence.
- Scan the USB drive and the host PC.
- Inspect unexpected shortcuts without opening them.
- Repair attributes only on the verified removable drive.
- Copy important verified files to clean storage.
- Reconnect the drive only after the PC is clean and perform a final scan.
For the complete workflow, see How to Remove a USB Shortcut Virus Without Losing Files.
Frequently asked questions
Does ATTRIB delete malicious .LNK files?
No. It changes attributes on matching files and directories. It does not classify or delete shortcuts.
Can ATTRIB restore deleted files?
No. It can reveal existing hidden items, but it is not a deleted-file recovery utility.
Why did the folders become hidden again?
A still-active infection, another infected computer, startup persistence, or a reinfected removable drive may have reapplied the attributes.