Show Hidden USB Files After a Shortcut Virus

Shortcut malware often makes original folders appear to vanish by applying hidden or system attributes, then places look-alike shortcuts on the USB drive. If the drive still shows used space, the files may still be present. The goal is to scan first, reveal the originals carefully, and avoid launching anything suspicious.

Before changing file attributes

Do not start by double-clicking a shortcut or running a random “USB fix” script. Changing visibility does not remove malware. It only affects whether File Explorer displays an item.

Disconnect other removable drives.
Confirm the affected drive letter in File Explorer.
Update Microsoft Defender security intelligence.
Run a custom scan of the USB drive and a full scan of the PC if you suspect infection.
Back up irreplaceable files once they can be accessed safely.

Method 1: View hidden items in File Explorer

This method changes the view, not the files themselves.

Open File Explorer.
On Windows 11, choose View > Show > Hidden items. On Windows 10, use the View tab and select Hidden items.
Open the USB drive by selecting the drive itself—not a shortcut inside it.

If the original folders appear faint or translucent, they are hidden. Do not open unknown executable files, scripts, or shortcuts while investigating.

Some items marked as protected operating-system files may remain invisible. Disabling that protection exposes sensitive files across the computer and is not the preferred first step.

Method 2: Use Shortcut Remover visibility repair

Shortcut Remover can scan the selected drive, explain suspicious shortcut findings, quarantine reviewed items, and then repair visibility within the selected path. This order matters: scan and review first, repair second.

Before starting, verify the drive shown in the app. After the operation, review its history and confirm that it did not report access errors or an incomplete scan. Avoid applying the repair to an entire system drive when only one USB drive is affected.

Method 3: Use the Windows attrib command

Windows includes the attrib command for setting and clearing file attributes. It is powerful and easy to aim at the wrong location, so verify the drive letter twice.

Open Windows Terminal or Command Prompt. To inspect attributes before changing them, replace X: with the confirmed USB drive letter and run:

attrib X:\* /s /d

After the drive has been scanned, this command clears the hidden and system attributes recursively on that drive:

attrib -h -s X:\* /s /d

What the command means:

-h clears the hidden attribute.
-s clears the system attribute.
/s processes matching files in subdirectories.
/d includes directories.

Microsoft’s official attrib documentation lists the full syntax. Do not add switches you do not understand, and do not run the command against C:\.

If the files are still missing

Visibility repair cannot restore files that were deleted, overwritten, encrypted, or physically lost due to storage failure. Check these possibilities:

Drive usage: If the USB drive shows little or no used space, the original data may no longer be present.
File-system errors: Repeated disconnects, read errors, or a request to format the drive can indicate corruption or hardware trouble.
Quarantine: If a security tool moved an item, review its quarantine history instead of recreating files by hand.
Wrong drive: Confirm the volume label, capacity, and drive letter.

If the data is unique and the drive is failing, stop writing to it. Professional recovery has a better chance when additional changes have not been made.

Verify the recovery

Once the folders are visible, check a small number of known documents. Copy important data to clean storage, eject the USB drive properly, reconnect it, and scan again. If suspicious shortcuts return, scan the PC that the drive was connected to; restoring file attributes alone did not remove the source.