How to Inspect Suspicious .LNK Files Safely

Reviewing a Windows shortcut before deciding whether to delete it

A Windows .lnk file is a shortcut, not the target itself. Most shortcuts are legitimate, and deleting one normally removes only the pointer. The risk is that a shortcut can also contain a target, arguments, and working directory that cause Windows to launch an unexpected command. Inspect suspicious shortcuts without double-clicking them.

Do not test a suspicious shortcut by opening it. Preserve the file when it may be incident evidence, inspect its metadata, and scan both the shortcut and the referenced files with a maintained security product.

What information a .LNK file can contain

Target path: the application, document, folder, or command interpreter to open.
Arguments: options or commands passed to the target.
Working directory: the folder in which the target starts.
Icon location: an icon that can make the shortcut resemble another file or folder.
Window state and hotkey: presentation and keyboard-launch settings.

A familiar icon or name is not proof of safety. Windows can display an icon chosen by the shortcut author, while file-name extensions may be hidden.

When deleting a .LNK file is normally safe

Deleting a shortcut is usually harmless when you created it, no longer need it, and have confirmed that it is really a .lnk file. Examples include an extra Desktop shortcut, a link to an uninstalled program, or a pointer to a document you intentionally moved.

Pause when the shortcut appeared unexpectedly, is part of a USB incident, belongs to a managed business application, contains required arguments, or may be evidence. Quarantine is a safer first action when you are not sure.

Method 1: inspect Properties without launching the shortcut

Enable File name extensions in File Explorer.
Right-click the shortcut and choose Properties.
Read the Target, Start in, and Comment fields.
Do not click the target, paste it into a terminal, or approve an elevation prompt.
Write down the path and arguments for comparison with the application’s official documentation.

Method 2: read shortcut metadata with PowerShell

The following example asks the Windows Script Host shortcut parser to return metadata. It does not intentionally launch the shortcut target. Replace the example path with the literal path to the file you are inspecting.

$shell = New-Object -ComObject WScript.Shell
$shortcut = $shell.CreateShortcut('E:\Suspicious Folder.lnk')
[pscustomobject]@{
    TargetPath       = $shortcut.TargetPath
    Arguments        = $shortcut.Arguments
    WorkingDirectory = $shortcut.WorkingDirectory
    IconLocation     = $shortcut.IconLocation
}

Run inspection commands only on a computer you trust. Do not execute anything copied from the output. If the path contains evidence for a serious incident, work from a forensic copy and obtain professional help.

Signals that deserve closer review

Signal	Why it matters	Important qualification
`powershell.exe`, `cmd.exe`, `wscript.exe`, or `cscript.exe`	The shortcut may run a command or script rather than open a folder	Administrators and legitimate tools also use these programs
`mshta.exe`, `rundll32.exe`, or `regsvr32.exe`	These Windows utilities can be abused to execute content	The program name alone is not a verdict; inspect arguments and context
Encoded, heavily escaped, or unusually long arguments	Obfuscation can conceal the real command	Some enterprise launchers legitimately use complex arguments
Targets in Temp, AppData, or an unexpected USB folder	Malware often uses writable locations	Many legitimate per-user applications also install in AppData
A folder-like icon with a command target	The presentation and behavior do not match	Confirm that the shortcut was not intentionally created by an administrator

Validate the target and its context

Ask four questions:

Was the shortcut expected? A shortcut installed with known software has a different context from one that appeared on every USB folder.
Does the target match the icon and name? A “Photos” shortcut that launches a script host deserves investigation.
Are the arguments necessary and documented? Compare them with the application publisher’s instructions.
Does the referenced file have a trustworthy origin? Scan it, check its digital signature where applicable, and avoid third-party download mirrors.

Use antivirus scanning as a separate layer

Scan the shortcut and its containing drive with Microsoft Defender. Also scan the target or script it references when that file is available. A clean result lowers risk but does not convert an unexplained shortcut into a trusted one; detection changes over time, and the referenced payload may be missing or inaccessible.

For removable media, follow the full USB shortcut-virus recovery guide before restoring hidden files.

Quarantine, delete, or allow?

Quarantine when the shortcut is unexplained, may be evidence, or requires more review. Confirm that the quarantine record and restore path exist.
Delete when you have verified that the shortcut is unnecessary and no evidence needs to be retained.
Allow only after you understand the target and arguments. Scope the allow rule narrowly rather than trusting every shortcut with a similar name.

Deleting a shortcut does not delete a separate payload, undo persistence, restore hidden folders, or clean the computer that created it.

How Shortcut Remover supports review

Shortcut Remover reads shortcut metadata, presents risk signals with their reasons, separates ordinary broken links from suspicious behavior, supports a scoped allow list, and provides quarantine and history. It does not claim to replace antivirus scanning or make a final attribution about who created a file.

Download Shortcut Remover 8.0.0 Read the security design

Frequently asked questions

Does deleting a .LNK file delete the original program or document?

Normally, no. It removes the shortcut. Verify that the selected item is a shortcut and not the original target.

Is every shortcut that launches PowerShell malicious?

No. PowerShell is an administration tool. Unexpected use, concealed arguments, remote content, or a deceptive folder icon are the reasons to investigate.

Can a shortcut be dangerous even if the target is missing?

Yes. It may be broken now but still reveal the command or payload path used earlier. Preserve it if it matters to an incident investigation.

Is quarantine better than deletion?

Quarantine is preferable when you need reversibility or evidence. Permanent deletion is appropriate only after review.