If folders on a USB drive suddenly appear as shortcuts, do not open those shortcuts. The safest recovery order is to isolate the drive, scan the Windows PC and removable drive, reveal and verify the original files, preserve anything you may need as evidence, and remove only confirmed malicious leftovers. This guide explains that process without assuming that every .lnk file is malware.
Quick recovery checklist
- Disconnect the affected drive and do not double-click shortcut files.
- Update Windows Security, then scan the Windows PC.
- Reconnect the USB drive without opening its contents and scan that drive.
- Enable file-name extensions and hidden items.
- Inspect suspicious shortcuts and preserve evidence before deleting it.
- Restore hidden attributes only after the active threat has been addressed.
- Copy verified personal files, rescan them, and format the USB drive if you cannot trust what remains.
What people mean by “USB shortcut virus”
“Shortcut virus” is an informal name for malware that hides real folders and creates deceptive Windows shortcuts with similar names. A user opens what appears to be a folder, but the shortcut first launches a command, script, or executable. Some samples then open the expected folder as a distraction.
| What you see | More likely explanation | Safest next action |
|---|---|---|
| One familiar shortcut fails after an app was removed | Ordinary broken shortcut | Inspect its target, then repair or delete the shortcut. |
Many USB folders changed into similarly named .lnk files |
Possible shortcut-virus incident | Do not open them; scan the PC and USB drive. |
| Files seem missing but the drive still shows used space | Original folders may be hidden | Scan first, then reveal hidden items and attributes. |
| Shortcuts return after deletion or reconnection | An infected PC, scheduled task, or another device may be recreating them | Disconnect the drive and investigate every computer that used it. |
Unexpected .vbs, .js, .cmd, .bat, .scr, or .exe files on the same drive increase concern. The absence of those extensions does not prove a shortcut is safe.
Step 1: isolate the drive and protect important data
Unplug the removable drive. Do not move it between computers while you investigate; that can spread the problem or make it difficult to identify which PC is reinfecting the drive. Disconnect other removable drives so you cannot accidentally scan, format, or run a command against the wrong device.
If the USB drive contains irreplaceable data, minimize writes. A failing drive and a malware incident require different recovery strategies. When the device is making unusual noises, disconnecting repeatedly, reporting the wrong capacity, or producing read errors, make a sector-level image or consult a recovery professional before changing attributes or formatting it.
Step 2: scan the Windows PC before opening the USB drive
- Open Windows Security > Virus & threat protection.
- Install current Windows and security-intelligence updates.
- Open Scan options and run a Full scan.
- Apply the recommended actions and restart if Windows asks you to.
- If detections return after restart, run Microsoft Defender Offline scan before reconnecting the USB drive.
Microsoft’s Defender Offline guidance explains how the offline scan restarts Windows and checks outside the normal desktop session.
Step 3: scan the removable drive without launching its files
Reconnect the drive, but do not double-click a shortcut or unknown file. In File Explorer, right-click the drive. On Windows 11, choose Show more options if necessary, then select Scan with Microsoft Defender. Microsoft documents this workflow in its scan-an-item instructions.
Record the scan result. If files could not be accessed, treat the result as incomplete rather than “clean.” You can also follow our separate guide to scan a USB drive without opening suspicious files.
Step 4: show extensions and hidden items
After the security scan, open File Explorer and enable View > Show > File name extensions and Hidden items. A name such as Photos.lnk is easier to recognize when extensions are visible, and a deceptive Invoice.pdf.exe can no longer hide its executable extension. Microsoft lists both options in its File Explorer instructions.
Do not interpret a hidden file as automatically malicious. Windows and applications legitimately hide some files. The timing, location, shortcut target, and surrounding scripts matter.
Step 5: inspect suspicious shortcuts without opening them
Right-click a shortcut and choose Properties. Review Target, Start in, and any visible arguments. Pause when a shortcut unexpectedly invokes PowerShell, Command Prompt, Windows Script Host, MSHTA, Rundll32, Regsvr32, an executable in a temporary folder, or a script on the removable drive.
Those programs are not malicious by definition. Administrators and legitimate software use them too. They are risk signals when their use is unexpected, concealed, encoded, or combined with a folder name meant to trick the user. Our guide to inspecting suspicious .LNK files gives a safer, more detailed review procedure.
Step 6: restore hidden attributes only after scanning
If the active threat has been removed but your original folders remain hidden, the Windows attrib command can clear Hidden, System, and Read-only attributes. Confirm the USB drive letter in File Explorer first. The example below uses E:; replace it with the correct letter.
attrib -h -r -s /s /d E:\*.*-hclears the Hidden attribute.-rclears the Read-only attribute.-sclears the System attribute./sprocesses matching files in subfolders./dincludes folders.
This command does not remove malware, recover deleted data, or prove that a revealed file is safe. It changes attributes. See the focused walkthrough for showing hidden USB files after a shortcut-virus incident.
Step 7: copy verified files and decide whether to format
Copy only the personal documents, photos, and other files you recognize to a clean staging folder. Do not copy unknown scripts or executables merely because they were hidden. Scan the staging folder again before opening anything.
When the important data has been copied and verified, formatting the USB drive is the clearest way to remove unknown leftovers. Formatting erases the selected drive, so verify both the drive letter and the backup before starting. Then reconnect the freshly formatted drive to the now-clean PC and scan it once more.
Where Shortcut Remover fits in the process
After antivirus scanning, Shortcut Remover can enumerate Windows shortcuts, show target and argument signals, identify broken entries, quarantine reviewed findings, and preserve an action history. It does not execute shortcuts during inspection and does not claim that a single heuristic result proves a file is safe or malicious.
- Select only the intended drive or folder.
- Choose a full scan when you need recursive coverage.
- Review the reported directory, file, shortcut, access-error, and reparse-point counts.
- Inspect findings before selecting an action.
- Prefer quarantine when the item may be evidence or when you are uncertain.
Download Shortcut Remover 8.0.0 Read the testing methodology
If the shortcut virus keeps returning
Reappearing shortcuts mean deletion addressed a symptom, not the source. Keep the USB drive disconnected and check:
- every PC that recently used the drive;
- startup apps and scheduled tasks;
- other removable drives that may be reintroducing the same files;
- whether Windows Security remains enabled and updated;
- whether the shortcut points to a payload that still exists elsewhere.
If security tools are disabled unexpectedly, detections return after an offline scan, important files are encrypted, or the PC is used for sensitive accounts, stop using it for sensitive work and obtain professional incident-response help.
Frequently asked questions
Does the attrib command remove a shortcut virus?
No. It only changes file and folder attributes. Scan and address the active threat first.
Can I delete every .lnk file on the USB drive?
No. Windows shortcuts can be legitimate. Inspect them and delete or quarantine only entries you understand.
Why are my files missing while the drive still shows used space?
The original folders may have been marked Hidden and System. Scan first, enable Hidden items, and use attribute recovery only after the active threat is handled.
Will formatting the USB drive clean the infected computer?
No. Formatting affects the selected drive. A compromised PC can infect the drive again, so clean and rescan the computer separately.
Related guides: what to do first when USB files turn into shortcuts, shortcut virus vs. broken shortcut, and how to review Autorun.inf.