You connect a USB drive and the folders you expected to see have been replaced by shortcuts. The drive may still show the same used space, yet your documents look missing. This is a common pattern in a shortcut-malware incident—but it is not enough, by itself, to prove that every shortcut is malicious.
The safest response is to avoid opening the new shortcuts, preserve the drive as it is, scan it, and only then restore the visibility of files that are still present. This guide walks through that sequence on Windows 10 and Windows 11.
What probably happened
A Windows shortcut is a small .lnk file that points to another file, folder, or command. Shortcuts are normal Windows objects. In a shortcut-malware incident, however, malicious software may hide the original folders and create look-alike shortcuts with familiar names. Opening one can launch a command or program before showing the expected folder.
That explains two confusing symptoms:
- The drive still contains data, but File Explorer no longer shows the original folders normally.
- A shortcut appears to have the same name and icon as a folder you recognize.
There are other explanations. A single broken shortcut may simply point to a file that was moved. Files can also be hidden by a user, an application, or a previous repair attempt. Treat the pattern as suspicious, not as a diagnosis.
What to do immediately
- Do not open the new shortcuts. Double-clicking is not required to inspect the drive.
- Do not format the drive. Formatting can make recovery harder and is unnecessary if the original files are still present.
- Disconnect other removable drives. This reduces the number of devices involved while you investigate.
- Note the drive letter. In File Explorer, confirm whether the affected device is, for example,
E:orF:. Never guess. - Scan the Windows PC too. Cleaning only the USB drive can lead to reinfection if the computer that modified it remains compromised.
Inspect the drive without opening suspicious files
Start with Windows Security. Open Virus & threat protection, choose Scan options, then use a custom scan for the removable drive. Microsoft notes that removable drives can be included in scans, depending on the scan type and configuration. Keep security intelligence up to date before scanning.
You can also use Shortcut Remover to inspect shortcut targets and arguments before deciding what to quarantine. A full scan should report coverage—such as directories and files inspected—and should disclose access errors or an incomplete result. A result that finishes almost instantly with zero files deserves investigation.
Do not assume that every .lnk file is unsafe. A useful review asks:
- Does the shortcut launch a command interpreter, script host, or executable from the USB drive?
- Does it contain unexpected command-line arguments?
- Does its displayed name imitate a hidden folder?
- Does the target path exist, and is it where you would expect?
Restore visibility only after scanning
If the scan finds that your original folders still exist but have hidden or system attributes, you can restore their visibility. The least risky approach is a tool that confines the repair to the selected drive and records what it changes. Shortcut Remover includes a visibility-repair workflow for that purpose.
Windows also provides the attrib command, but it can change many files at once. If you use it, confirm the exact drive letter, scan first, and understand each switch. Microsoft documents attrib and its recursive options in the Windows command reference. Do not copy a command from a forum and run it against an unverified drive letter.
Quarantine is safer than immediate deletion
When a shortcut is suspicious, quarantine preserves a recovery path. Review the item, move it into quarantine, and confirm that your original data opens normally from its real folder. Permanent deletion can wait until you have a backup and are confident the item is not needed.
After restoring visibility, copy irreplaceable documents to clean storage. Do not copy suspicious executables, scripts, or shortcuts merely because their names look familiar.
Prevent the same problem from returning
- Keep Windows and Microsoft Defender updated.
- Scan shared USB drives before browsing their contents.
- Leave file-name extensions visible so a shortcut or script is easier to recognize.
- Avoid using unknown public computers with a drive that contains important files.
- Maintain a second copy of important data that is not continuously connected.
If the same shortcut pattern returns after the USB drive is cleaned, stop using the drive with that computer until the computer receives a full malware scan. Repeated reinfection usually means the source has not been removed.
Next: Read how to show hidden USB files safely, or download Shortcut Remover for an explainable scan and quarantine workflow.
Reviewed for Windows 10 and Windows 11. This article describes defensive file inspection and does not replace incident-response help for a business network or a system handling sensitive data.