What the shortcut virus does to a USB drive
The shortcut virus is a common Windows-based malware issue that hides your real folders and replaces them with fake shortcut files.
If you need to know how to remove shortcut virus from USB, the goal is to restore access to your data, delete the malicious files, and stop the infection from spreading back.
This threat is often associated with removable media such as USB flash drives, memory cards, and external hard disks.
It is especially frustrating because the files may still be present, but Windows Explorer shows shortcuts instead of folders, making the drive look damaged when it is usually recoverable.
Signs your USB drive is infected
Before cleaning the device, confirm that the symptoms match shortcut malware.
Common signs include missing folders, unexpected .lnk files, and repeated prompts to run a shortcut instead of opening a normal file.
- Folders appear as shortcuts with the same name.
- Your files are hidden or seem to have disappeared.
- Unknown executable files appear on the USB drive.
- The drive opens a folder but immediately launches a shortcut or script.
- Windows Security, Microsoft Defender, or another antivirus detects suspicious activity.
Disconnect the USB and stop the spread
As soon as you suspect infection, stop using the USB drive on other computers.
Shortcut malware is designed to copy itself to new removable media and may also infect shared folders on a PC.
Safest practice is to unplug the USB drive, avoid double-clicking any shortcut files, and scan the host computer before reconnecting the device.
If the drive was used on multiple systems, those systems should also be checked for malware.
Back up the USB drive before cleanup
If the files matter, make a backup before removing the malware.
Copy only data you recognize and trust, and avoid opening suspicious .lnk, .exe, .vbs, .bat, or .cmd files found on the drive.
If you can see your real folders after changing hidden-file settings, copy them to a clean location on your computer or to another external drive.
Do not use the infected USB as the only source of recovery.
How to remove shortcut virus from USB using Windows tools
Windows includes command-line tools that can reveal hidden files and remove common shortcut malware.
These steps are useful when the infection is hiding folders but not encrypting them.
1. Show hidden files first
Open File Explorer, go to the View options, and enable hidden items.
This may allow you to see the actual folders if the malware only marked them as hidden.
2. Use Command Prompt to unhide files
Open Command Prompt as an administrator and replace X: with your USB drive letter:
attrib -h -r -s /s /d X:\*.*
This command removes hidden, read-only, and system attributes from files and folders on the USB drive.
After running it, check whether your original files are visible again.
3. Delete suspicious shortcut files
Look for shortcut files with the .lnk extension and delete them along with any unfamiliar scripts or executables in the root of the USB drive.
If the malware created an autorun-style file, removing it can prevent immediate reinfection.
4. Scan the drive with antivirus software
Run a full scan using Microsoft Defender or another reputable antivirus product.
For stronger detection, update the virus definitions first, then scan both the USB drive and the computer that used it.
Use a dedicated malware cleanup tool
Some shortcut viruses create registry entries or background processes that standard file cleanup will not remove.
In those cases, a trusted anti-malware utility can help identify related components on the PC.
Well-known options include Microsoft Defender Offline, Malwarebytes, ESET Online Scanner, and similar reputable tools.
The exact product matters less than keeping it current and using it to scan the computer, not just the USB stick.
What to do if files still look missing
If the folders remain hidden after the attrib command, the infection may have changed file attributes more aggressively or your data may have been deleted.
At that point, try these checks:
- Inspect the drive in Command Prompt with dir /a X:\ to display hidden entries.
- Look for duplicate files with strange names or extensions.
- Use a file recovery tool if the files were deleted instead of hidden.
- Check whether Windows Defender quarantined suspicious items.
If the USB drive shows signs of corruption as well as malware, it may be safer to copy recoverable data off the device and then format it after cleanup.
When formatting is the best option
Formatting removes the file system contents and is often the most reliable way to eliminate leftover malware on the USB drive.
Use this option when the drive is badly infected, repeatedly reinfects computers, or contains no data worth preserving.
Before formatting, make sure your important files are backed up and verified.
A quick format is usually enough for a USB flash drive, but if you suspect deeper damage, consider a full format after confirming the data is safe elsewhere.
How to prevent shortcut virus reinfection
Prevention matters because the shortcut virus commonly returns through unsafe file handling or infected PCs.
Once you know how to remove shortcut virus from USB, the next step is reducing exposure on future transfers.
- Keep Microsoft Defender or another antivirus solution active on all Windows PCs.
- Do not open unknown shortcuts, scripts, or executables from removable drives.
- Disable AutoRun and AutoPlay where possible.
- Scan every USB drive before opening files.
- Avoid using the same USB stick on untrusted computers.
- Store backups in cloud storage or on a second clean drive.
Safe USB handling habits for Windows users
Good habits reduce the chance that one infected device spreads to your workstations, laptops, or home PCs.
Always use the Safely Remove Hardware option before unplugging a USB drive, and keep file extensions visible so you can spot fake shortcuts and renamed files.
If you manage multiple devices, standardize your cleanup process.
That may include a known-good antivirus scanner, a repeatable command-line unhide step, and a policy that blocks USB use on machines not patched with current Windows updates.
When to get help from a technician
If the USB drive contains critical business files, if multiple systems are infected, or if malware keeps returning after cleanup, professional help is the safest path.
A technician can inspect startup items, scheduled tasks, registry changes, and any related network exposure that may be keeping the infection alive.
For most home users, though, the problem can be handled with hidden-file restoration, deletion of shortcut files, a full antivirus scan, and careful prevention steps before reconnecting the drive.