USB Shortcut Virus: Real Fix That Works (No Data Loss)

Quick Answer (for pros)

Open Command Prompt as admin, type attrib -h -r -s /s /d X:\*.* (replace X with USB drive letter), then delete autorun.inf, *.lnk, and any random-looking .exe or .vbs files. Your files will reappear.

What's Actually Happening

You plug in a USB stick, open it, and see nothing but shortcuts that look like your files. Double-click one and it might open a folder, run a script, or do nothing at all. Meanwhile, your real documents, photos, and folders are still there — just hidden. The virus set their attributes to system + hidden, then created shortcuts pointing to the malware payload on the drive. I've seen this hit small law firms, print shops, even a dentist's office where they lost patient X-rays. The worst part? People panic and reformat, wiping everything. Don't do that.

What You'll Need

Your infected USB drive
A Windows PC (7 through 11 all work the same)
5 minutes

No antivirus needed. No fancy tools. Just the command line.

Step-by-Step Fix

Find your USB drive letter. Open File Explorer, look under 'This PC' or 'My Computer'. Say it's F:.
Open Command Prompt as administrator. Click Start, type cmd, right-click 'Command Prompt' and choose 'Run as administrator'. Click Yes if prompted.
Type this exactly (replace F with your drive letter):
```
attrib -h -r -s /s /d F:\*.*
```
Hit Enter. Wait for it to finish — could be 10 seconds or 2 minutes depending on drive size.
Check your files. Open the USB drive. Your original files should be visible now, with normal icons. Shortcuts are still there too — we'll clean those next.
Delete the junk. Delete these files if they exist on the drive:
- autorun.inf
- All .lnk files (shortcuts)
- Any weird-looking .exe, .vbs, .bat, or .scr files — especially ones with random names like f34g67.exe
Don't delete real files. If you're unsure, leave them and check later.
Safely remove the USB. Use the 'Safely Remove Hardware' icon in the taskbar. This flushes any lingering file changes.

Alternative Fixes (When the Main One Fails)

Option 1: Use PowerShell Instead

If attrib doesn't work (rare, but happens on some locked-down systems), try PowerShell as admin:

Remove-Item -Path F:\autorun.inf -Force -ErrorAction SilentlyContinue
Get-ChildItem -Path F:\ -Filter *.lnk | Remove-Item -Force
Get-ChildItem -Path F:\ -Filter *.vbs | Remove-Item -Force
Get-ChildItem -Path F:\ -Filter *.exe | Where-Object { $_.Name -match '^[a-z0-9]{5,}\.exe$' } | Remove-Item -Force
attrib -h -r -s /s /d F:\*.*

This does the same thing but more aggressively cleans known malware file patterns.

Option 2: Show Hidden Files Manually

Open File Explorer, click 'View' tab, check 'Hidden items'. Uncheck 'Hide protected operating system files' (you'll get a warning — click OK). Now you'll see your files as ghosted icons. You can copy them off, then format the drive clean. But this is slower and easier to screw up.

Option 3: Use a Dedicated Tool

I'm not a fan of random USB cleaner tools, but if you're uncomfortable with the command line, grab USB Disk Security or Malwarebytes USB Protection. Both are lightweight and handle this specific virus. Just scan the drive and let them clean it.

Had a client last month whose entire print queue died because of this. The shortcut virus spread from a USB to the print server via a shared folder. Killed all network printing for two days. Don't plug unknown USBs into shared machines.

Prevention Tips

Disable AutoRun on all drives. In Windows, open Control Panel > AutoPlay, uncheck 'Use AutoPlay for all media and devices'. Set 'Removable Drive' to 'Take no action'. This stops the virus from executing the moment you plug in the USB.
Enable 'Show hidden files' permanently. In File Explorer, View > Options > View tab, select 'Show hidden files, folders, and drives', uncheck 'Hide protected operating system files'. Now you'll see any weirdness immediately.
Use a write-blocker USB hub. If you handle a lot of random USBs (I do for clients), get a $15 USB write-blocker. It lets you see files but blocks any writes — so the virus can't execute or copy itself to your PC.
Scan with Malwarebytes weekly. It's free and catches this specific threat better than most antivirus suites.
Keep a clean USB with your tools. I carry a 16GB USB with Rufus, Malwarebytes portable, and a text file of the attrib command. Never plug it into an untrusted machine.

That's it. No voodoo, no reformatting, no data loss. If you run into trouble, the attrib command is your best friend — it strips the hidden/system attributes and gives you back your files. Just remember to delete the shortcuts and malware files after. Your data was never gone, just hidden. Now go fix that USB.