Interactive Troubleshooter

Published: Oct 14, 2026

USB Shortcut Virus: How to Remove It Without Formatting

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

This interactive diagnostic decision tree guides you through removing the USB shortcut virus without losing data or formatting your flash drive. It addresses root causes spanning VBS/WScript payload execution, hidden file attribute tampering, autorun registry hooks, and lingering PowerShell dropper processes.

Full Diagnostic Tree & Step-by-Step Overview

What symptoms appear when you insert the USB flash drive or external storage into your Windows PC?

All original folders are converted into shortcuts (.lnk), while real data files are hidden or inaccessible.
Clicking any shortcut on the USB opens a command prompt window or launches an external script.
New unknown files (e.g., .vbs, .bat, .cmd, or autorun.inf) appear on the root of the USB drive.
Opening the USB drive immediately infects the host PC, creating duplicate shortcuts on local hard drives.

What happens when you try to access your folders or inspect drive properties?

Drive space shows full (data is still on the disk), but clicking folders executes the shortcut target.
Folders are completely invisible even when 'Show hidden files, folders, and drives' is checked in File Explorer.
Attempting to open a folder displays an error stating the target file or path cannot be found.
File Explorer freezes or crashes whenever the USB drive root directory is expanded.

Restoring Hidden Files and Removing Shortcut Malware via Attrib Command

Solution:

Root Cause: Attribute Flag Modification (-h -s -r Manipulation)

The USB shortcut virus operates by executing a background script that alters the file attributes of your original directories, setting them to Hidden (-h), System (-s), and Read-Only (-r), while generating malicious .lnk shortcut files bearing the exact names and icons of your original folders. When you click a shortcut, it silently launches the underlying malware payload via WScript before opening the hidden directory to deceive the user.

Diagnostic Verification:

Open the USB drive root in File Explorer > click the View tab > check Hidden items. Your original folders appear translucent or greyed out, alongside matching shortcut files.

Step-by-Step Fix:

1Open Command Prompt as Administrator:

Press Win + R, type cmd, and press Ctrl + Shift + Enter.

2Identify your USB drive letter (e.g., E:):

Type your drive letter followed by a colon and press Enter:

E:

3Execute the Attrib Command to Strip Malware Attributes:

Run the following command (replace E: with your actual USB drive letter):

attrib -h -r -s /s /d E:\*.*

4Delete Malware Shortcut Files:

Run the command to remove all malicious .lnk files from the drive root:

del *.lnk

5Remove Suspicious Script Files:

Delete any stray .vbs, .bat, or autorun.inf files remaining on the root.

Prevention & Long-Term Monitoring:

Never open removable media directly by double-clicking; always inspect contents via File Explorer with hidden items visible.

Unlocking Protected Operating System Files in File Explorer

Solution:

Root Cause: Protected Operating System File Hiding Flag Suppression

When malware applies system flags (+s and +h), standard Windows File Explorer settings hide these items even if 'Show hidden files' is enabled, because the additional 'Hide protected operating system files' option remains checked by default in Windows folder options.

Diagnostic Verification:

File Explorer shows zero files on the USB root, yet the drive properties pie chart indicates the disk is nearly full of used space.

Step-by-Step Fix:

1Uncheck Protected Operating System Hiding in File Explorer:

Open File Explorer > click View (or the three dots menu > Options on Windows 11).

Select the View tab.

Uncheck Hide protected operating system files (Recommended).

Select Show hidden files, folders, and drives.

Click Apply and OK.

2Run Attribute Recovery via Command Prompt:

Open Command Prompt as Administrator, switch to your USB drive letter (e.g., G:), and run:

attrib -h -r -s /s /d G:\*.*

3Verify that original folders return to normal visibility and delete shortcut files.

Prevention & Long-Term Monitoring:

Maintain awareness of hidden file visibility settings when connecting untrusted flash drives.

Fixing Broken Shortcut Target Paths and Cleaning Link Remnants

Solution:

Root Cause: Orphaned Shortcut References Linked to Removed Malware Payloads

If antivirus software or manual cleanup removes the underlying VBS/BAT payload from the USB drive or host system, existing shortcut files lose their execution targets. Clicking them now results in Windows error popups stating that the file or path cannot be found, while original data remains locked behind hidden attributes.

Diagnostic Verification:

Right-click any folder shortcut on the USB drive > select Properties. Under the Shortcut tab, the Target field points to cmd.exe /c start ... or a hidden script rather than a folder path.

Step-by-Step Fix:

1Inspect and Purge All Malicious Shortcut Files:

Open Command Prompt as Administrator, switch to your USB drive letter (e.g., F:):

F:

Delete all shortcut files instantly using wildcard deletion:

del /a *.lnk

2Restore Original Directory Attributes:

Run the attribute restoration command:

attrib -h -r -s /s /d F:\*.*

3Verify Folder Accessibility:

Open your restored directories and confirm all documents, photos, and files open normally without error dialogs.

Prevention & Long-Term Monitoring:

Regularly audit removable drive contents for unauthorized shortcut generation.

Repairing File System Corruption Caused by Shortcut Malware Loops

Solution:

Root Cause: File Allocation Table (FAT32/exFAT) Corruption from Infinite Loop Scripting

When shortcut malware executes infinite background loops writing and deleting temporary script files to removable flash memory, it can corrupt the File Allocation Table (FAT32 or exFAT) or Master File Table (NTFS). This causes File Explorer to freeze, hang, or report cyclic redundancy check errors when attempting to read directory structures.

Diagnostic Verification:

Connecting the USB drive causes File Explorer to hang indefinitely, or disk management reports the file system as RAW or corrupted.

Step-by-Step Fix:

1Run Check Disk Utility (Chkdsk) Without Formatting:

Open Command Prompt as Administrator.

Run the check disk utility on your USB drive letter (e.g., E:), repairing errors automatically:

chkdsk E: /f /r

2Wait for Scan Completion:

Allow Windows to scan and repair corrupted file allocation chains and lost clusters.

3Access Drive After Repair:

Once chkdsk finishes, open the USB drive and run attrib -h -r -s /s /d E:\*.* to restore visibility to recovered folders.

Prevention & Long-Term Monitoring:

Eject USB drives safely using the taskbar notification tray to prevent file system corruption.

What happens in Task Manager or your system environment when the shortcut is executed?

`wscript.exe` or `cscript.exe` runs continuously in background processes, consuming CPU resources.
PowerShell opens briefly, executes an encoded command string, and closes automatically.
`cmd.exe` launches batch scripts pointing to temporary AppData or Temp directory paths.
Explorer.exe restarts repeatedly, causing the Windows taskbar and desktop icons to flash.

Terminating Malicious WScript / CScript Processes and Startup Scripts

Solution:

Root Cause: Persistent Background Execution via Windows Script Host (WScript)

Many USB shortcut variants rely on VBScript (.vbs) payloads executed via Windows Script Host (wscript.exe or cscript.exe). Once triggered by clicking a shortcut, the script runs indefinitely in the background, continuously monitoring for newly inserted USB drives to infect them while spawning malicious processes.

Diagnostic Verification:

Press Ctrl + Shift + Esc to open Task Manager > go to the Details tab. Locate running processes named wscript.exe or cscript.exe. Right-click > Open file location reveals they are executing from AppData or Temp folders.

Step-by-Step Fix:

1Terminate Active Script Processes:

Open PowerShell as Administrator and forcefully kill all script execution instances:

Stop-Process -Name wscript -Force -ErrorAction SilentlyContinue
Stop-Process -Name cscript -Force -ErrorAction SilentlyContinue

2Clean Startup Folder Script Remnants:

Press Win + R, type shell:startup, and press Enter.

Delete any unknown .vbs, .js, or shortcut files located in the user startup directory.

Press Win + R, type shell:common startup, and repeat the cleanup.

3Check Task Scheduler for Persistent Triggers:

Open Task Scheduler (taskschd.msc) and disable any unverified tasks running scripts from AppData.

Prevention & Long-Term Monitoring:

Disable Windows Script Host execution globally in enterprise environments via Group Policy if VBScript execution is not required.

Neutralizing Encoded PowerShell Droppers and Execution Policies

Solution:

Root Cause: Encoded PowerShell Command Execution (Bypassing Execution Policies)

Advanced shortcut viruses bypass traditional antivirus detection by invoking powershell.exe with base64-encoded command strings (-enc). These commands silently download secondary ransomware or keylogger payloads from remote command-and-control servers while spawning decoy shortcut icons on removable drives.

Diagnostic Verification:

Task Manager or Process Hacker reveals powershell.exe running with arguments containing long base64 strings (-encodedcommand or -e).

Step-by-Step Fix:

1Terminate Rogue PowerShell Instances:

Open PowerShell as Administrator and run:

Stop-Process -Name powershell -Force -ErrorAction SilentlyContinue

2Inspect and Reset PowerShell Execution Policy:

Run: Set-ExecutionPolicy Restricted -Scope LocalMachine

3Clear PowerShell History to Remove Stale Logs:

Run: Remove-Item (Get-PSReadLineOption).HistorySavePath -ErrorAction SilentlyContinue

4Perform Full System Scan with Malwarebytes to eliminate residual dropper executables.

Prevention & Long-Term Monitoring:

Restrict PowerShell execution policies across user profiles in enterprise environments.

Purging Malicious Batch Files from AppData and Temp Directories

Solution:

Root Cause: Staged Payload Dropping in User AppData / LocalAppData

When a shortcut executes, it often copies a batch file (.bat) or executable payload into hidden user directories such %AppData%, %LocalAppData%, or %Temp%. The shortcut points directly to these hidden local paths, allowing the malware to infect the host PC permanently even after the USB drive is unplugged.

Diagnostic Verification:

Open Run (Win + R), type %AppData% or %LocalAppData%. Look for recently modified folders containing suspicious .vbs, .bat, or .exe files with randomized names.

Step-by-Step Fix:

1Clean User Temp Directory:

Press Win + R, type %temp%, and press Enter.

Select all files (Ctrl + A) and delete them (Shift + Delete). Skip any files currently in use by active Windows processes.

2Clean AppData and LocalAppData Folders:

Press Win + R, type %appdata%, press Enter > inspect and delete unauthorized script files.

Press Win + R, type %localappdata%, press Enter > check for rogue staging folders and remove them.

3Restart PC into Safe Mode and run a full antivirus scan.

Prevention & Long-Term Monitoring:

Regularly empty temporary directories using Windows Storage Sense or automated scripts.

Restoring Explorer Shell Stability and Clearing Shell Hooks

Solution:

Root Cause: Explorer Shell Hook Interference and Registry Image Hijacks

Some aggressive shortcut variants inject hooks into the Windows Explorer shell execution loop (explorer.exe), causing desktop flashing, taskbar freezes, or automatic shortcut regeneration whenever removable drives are accessed.

Diagnostic Verification:

Taskbar icons disappear and reappear repeatedly, and inserting any USB drive immediately triggers high CPU usage in explorer.exe.

Step-by-Step Fix:

1Restart Windows Explorer Process:

Open Task Manager (Ctrl + Shift + Esc) > find Windows Explorer > right-click > Restart.

2Clean Explorer Shell Image File Execution Options (IFEO) in Registry:

Open Registry Editor (regedit) as Administrator.

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options.

Check for subkeys related to explorer.exe or wscript.exe containing debugger values and delete them.

3Clear Shell Icon Cache:

Delete IconCache.db located under %localappdata% to refresh corrupted icon renderings.

Prevention & Long-Term Monitoring:

Avoid executing unsigned batch files or scripts downloaded from untrusted file-sharing sources.

What specific anomalous files or infection artifacts are visible on the root of the USB drive?

A hidden `autorun.inf` file containing launch commands pointing to hidden scripts.
Massive numbers of randomly named `.vbs`, `.lnk`, or `.tmp` files filling up the directory.
A hidden folder named `RECYCLER`, `Recycled`, or `System Volume Information` containing malicious payloads.
Desktop.ini or hidden executable files masquerading as system folders.

Neutralizing Malicious Autorun.inf Files and Registry AutoRun Protections

Solution:

Root Cause: Autorun.inf Exploitation of Windows Drive Mounting Mechanisms

Legacy Windows versions executed autorun.inf automatically upon mounting removable media, launching embedded malware scripts instantly. While modern Windows 11/10 disables automatic execution of non-optical drives, malware still deploys autorun.inf to trick users or exploit unpatched shell vulnerabilities.

Diagnostic Verification:

On the USB drive root, enabling hidden items reveals an autorun.inf file. Attempting to open it in Notepad shows lines launching .vbs or .bat scripts.

Step-by-Step Fix:

1Delete Malicious Autorun Files via Command Prompt:

Open Command Prompt as Administrator, switch to your USB drive letter (e.g., D:):

D:

Remove system and hidden attributes from autorun files:

attrib -h -r -s autorun.inf

Delete the file:

del autorun.inf

2Verify Windows AutoPlay Protections:

Open Windows Settings > Bluetooth & devices > AutoPlay > toggle Use AutoPlay for all media and devices to OFF.

3Verify Registry NoDriveTypeAutoRun Key:

Open regedit, navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer and ensure NoDriveTypeAutoRun is configured to block unauthorized drive execution.

Prevention & Long-Term Monitoring:

Keep AutoPlay permanently disabled for removable USB storage devices across all workstations.

Purging Temporary Script Litter and Corrupted Extension Mappings

Solution:

Root Cause: Script Replication Littering and File Extension Association Hijacks

Shortcut malware often replicates thousands of tiny .vbs or .tmp files across USB directories to evade detection and overwhelm file allocation tables. Concurrently, some variants alter Windows file extension associations in the registry so that clicking normal files triggers script compilation.

Diagnostic Verification:

USB drive contains thousands of files with random alphanumeric names taking up gigabytes of hidden space.

Step-by-Step Fix:

1Bulk Delete Malicious Script Files via Command Prompt:

Open Command Prompt as Administrator, switch to USB drive (e.g., E:):

E:

Delete all VBS files across directories:

del /s /q *.vbs
del /s /q *.tmp
del /s /q *.bat

2Restore Default File Association Registry Keys:

Open Command Prompt as Admin and run:

assoc .exe=exefile
assoc .lnk=lnkfile

3Run attrib -h -r -s /s /d E:\*.* to ensure original folders are fully restored.

Prevention & Long-Term Monitoring:

Scan newly attached USB drives with trusted security software before opening files.

Cleaning Hidden Malicious Payloads Inside Recycler and System Folders

Solution:

Root Cause: Malware Hiding Inside System Trash Directories (`RECYCLER` / `Recycled`)

Shortcut worms frequently create fake system folders named RECYCLER, Recycled, or hide inside legitimate System Volume Information directories on the USB drive. Because these names mimic core operating system directories, users ignore them, allowing the malware payload .exe or .vbs files to run safely out of sight whenever the drive is accessed.

Diagnostic Verification:

Enabling hidden and system files reveals folders named RECYCLER or Recycled on a FAT32-formatted USB drive (which normally does not utilize Windows Recycle Bin structures).

Step-by-Step Fix:

1Take Ownership and Remove Fake Recycler Folders:

Open Command Prompt as Administrator, switch to USB drive (e.g., F:):

F:

Strip system and hidden attributes from the recycler directory:

attrib -h -r -s RECYCLER
attrib -h -r -s Recycled

Force delete the malicious directory tree:

rd /s /q RECYCLER
rd /s /q Recycled

2Clean System Volume Information Staging:

Run: attrib -h -r -s "System Volume Information"

Delete any unauthorized script files located inside the System Volume Information folder.

Prevention & Long-Term Monitoring:

Periodically inspect removable drives for unauthorized system-named directories using command-line directory listings (dir /ah).

Restoring Desktop.ini and Folder Icon Customization Parameters

Solution:

Root Cause: Corrupted Desktop.ini Folder Icon Hijacks

To make shortcut folders look identical to real directories, malware modifies or injects malicious Desktop.ini configuration files inside each folder. These files instruct File Explorer to display custom icons or execute secondary scripts upon folder previewing.

Diagnostic Verification:

Folders display strange icons or fail to open normally, and inspecting folder contents reveals hidden Desktop.ini files with non-standard code.

Step-by-Step Fix:

1Remove Malicious Desktop.ini Files via Command Prompt:

Open Command Prompt as Administrator, switch to USB drive (e.g., G:):

G:

Remove system attributes and delete rogue ini files across all subdirectories:

attrib -h -r -s /s /d Desktop.ini
del /s /q Desktop.ini

2Rebuild Folder Attributes:

Run attrib -h -r -s /s /d G:\*.* to clear all remaining malware flags.

3Verify normal folder icon rendering in File Explorer.

Prevention & Long-Term Monitoring:

Avoid modifying default folder icon settings on shared removable media.

What host PC persistence mechanism or startup infection sign is observed after removing the USB drive?

Windows Registry Run/RunOnce keys recreate shortcut malware whenever the PC reboots.
Task Scheduler launches rogue background tasks pointing to AppData scripts every hour.
Inserting any clean, uninfected USB drive immediately turns into shortcuts on this PC.
Local hard drive folders (Documents, Downloads) are infected with shortcut duplicates.

Purging Windows Registry Run and RunOnce Persistence Keys

Solution:

Root Cause: Registry Run Key Persistence (`CurrentVersion\Run`)

To ensure survival across system reboots, shortcut malware injects execution strings into Windows Registry Startup Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run or HKLM\...\Run). When Windows boots, the registry key launches the resident VBS/PowerShell script, which waits for new USB drives to be connected so it can infect them instantly.

Diagnostic Verification:

Press Win + R, type regedit, and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Look for suspicious string values launching wscript.exe, powershell.exe, or scripts in AppData.

Step-by-Step Fix:

1Clean User Run Keys in Registry:

Open Registry Editor (regedit) as Administrator.

Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

Delete any unverified or suspicious string values pointing to scripts or temporary folders.

2Clean Machine Run Keys in Registry:

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Inspect and delete rogue startup entries.

3Clean Wow6432Node Run Keys (64-bit Systems):

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run and remove malware entries.

4Restart PC to verify persistence is eliminated.

Prevention & Long-Term Monitoring:

Regularly audit startup registry keys using Windows Sysinternals Autoruns utility.

Disabling Rogue Scheduled Tasks and Background Staging Jobs

Solution:

Root Cause: Task Scheduler Job Persistence

Advanced shortcut worms create scheduled tasks in Windows Task Scheduler that execute hidden scripts at user logon, system startup, or regular time intervals. Even if registry run keys are cleaned, surviving scheduled tasks will recreate the registry entries upon the next login.

Diagnostic Verification:

Open Task Scheduler (taskschd.msc) > Task Scheduler Library. Look for tasks with randomized names, empty publishers, or actions executing scripts from AppData/Temp.

Step-by-Step Fix:

1Open Task Scheduler as Administrator (taskschd.msc).

2Select Task Scheduler Library.

3Review active tasks. Right-click any suspicious task > select Disable or Delete.

4Clean Tasks via Administrative PowerShell:

Open PowerShell as Admin and list scheduled tasks:

Get-ScheduledTask | Where-Object {$_.State -eq 'Ready'}

Unregister malicious tasks using:

Unregister-ScheduledTask -TaskName "SuspiciousTaskName" -Confirm:$false

5Restart computer.

Prevention & Long-Term Monitoring:

Monitor scheduled task creation events via Windows Security Event Logs (Event ID 4698).

Disinfecting Host PC Resident Worms and WScript System Hooks

Solution:

Root Cause: Resident Host Worm Reinfecting Newly Inserted Clean Media

If cleaning the USB drive works temporarily, but plugging the drive back in immediately populates it with shortcuts again, the host computer itself is harboring a resident worm service (such as a background VBS/Python script or infected Explorer extension) that detects USB mount events and deploys the payload automatically.

Diagnostic Verification:

Inserting a brand-new, freshly formatted USB drive into the PC results in instant shortcut infection within 5 seconds without user interaction.

Step-by-Step Fix:

1Disconnect PC from Internet to prevent remote payload downloads.

2Kill All Script Host Processes:

Open PowerShell as Administrator:

Stop-Process -Name wscript, cscript, powershell -Force -ErrorAction SilentlyContinue

3Run Comprehensive Offline Antivirus Scan:

Run Windows Defender Offline scan or use Malwarebytes Premium to purge host resident worms.

4Clean Startup, Registry Run Keys, and Task Scheduler as detailed in previous steps.

5Re-verify by inserting a test USB drive only after a full system reboot and clean scan.

Prevention & Long-Term Monitoring:

Maintain active real-time protection and avoid executing files from unknown flash drives on corporate or personal workstations.

Restoring Local Hard Drive Folder Attributes and Clearing Local Shortcut Sprawl

Solution:

Root Cause: Lateral Spread of Attribute-Hiding Scripts to Local System Directories

When a shortcut virus runs on an infected PC, it occasionally scans local hard drive partitions (C:, D:) and applies hidden/system attributes to local user folders (Documents, Pictures, Downloads) while populating them with shortcut clones.

Diagnostic Verification:

Local user folders appear empty or display shortcut icons instead of actual files, while disk space remains fully occupied.

Step-by-Step Fix:

1Open Command Prompt as Administrator.

2Navigate to Local Partition Root (e.g., C:):

C:

3Execute Global Attribute Restoration across User Profiles:

Run the attrib command targeting your user profile directory (replace Username with your actual Windows username):

attrib -h -r -s /s /d "C:\Users\Username\Documents\*.*"
attrib -h -r -s /s /d "C:\Users\Username\Downloads\*.*"

4Delete Local Shortcut Sprawl:

Run: del /s /q "C:\Users\Username\Documents\*.lnk"

5Verify that all local files return to normal accessibility.

Prevention & Long-Term Monitoring:

Perform regular system backups and restrict unauthorized script execution across user directories.

Related Diagnostic Guides

Printer Driver Is Unavailable Windows 11: Driver Store Cleanup Fix

SD Card Reader Not Working After Update: Realtek Driver Tree

USB C Hub Not Detecting HDMI: DP Alt Mode Diagnostic

Laptop Touchpad Not Working After Windows Update: Precision Driver Tree

MEMORY_MANAGEMENT BSOD While Gaming: XMP Profile Diagnostic

Subscribe to StepDiag

Embed Guide on Your Website