Interactive Troubleshooter

Published: Sep 18, 2026

USB Drive Shows Shortcut Virus: Remove Without Format

Time: 15 mins Level: Beginner

By StepDiag Engineering Team

Reviewed by Ibraheem Taofeeq Opeyemi

An exhaustive root-cause diagnostic tree to recover data and eliminate USB drive shortcut viruses without formatting. Resolves System attribute masking, malicious WScript execution chains, Windows host registry persistence, and AutoRun hijacking.

Full Diagnostic Tree & Step-by-Step Overview

What primary symptom or behavior are you experiencing when accessing the USB drive?

USB files and folders are replaced by .lnk shortcuts pointing to scripts or executables.
USB drive shows used storage space in Explorer but appears completely empty.
Clean USB drives instantly get infected with shortcuts upon insertion into this host PC.
Windows throws WScript script errors or open command errors when opening the USB drive.

What payload structure or file extension is targeted by the .lnk shortcuts?

Shortcuts invoke wscript.exe or cscript.exe executing a .vbs or .vbe payload.
Shortcuts point to an executable (.exe) or DLL disguised inside a hidden folder.
Shortcuts execute obfuscated CMD or PowerShell command strings (-EncodedCommand).
Shortcuts are coupled with a hidden autorun.inf file triggering execution on mount.

Purging VBScript / VBE Shortcut Payloads via Attrib and CMD

Solution:

Root Cause: VBScript Worm Execution Chain

A VBScript worm (such as Houdini, Jenxcus, or Bondat) altered directory attributes on the USB storage volume to System (+s) and Hidden (+h). It created dummy .lnk files that execute wscript.exe with arguments pointing to a hidden .vbs or .vbe payload while silently opening the legitimate folder in the background.

# Diagnostic Verification:

1. Open Command Prompt as Administrator.
2. Inspect shortcut target paths by running:

cmd
wmic shortcut where "Drive='X:'" get Target, Arguments

3. Look for target parameters containing wscript.exe //B //e:VBScript or references to scripts residing in hidden USB directories.

# Step-by-Step Fix:

1. Terminate all active Windows Script Host processes in PowerShell:

powershell
Stop-Process -Name wscript, cscript -Force -ErrorAction SilentlyContinue

2. Open Command Prompt as Administrator and switch to your USB drive letter (replace X: with your actual USB drive letter):

cmd
X:

3. Strip System, Hidden, and Read-Only attributes from all files and folders across the volume:

cmd
attrib -h -r -s /s /d X:\*.*

4. Force delete all malicious shortcut .lnk files on the USB volume:

cmd
del /f /q /s X:\*.lnk

5. Search for and delete dropped script payload files (.vbs, .vbe, .js, .ini):

cmd
del /f /q /a:h X:\*.vbs X:\*.vbe X:\*.js

6. Move your unhidden original folders out of any suspicious unnamed subdirectories back to the root of X:.

# Prevention & Long-Term Monitoring:

Disassociate .vbs and .vbe files from wscript.exe by changing their default handler to notepad.exe. Refer to the Microsoft Official Documentation on Attrib Command for attribute parameter reference.

Removing Executable / DLL Trojan Binary Shortcuts

Solution:

Root Cause: Binary Payload Injection & Folder Masquerading

Trojan binaries (e.g., Gamarue, Silente, or Andromeda) move original USB directories into a hidden, unmapped system folder (such as X:\Drive or X:\...). The malware places an executable with a folder icon on the root drive matching your original directory names.

# Diagnostic Verification:

1. Right-click any folder icon on the USB drive and select Properties.
2. Inspect the Type of file: if it reads Shortcut (.lnk) or Application (.exe) rather than File folder, binary masquerading is active.
3. Check shortcut target paths for references like X:\Drive\indexer.exe or X:\RECYCLER\*.exe.

# Step-by-Step Fix:

1. Open PowerShell as Administrator and terminate suspicious executable instances running from AppData or Temp paths:

powershell
Get-Process | Where-Object { $_.Path -match "AppData|Temp|Recycler" } | Stop-Process -Force

2. Open CMD as Administrator and navigate to the USB drive (X:).
3. Remove restrictive attributes on all hidden structures:

cmd
attrib -h -r -s /s /d X:\*.*

4. Remove all fake folder shortcuts:

cmd
del /f /q X:\*.lnk

5. Locate the hidden folder containing your original files (often named Drive, _, or an empty space string) and move its contents back to the root:

cmd
move "X:\Drive\*" "X:\"

6. Delete the residual empty payload folder and rogue binary:

cmd
rmdir /s /q "X:\Drive"
del /f /q /a:h X:\*.exe

# Prevention & Long-Term Monitoring:

Enable Microsoft Defender Real-Time Protection and configure Attack Surface Reduction (ASR) rules to block executable files from running off USB storage.

Neutralizing PowerShell & Obfuscated CMD Shortcut Chains

Solution:

Root Cause: Encoded PowerShell Downloaders

The .lnk file targets contain base64-encoded PowerShell command lines (powershell.exe -e <Base64>) or chained cmd.exe /c parameters. Clicking the shortcut invokes PowerShell silently, downloads secondary stage payloads from a C2 server, and launches them in memory.

# Diagnostic Verification:

1. Disconnect your PC from the internet immediately to block C2 exfiltration.
2. Open PowerShell as Administrator and inspect active script execution processes:

powershell
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match "powershell" -and $_.CommandLine -match "-e|-EncodedCommand|Hidden" } | Select-Object ProcessId, CommandLine

# Step-by-Step Fix:

1. Kill all active PowerShell background instances:

powershell
Stop-Process -Name powershell -Force

2. Open CMD as Administrator and run the attribute reset on the USB volume (X:):

cmd
attrib -h -r -s /s /d X:\*.*

3. Delete all malicious shortcuts on the drive:

cmd
del /f /q /s X:\*.lnk

4. Search for dropped staging files inside the user Temp directory and purge them:

powershell
Remove-Item -Path "$env:TEMP\*.ps1", "$env:TEMP\*.bat", "$env:TEMP\*.vbs" -Force -ErrorAction SilentlyContinue

5. Reconnect to the network only after performing a full offline antivirus scan.

# Prevention & Long-Term Monitoring:

Enable PowerShell Constrained Language Mode (__PSLockdownPolicy = 4) and turn on Script Block Logging in Windows Audit Policy.

Removing Legacy Autorun.inf Execution Triggers

Solution:

Root Cause: AutoRun Configuration Hijacking

The shortcut virus dropped an autorun.inf file onto the root of the USB drive. This file defines open= and shell\open\command= parameters that execute malicious scripts automatically whenever Windows attempts to mount or double-click the drive.

# Diagnostic Verification:

1. Open Command Prompt as Administrator.
2. List hidden files on the root of X: specifically searching for autorun.inf:

cmd
dir /a:h X:\autorun.inf

3. Display the contents of autorun.inf using type:

cmd
type X:\autorun.inf

# Step-by-Step Fix:

1. Strip file attributes from autorun.inf:

cmd
attrib -h -r -s X:\autorun.inf

2. Force delete the autorun.inf file from the volume:

cmd
del /f /q /a X:\autorun.inf

3. Unhide all legitimate user files and directories on the drive:

cmd
attrib -h -r -s /s /d X:\*.*

4. Delete any accompanying shortcuts:

cmd
del /f /q X:\*.lnk

5. Immunize the drive by creating an un-deletable dummy autorun.inf folder:

cmd
mkdir X:\autorun.inf\con\
attrib +s +r +h X:\autorun.inf

# Prevention & Long-Term Monitoring:

Disable AutoRun/AutoPlay globally across Windows using Registry policies (NoDriveTypeAutoRun = 255).

How are your original files masked or hidden on the USB storage volume?

Files are hidden under System (+s) and Hidden (+h) OS attributes.
Files are moved into an unnamed space folder (Drive:\ ) or underscore directory.
Files are inaccessible due to FAT32/exFAT directory index metadata corruption.
Volume write-protection or storage read-only flag blocks attribute modification.

Recovering System-Hidden Files via Attrib Command

Solution:

Root Cause: Protected Operating System Attribute Masking

Malware alters the NTFS/FAT32 file table attributes, applying both the Hidden (+h) and System (+s) flags to user files. Standard Windows File Explorer configurations hide these files by default even if 'Show hidden files' is enabled, making the drive appear completely empty.

# Diagnostic Verification:

1. Open File Explorer -> Drive X:.
2. Note the drive capacity bar in This PC: storage space is heavily occupied (e.g., 28 GB used of 32 GB), yet opening the folder shows 'This folder is empty'.

# Step-by-Step Fix:

1. Press Win + X and select Terminal (Admin) or Command Prompt (Admin).
2. Type your USB drive letter and press Enter:

cmd
X:

3. Execute the full attribute stripping command across all files and directories:

cmd
attrib -h -r -s /s /d X:\*.*

4. Inspect File Explorer; your original files and folders will reappear immediately on the root drive.
5. Audit directory contents and delete any orphaned .lnk, .vbs, or .exe files dropped by the virus:

cmd
del /f /q X:\*.lnk X:\*.vbs X:\*.vbe

# Prevention & Long-Term Monitoring:

In File Explorer, go to View -> Options -> View tab. Uncheck Hide protected operating system files (Recommended) to catch attribute-masking malware instantly.

Extracting Data from Unnamed ASCII Space Directories

Solution:

Root Cause: Unnamed ASCII Character Directory Relocation

The malware creates a directory named with a non-printable or blank ASCII character (such as ALT+255 space X:\ or X:\_), moves all legitimate user files inside it, and hides the container folder. Windows GUI Explorer renders the folder as invisible or inaccessible.

# Diagnostic Verification:

1. Open CMD as Administrator and list all drive contents including hidden items:

cmd
dir /a X:\

2. Observe the output table: look for a directory entry displaying <DIR> with no visible name, a dot, or a single underscore _.

# Step-by-Step Fix:

1. Open CMD as Administrator and navigate to the USB drive (X:).
2. Strip attributes from all root items:

cmd
attrib -h -r -s /s /d X:\*.*

3. Change directory into the unnamed space folder using wildcard tab-completion:

cmd
cd "X:\_"

*(If named with a blank ASCII space, use cd "X:\ " or cd X:\*)*
4. Move all contained user directories and files back to the root volume:

cmd
move *.* X:\
move * X:\

5. Navigate back to the root drive and remove the empty rogue container directory:

cmd
cd X:\
rmdir /s /q "X:\_"

# Prevention & Long-Term Monitoring:

Run command-line directory audits (dir /a) whenever file structures appear missing after using public or shared computers.

Repairing File System Corruption with CHKDSK Prior to Unhiding

Solution:

Root Cause: FAT32/exFAT Directory Index Metadata Corruption

When a USB drive infected with a shortcut virus is abruptly unplugged, FAT32 allocation tables become corrupted. Running attrib fails with errors such as File not found or Access Denied because file pointers are orphaned in corrupted sectors.

# Diagnostic Verification:

1. Open CMD as Administrator and run attrib -h -r -s /s /d X:\*.*.
2. The console returns continuous error messages: File not found - X:\*.* or Corrupted master file table despite Disk Management showing active volume data usage.

# Step-by-Step Fix:

1. Open CMD as Administrator.
2. Execute Check Disk to repair file system indexing and fix bad sectors:

cmd
chkdsk X: /f /r /x

3. If prompted to convert lost chains to files, type Y and press Enter.
4. Wait for CHKDSK to finish repairing directory allocation tables.
5. Re-run the attribute unhide command:

cmd
attrib -h -r -s /s /d X:\*.*

6. If recovered files appear inside a FOUND.000 folder as .CHK files, use an open-source file recovery tool (such as UnCHK) to restore original file extensions.

# Prevention & Long-Term Monitoring:

Always click Safely Remove Hardware and Eject Media in the Windows system tray before disconnecting flash drives.

Clearing Read-Only Volume Attribute Locks and Storage Policies

Solution:

Root Cause: StorageDevicePolicies Read-Only Registry / Diskpart Lock

Either a Windows local security policy (StorageDevicePolicies\WriteProtect) or a hardware attribute flag placed by the malware forces the USB volume into a Read-Only state, preventing the attrib command from removing System and Hidden flags.

# Diagnostic Verification:

1. Open CMD and run attrib -h -r -s /s /d X:\*.*.
2. The command terminates with the error message: Write Protect Error or Access is denied.

# Step-by-Step Fix:

1. Press Win + R, type powershell, press Ctrl + Shift + Enter to launch elevated PowerShell.
2. Clear the volume-level read-only attribute using Diskpart:

powershell
diskpart
list disk
select disk N   # Replace N with the disk number corresponding to your USB drive
attributes disk clear readonly
exit

3. Disable the Windows Storage ReadOnly policy key in the Registry:

powershell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies" -Name "WriteProtect" -Value 0 -ErrorAction SilentlyContinue

4. Open CMD as Administrator and re-run the attribute unhide command:

cmd
attrib -h -r -s /s /d X:\*.*

# Prevention & Long-Term Monitoring:

Verify endpoint management software does not apply global write-block policies to external storage media.

Where is the host malware residing to reinfect newly connected flash drives?

Registry HKCU/HKLM Run keys loading VBScript/EXE from AppData or Temp.
WMI Event Subscriptions (ActiveScriptEventConsumer) spawning persistence scripts.
Windows Task Scheduler library executing persistent background tasks.
User Startup folder shortcuts invoking payload scripts on user sign-in.

Eliminating Host Registry Run Key Infection Persistence

Solution:

Root Cause: Registry Run Key Autostart Hook

The host Windows system is infected with a persistent resident script. The malware added an entry under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that loads wscript.exe with a hidden script in %AppData%. When a clean USB drive is inserted, the background script immediately infects it.

# Diagnostic Verification:

1. Press Win + R, type regedit, and press Enter.
2. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.
3. Look for entries executing wscript.exe or cmd.exe referencing .vbs, .vbe, or .exe files located in AppData or Temp.

# Step-by-Step Fix:

1. Open PowerShell as Administrator and terminate running script interpreters:

powershell
Stop-Process -Name wscript, cscript, mshta -Force -ErrorAction SilentlyContinue

2. Delete persistent registry startup keys:

powershell
Remove-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Helper" -ErrorAction SilentlyContinue
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -Name "Helper" -ErrorAction SilentlyContinue

3. Purge the malicious script files from local user profile directories:

powershell
Remove-Item -Path "$env:APPDATA\*.vbs", "$env:APPDATA\*.vbe", "$env:APPDATA\*.js" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:LOCALAPPDATA\Temp\*.vbs" -Force -ErrorAction SilentlyContinue

4. Re-insert the cleaned USB drive to confirm no new shortcuts are generated.

# Prevention & Long-Term Monitoring:

Use Sysinternals Autoruns to audit Run and RunOnce registry locations periodically for unverified script entries.

Purging Malicious WMI Event Subscriptions

Solution:

Root Cause: WMI ActiveScriptEventConsumer Persistence

Advanced shortcut malware installs a WMI __EventFilter linked to an ActiveScriptEventConsumer. The WMI provider listens for system volume insertion events (__InstanceCreationEvent of Win32_Volume) and executes an embedded VBScript payload directly from WMI memory without requiring a registry startup key.

# Diagnostic Verification:

1. Open PowerShell as Administrator.
2. Query WMI event consumers registered in the system namespace:

powershell
Get-CimInstance -Namespace root\subscription -ClassName ActiveScriptEventConsumer

3. Review script code contained within the ScriptText property output.

# Step-by-Step Fix:

1. Open PowerShell as Administrator.
2. List and identify rogue WMI event bindings:

powershell
Get-CimInstance -Namespace root\subscription -ClassName __EventFilter

3. Execute targeted removal of the malicious WMI event consumers and filters:

powershell
Get-CimInstance -Namespace root\subscription -ClassName ActiveScriptEventConsumer | Where-Object Name -match "USB|Shortcut|Malware|Volume" | Remove-CimInstance
Get-CimInstance -Namespace root\subscription -ClassName __EventFilter | Where-Object Name -match "USB|Shortcut|Malware|Volume" | Remove-CimInstance
Get-CimInstance -Namespace root\subscription -ClassName __FilterToConsumerBinding | Remove-CimInstance

4. Verify that querying ActiveScriptEventConsumer returns no malicious entries.

# Prevention & Long-Term Monitoring:

Restrict WMI event creation rights to local Administrators and monitor WMI repository modifications via Event ID 5861.

Removing Malicious Scheduled Task Persistence Triggers

Solution:

Root Cause: Scheduled Task Loop Execution

The installer registered a hidden task in Windows Task Scheduler. The task is configured to execute wscript.exe every 5 to 10 minutes or upon user logon, checking for active removable storage drives and re-applying shortcut transformations.

# Diagnostic Verification:

1. Open PowerShell as Administrator.
2. List scheduled tasks pointing to script engines or temporary paths:

powershell
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "wscript|cscript|powershell|cmd" -and $_.Actions.Arguments -match "AppData|Temp|Users" } | Select-Object TaskName, TaskPath, State

# Step-by-Step Fix:

1. Open PowerShell as Administrator.
2. Delete identified malicious scheduled tasks by name:

powershell
Unregister-ScheduledTask -TaskName "MaliciousTaskName" -Confirm:$false

3. Navigate to the Task Scheduler XML folder and delete residual files if the GUI fails to clear them:

powershell
Remove-Item -Path "C:\Windows\System32\Tasks\MaliciousTaskName" -Force -ErrorAction SilentlyContinue

4. Delete the payload file referenced in the task arguments path.
5. Restart the computer.

# Prevention & Long-Term Monitoring:

Monitor Task Scheduler creation logs in Event Viewer under Microsoft-Windows-TaskScheduler/Operational (Event ID 106).

Clearing User Startup Folder Script Payloads

Solution:

Root Cause: Windows User Startup Directory Dropper

The malware drops a hidden shortcut or script file into the Windows User Startup folder (%AppData%\Microsoft\Windows\Start Menu\Programs\Startup). Every time the current user signs in, Windows executes the script, keeping the infection alive in RAM.

# Diagnostic Verification:

1. Press Win + R, type shell:startup, and press Enter.
2. Review the folder contents: check for shortcuts, .vbs, .vbe, .bat, or .exe files that do not belong to legitimate applications.

# Step-by-Step Fix:

1. Open PowerShell as Administrator and kill running script hosts:

powershell
Stop-Process -Name wscript, cscript -Force -ErrorAction SilentlyContinue

2. Navigate to the Startup folder in PowerShell:

powershell
cd "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup"

3. Unhide all files inside the Startup directory:

powershell
Get-ChildItem -Force | Rename-Item -NewName { $_.Name }

4. Remove all unverified script and executable files:

powershell
Remove-Item -Path "*.vbs", "*.vbe", "*.js", "*.bat" -Force -ErrorAction SilentlyContinue

5. Check the system-wide Startup folder (C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup) and clean rogue files there as well.

# Prevention & Long-Term Monitoring:

Restrict non-administrative write access to Startup folder directories using standard Windows NTFS permissions.

What error condition or safety configuration do you need to resolve post-cleanup?

Windows displays 'Cannot find script file' error popup on startup.
Double-clicking drive letter fails due to registry Drive shell open hijack.
Windows AutoPlay service automatically executes untrusted removable media scripts.
Immunize clean flash drives against future shortcut virus write attempts.

Fixing 'Windows Script Host - Cannot Find Script File' Startup Error

Solution:

Root Cause: Orphaned Registry Autostart Pointer

The malware payload .vbs file was deleted during cleanup, but the registry autostart entry pointing to its location remains active in HKCU\...\Run or Winlogon\Userinit. On Windows boot, wscript.exe attempts to load the missing file and throws a dialog popup error.

# Diagnostic Verification:

Windows sign-in completes and displays an error box titled Windows Script Host: Can not find script file "C:\Users\...\AppData\Roaming\...\helper.vbs".

# Step-by-Step Fix:

1. Press Win + R, type regedit, press Enter.
2. Navigate to the primary autostart key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
3. Look for value entries containing the script path referenced in the error popup.
4. Right-click the orphan entry and select Delete.
5. Navigate to the Winlogon registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\NT\CurrentVersion\Winlogon
6. Inspect the Userinit string: ensure its value is set strictly to C:\Windows\system32\userinit.exe, (include the trailing comma). Remove any appended script paths.
7. Restart Windows to confirm the error dialog no longer appears.

# Prevention & Long-Term Monitoring:

Always remove corresponding startup registry keys when deleting malware script binaries from system drives.

Repairing Registry Drive Shell Open Command Hijacks

Solution:

Root Cause: Registry HKCR Drive Shell Command Override

The malware modified the default Windows Registry association for drive double-click actions (HKEY_CLASSES_ROOT\Drive\shell\open\command). Instead of launching Windows File Explorer, double-clicking any drive letter in 'This PC' attempts to launch a missing malware script.

# Diagnostic Verification:

Double-clicking a USB drive letter in File Explorer results in an error: Application not found or launches a Command Prompt window instead of opening the directory.

# Step-by-Step Fix:

1. Open PowerShell as Administrator.
2. Reset the Registry shell open handler for drive objects back to Windows Explorer default:

powershell
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Drive\shell\open\command" -Name "(default)" -Value "%SystemRoot%\Explorer.exe %1"
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\Directory\shell\open\command" -Name "(default)" -Value "%SystemRoot%\Explorer.exe %1"

3. Remove any rogue subkeys under the Drive shell registry key:

powershell
Remove-Item -Path "Registry::HKEY_CLASSES_ROOT\Drive\shell\run" -Recurse -Force -ErrorAction SilentlyContinue

4. Restart Windows Explorer process in Command Prompt:

cmd
taskkill /f /im explorer.exe & start explorer.exe

# Prevention & Long-Term Monitoring:

Lock Registry shell association keys against unprivileged modification using Windows Group Policy.

Globally Disabling Windows AutoRun and AutoPlay Services

Solution:

Root Cause: Enabled Windows Removable Media AutoPlay

By default, Windows AutoPlay and AutoRun handlers parse autorun.inf and root content when new flash drives are connected. Disabling this functionality prevents rogue scripts from automatically executing upon plugging in removable storage.

# Diagnostic Verification:

1. Connect a USB drive.
2. If Windows displays an AutoPlay prompt or attempts to launch files automatically without manual File Explorer navigation, AutoRun is active.

# Step-by-Step Fix:

1. Open PowerShell as Administrator.
2. Enforce global AutoRun block across all drive types via Windows Registry:

powershell
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255 -Type DWord

3. Disable AutoPlay handler triggers:

powershell
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers" -Name "DisableAutoplay" -Value 1 -Type DWord

4. Reboot the host computer to apply global policy changes.

# Prevention & Long-Term Monitoring:

Deploy the NoDriveTypeAutoRun = 255 DWORD policy across enterprise workstations via Group Policy Object (GPO).

Immunizing USB Flash Drives Against Future Shortcut Infections

Solution:

Root Cause: Unrestricted Root Directory Write Access

Shortcut viruses infect clean USB drives by writing a malicious autorun.inf file and creating fake shortcut links on the root volume directory. Creating a write-locked dummy folder named autorun.inf blocks malware from dropping its execution trigger.

# Diagnostic Verification:

Verify whether your USB volume allows setting system attributes on root container objects.

# Step-by-Step Fix:

1. Open Command Prompt as Administrator and switch to your USB drive letter (X:).
2. Delete any existing autorun.inf file:

cmd
del /f /q /a X:\autorun.inf

3. Create a dummy directory named autorun.inf on the root of the USB volume:

cmd
mkdir X:\autorun.inf

4. Create an un-deletable reserved device directory inside the dummy folder:

cmd
mkdir X:\autorun.inf\con\

5. Apply Read-Only, System, and Hidden attributes to the autorun.inf folder:

cmd
attrib +s +r +h X:\autorun.inf

6. Test: Future shortcut viruses attempting to write an autorun.inf file to X:\ will fail because a locked system directory with the exact same name already exists.

# Prevention & Long-Term Monitoring:

Perform this immunization procedure on all clean USB flash drives before using them on shared or public computers.

Related Diagnostic Guides

Windows Credential Guard Blocking App: Exclusion Guide

Browser Extensions Stealing Data: Audit and Remove

Google Account Suspicious Activity: Device Check

Microsoft Account Hacked: Lockdown and Recovery Steps

Notion Offline Mode Data Lost: Version History & Cache Recovery Guide

Subscribe to StepDiag

Embed Guide on Your Website