USB Drive Files Turned Into Shortcuts? Fix It
If your files on a USB drive have turned into shortcuts that won’t open, the drive is almost certainly infected with malware that has hidden your real files and replaced them with shortcut links. This guide explains what causes the problem, how to recover your data safely, and how to prevent it from happening again.
What Causes Files to Become Shortcuts
The shortcut phenomenon is a classic symptom of a specific type of malware, often called a “shortcut virus” or “USB worm.” It spreads through removable drives and network shares. When you plug an infected drive into a computer, the malware copies itself to the drive and then performs two actions:
- It hides all your original files and folders by setting their attributes to Hidden and System.
- It creates a shortcut (.lnk) file that has the same name as your original file or folder, but points to the malware executable.
When you double-click the shortcut, you don’t open your file; you run the malware, which then infects the current computer and any other drive connected to it. Your actual data is still on the drive, just hidden and not deleted.
How the Malware Works
Most shortcut viruses are written in scripting languages like VBS (VBScript) or PowerShell. The malware typically creates an autorun.inf file (though modern Windows disables autorun by default) and a copy of itself, often with a name like svchost.exe or msiexec.exe to look like a legitimate system process. The shortcuts it creates have names that match your folders (e.g., Documents.lnk) so you are likely to click them.
The hidden attribute is set using the Windows attrib command with the +h +s flags. This is why you may see the drive appear mostly empty even though the properties show space is used. The malware also often disables the “Show hidden files” option in Folder Options, making it harder for you to discover the hidden data manually.
How to Recover Your Files Safely
Before you do anything, stop using the USB drive and disconnect it from the computer. If you have another computer that you trust, use that one for recovery. The safest method is to use a dedicated malware removal tool that is designed to disinfect USB drives. Many reputable antivirus vendors offer free USB repair tools. These tools will:
- Scan the drive and remove the malicious .lnk files and the malware executable.
- Restore the hidden and system attributes on your real files and folders.
- Leave your data intact.
If you prefer to do it manually, you can open Command Prompt as administrator and type the following command, replacing E: with your drive letter:
attrib -h -s -r /s /d E:\*.*
This command removes the Hidden, System, and Read-Only attributes from all files and folders on the drive. After that, you should delete all .lnk files and the suspicious executable. However, manual removal is risky if you do not know exactly which files are malicious, so using a trusted antivirus scanner is strongly recommended.
What to Do If the Shortcuts Won’t Delete
Sometimes the shortcuts are stubborn because the malware is still running in memory on your computer. In that case, boot your computer into Safe Mode (with Networking if you need internet access) and then run the scan. Safe Mode loads only the essential drivers and services, which usually prevents the malware from starting. After the scan, restart normally and check the drive.
If the drive still shows shortcuts, try using a different USB port or a different computer. The drive itself may be failing, but the shortcut issue is almost always malware, not hardware failure.
How to Prevent It in the Future
Prevention is largely about safe habits and keeping your system patched:
- Enable “Show hidden files” in Windows (View tab in File Explorer) so you can spot hidden folders.
- Disable the autorun feature for removable drives (it is disabled by default in modern Windows, but verify in Group Policy or Control Panel).
- Do not double-click shortcuts on USB drives that you did not create yourself.
- Keep your antivirus software updated and run a full scan on any USB drive before opening files.
- Use a USB drive with a physical write-protect switch if you only need to read data from it.
Common Misconceptions
One common belief is that the files are actually deleted and gone forever. That is false in the vast majority of cases. The malware hides them, not deletes them. Another misconception is that formatting the drive is the only solution. Formatting will remove the malware, but it will also erase your data. Only format as a last resort after you have tried recovery tools and confirmed the data is not recoverable.
Also, some people think that simply changing the file extension from .lnk to .docx will restore the file. That does not work because the shortcut is a separate file that points to the malware, not to your original document. The original document is still hidden on the drive.
Frequently Asked Questions
Will my files be lost if I delete the shortcuts?
No, the shortcuts are not your files. They are small pointer files that malware created. Deleting them does not delete your original data. Your original files are hidden on the same drive and can be unhidden with the attribute removal command or a recovery tool.
Can I recover files from a shortcut-infected USB drive on a Mac?
Yes, but you need to be careful. The malware is designed for Windows, so it may not run on macOS, but it can still hide files. You can connect the drive to a Mac and use Finder’s “Show All Files” option or use the Terminal command chflags nohidden on the drive’s contents. However, the hidden attribute is a Windows attribute, so macOS may not see it as hidden. The simplest approach is to use a Windows computer with antivirus software.
How do I know if my USB drive is infected?
If you see shortcuts with names that match your folders or files, and the drive appears otherwise empty, it is almost certainly infected. Other signs include a sudden increase in the drive’s used space (due to the malware copy) or the appearance of new files you did not create, like autorun.inf or svchost.exe.
Can I use a smartphone to recover the files?
Yes, many Android phones can read USB drives via an OTG adapter. Since the malware is Windows-based, it will not run on Android, and the hidden files may be visible through a file manager app that shows hidden files. This is a useful alternative if you do not have a Windows computer available. However, be aware that some file managers do not show hidden files by default, so you may need to enable that option.
Is it safe to plug the infected USB drive into another computer?
It is not safe unless that computer has up-to-date antivirus software and you have disabled autorun. Even then, there is a risk. The safest practice is to use a dedicated USB repair tool on a quarantined computer that is not connected to your main network.
What if the drive is write-protected?
Some USB drives have a physical write-protect switch. If it is on, you cannot remove the malware or unhide files. Turn the switch off, then run the recovery steps. If the drive is write-protected due to a registry setting or a failing controller, you may need to use a different computer or a tool that can override the protection, but that is rare.
Related
Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.