USB Folders Turned Into EXE Files? Fix & Restore

If your USB drive’s folders have turned into EXE files, your drive is almost certainly infected with a widespread type of malware that hides real folders and replaces them with malicious executable files. The fix is to remove the infection, then reveal and restore your original folders using the Command Prompt or a dedicated cleanup tool.

What Causes Folders to Become EXE Files

This is not a Windows setting or a file system error. It is the result of a specific family of malware, often called a folder worm or shortcut virus. The worm copies itself onto any removable drive it can reach, then performs two actions:

• It sets the Hidden attribute on all your real folders.
• It creates an EXE file with the same name as each folder (e.g., Photos.exe instead of Photos).

When you double-click that EXE, you launch the malware again, which can infect your PC and continue spreading to other drives. The original folders are usually still on the drive, just hidden. This is why the fix focuses on unhiding them and deleting the fake EXE files.

How to Tell If It’s Really a Virus

Before taking action, confirm that the EXE files are malicious. A few signs:

• Your folders are gone and replaced by files ending in .exe.
• The EXE file has the same name as a folder you had on the drive.
• Your antivirus software flags the EXE as a trojan or worm.
• The drive’s file system is still intact (you can open the drive normally).

If you see EXE files that you did not create and cannot explain, treat them as dangerous. Do not double-click them.

Step-by-Step: Remove the Infection and Restore Your Folders

Perform these steps on a Windows PC. You will need to see hidden files first.

1. Enable hidden files: In File Explorer, go to View > Options > Change folder and search options. In the View tab, select Show hidden files, folders, and drives and uncheck Hide protected operating system files (confirm the warning).
2. Open Command Prompt as administrator: Press Win+R, type cmd, and press Ctrl+Shift+Enter.
3. Navigate to your USB drive: Type the drive letter followed by a colon (e.g., E:) and press Enter.
4. Remove hidden and system attributes from all folders: Run this command:
   attrib -h -s -r /s /d *.*
   This clears Hidden, System, and Read-Only attributes from every file and folder on the drive.
5. Delete the malicious EXE files: After running the command, you should see your original folders. Now delete any .exe files that have the same names as those folders. You can select them and press Shift+Delete to permanently remove them.
6. Run a full antivirus scan on the USB drive and your computer to ensure no other copies of the worm remain.

If the attrib command does not restore your folders, the malware may have actually deleted them. In that case, you may need to use file recovery software, but that is less common.

What to Do If the Attrib Command Doesn’t Work

Sometimes the worm is more aggressive or has already deleted the original folders. If after running attrib you still see no folders, try these alternatives:

• Use a dedicated USB cleaner tool – many well-known security vendors offer free tools that specifically remove shortcut and folder worms.
• Check the drive’s properties – if the drive was previously used, look at the used space. If it still shows a lot of used space, your files are likely still there but hidden in a way that attrib missed.
• Try a different PC – the worm may be re-infecting the drive every time you plug it into the same computer. Use a clean, updated system.

If the drive shows low used space or the folders are truly gone, you may need to use file recovery software that can scan for deleted data. However, this is a last resort.

How to Prevent This From Happening Again

Prevention is straightforward:

• Keep Windows and your antivirus updated.
• Enable “Show file extensionsâ€� in File Explorer so you can spot suspicious .exe files.
• Disable AutoRun for removable drives (Windows does this by default in recent versions).
• Do not plug your USB drive into public computers (school, library, print shops) without scanning it afterward.
• Back up important data regularly to a secure location.

Common Misconception: “It’s Just a Windows Setting�

Some users think the EXE files are a normal Windows feature or a file association problem. This is false. Windows never turns folders into EXE files. If you see an EXE with the same name as your folder, it is always malware. Changing file associations or renaming the EXE to a folder name will not fix the underlying infection and may make things worse.

Frequently Asked Questions

Can I recover my folders without losing data?

Yes, in most cases. The original folders are hidden, not deleted. The attrib command unhides them. If the malware did delete them, you may need recovery software, but that’s less common.

Is it safe to just delete the EXE files?

Deleting the EXE files is safe and necessary, but you must also unhide your folders first. If you delete the EXE without unhiding, you’ll lose the folder names and might not see your data.

Why does my antivirus not detect it?

Some worms are new or polymorphic, meaning they change their code to avoid detection. Also, the infection may have occurred before your antivirus was installed or updated. Running a full scan after cleaning is recommended.

Can I use my USB drive after cleaning?

Yes, after you delete the EXE files and run a full scan, the drive should be safe to use. However, if the infection came from a specific computer, avoid plugging the drive back into that machine until it is cleaned.

Will this affect my files?

No, the attrib command only changes file attributes; it does not modify file content. Your photos, documents, and other data remain intact.

Related

• Grow a Garden Carrot Coins?
• AFM Tip Measurements: Cantilever Motion to Surface Data
• Br1 Infinite Pays Real Money for Kills? The Catch