USB Files Turned into Shortcuts: Scan Safely and Stop Reinfection

A familiar folder appears with a shortcut arrow, files seem to disappear, or the same strange items return after deletion. Malware can use removable media and deceptive shortcuts, but normal shortcuts and file-system problems also exist. Start with controlled investigation rather than downloading a one-click “shortcut virus fixer”.

What to Do Before Opening Anything Else

1. Stop using the suspicious shortcuts and do not run executables or scripts from the drive.
2. On a work computer, report the symptoms and follow IT’s isolation procedure. Do not move the drive between other office computers to test it.
3. Record what changed, where the drive was used and whether security software raised an alert.
4. Check whether a known-good backup of the important files exists.
5. Use a controlled scan workflow with current trusted security software, covering both the computer and the affected media.

A screenshot of an icon is insufficient to name a malware family. Preserve the security product’s detection report, including the detected object and action, rather than guessing the threat from the appearance of the folder.

A Shortcut Is a Pointer, Not the Original Document

A Windows .lnk file points to something else. In a malicious case it can launch a program or script while pretending to open a familiar folder. The original data may be hidden, moved, damaged or absent; its state needs checking. An ordinary shortcut is not automatically dangerous simply because it has an arrow.

ESET has documented USB propagation that abuses shortcuts in real malware investigations. That establishes a possible mechanism, not a diagnosis of this drive. Avoid the common leap from “my files look different” to a universal command that unhides or deletes everything.

Check Both Sides of the Connection

Update the security product and its detection modules through its supported process. A computer scan checks the host; a removable-media scan checks the selected USB drive. If the host remains compromised, cleaning only the drive can leave the reinfection source in place.

Current ESET products provide computer and removable-media scan controls, but the exact menus and available device controls differ by product and version. Select the actual removable drive in the supported custom-scan or removable-media workflow. Check the selected target carefully when several drives are connected.

Scans can clean, quarantine or delete detected objects according to their settings. Do not describe a scan as a guaranteed read-only recovery operation. When the only copy is business-critical, coordinate preservation and remediation with IT before accepting broad cleaning actions.

Read the Result Before Trying to Recover Files

Avoid wildcard delete commands, registry recipes and unknown batch files from search results. A command that changes file attributes does not prove that the host is clean, and a command that removes every shortcut can also remove legitimate items.

Choose Protection for the Actual Environment

A managed office needs a repeatable process for shared USB media, software updates, least-privilege accounts and reporting. Personal users need the same basic discipline at a smaller scale: scan before opening unfamiliar content and retain a separate backup.

Finish by verifying that the computer is clean, the media no longer recreates the symptom and the recovered documents open from a trusted location. Then replace any unsafe sharing habit. If the drive also reports storage errors, keep the data-preservation decision separate from the malware-cleanup process.

Frequently Asked Questions