How to Remove Shortcut Viruses from USB Drives on Windows

A USB stick that opens as a pile of shortcuts, while your photos and documents seem to have vanished, is a familiar Windows problem. Sometimes the files are still there and only hidden. Sometimes they really are gone. This guide shows how to tell those cases apart, how to avoid wiping the drive, and what Shortcut Virus Remover can and cannot do.

On the publisher’s site the program is named Shortcut Remover. Softcoria lists that same 8.0.0 Windows build under the catalog name Shortcut Virus Remover. It is a free local tool for inspecting .lnk files. It is not a full antivirus, and it does not promise to remove every kind of malware.

What a shortcut problem looks like

Windows shortcuts are ordinary .lnk files. A shortcut points at something else: a program, a folder, or a command. The publisher is explicit that a normal shortcut is not automatically malware.

The pattern people call a “shortcut virus” is narrower. You plug in a USB drive and File Explorer shows shortcut icons where your folders used to be. Double-clicking one may do nothing useful, or it may try to run a command. The original files are not in the normal view. The drive may also feel slower, or Windows Security may already have flagged a file on it.

Two mechanisms get mixed together in those reports:

• Files and folders are marked hidden, and sometimes system, so Explorer hides them.
• New shortcuts are placed in the visible folders, often using the names of the hidden items.

If both happened, unhiding the files can bring your data back, and removing the extra shortcuts stops you opening the wrong thing. If the files were deleted or encrypted, unhiding will not recreate them.

When it may not be malware

Check the boring explanations before you treat the stick as infected.

• You, or a backup tool, created shortcuts on purpose. A shortcut named Photos.lnk next to a real Photos folder is not the same as a folder that has been replaced.
• File Explorer is hiding protected operating-system files, or Hidden items is off, so a previous copy looks empty.
• The drive letter changed. Windows may call the stick E: today and F: tomorrow. Look at the volume name, not only the letter.
• The stick has a hardware fault. Clicking, a request to format, or files that copy as zero bytes is a disk problem, not a shortcut problem.

Open one shortcut’s properties only if you already trust the drive enough to inspect it. On the Shortcut tab, read Target. A target that is your own folder is less alarming than a target that runs cmd.exe or a strange program from the same USB stick. Do not launch that target while you are only trying to read it.

Prepare the drive before you change anything

Do not format the USB drive as a first step. Formatting removes the file table you may still need.

1. Unplug other removable disks so you cannot pick the wrong letter.
2. Note the USB drive’s letter and volume name in File Explorer.
3. If a few files still open, copy those to an internal disk or a second stick. Copy, do not move.
4. Avoid saving new files onto the suspect stick. New writes can overwrite data that is only hidden.
5. Leave Microsoft Defender and SmartScreen enabled. This job does not require turning protection off. The catalog’s Windows security basics explains why that stack stays on.

In Windows 11, show hidden items with View > Show > Hidden items. In Windows 10, use the View tab and tick Hidden items. Hidden files often appear faded. If your documents show up, copy them off before you delete any shortcut.

What Shortcut Virus Remover is confirmed to do

The official site, shortcutremover.com, describes a Windows 10 and Windows 11 tool for 64-bit PCs. The current package documented there is version 8.0.0, file Shortcut-Remover-8.0.0-Windows-x64-Setup.exe, a self-contained Inno Setup build. No separate .NET install is required. The publisher does not list a CPU, RAM, or disk minimum, so this guide does not invent one. A calendar release date is not published on the pages reviewed.

Confirmed behavior, in the publisher’s own terms:

• Quick and full scans, with counters for directories and files on the drive you select.
• Findings that show the shortcut target, arguments, risk signals, and a recommended action.
• Ordinary shortcuts are not automatically labeled malware.
• Quarantine of items you have reviewed, with history, before permanent deletion.
• Restore of hidden attributes on the selected drive. This only affects files that still exist.
• An optional Microsoft Defender verification when Defender is available.
• Scheduled scans and an allow list.

The scanner stays inside the resolved path and skips reparse points. It cannot recover deleted, overwritten, encrypted, or failed-drive data. A .lnk file by itself is not proof of infection.

The 8.0.0 installer is not code-signed. Windows may say the publisher is unknown. The site publishes a SHA-256 for that exact file instead of a signature. Treat the hash as the check, and read how to check a Windows program before you install it if you want the longer signature and SmartScreen walkthrough.

How to use the program

Softcoria does not host the installer. Use the labeled download on the Shortcut Virus Remover page only as a pointer, and get the file from the official download page.

1. Download Shortcut-Remover-8.0.0-Windows-x64-Setup.exe.
2. In PowerShell, from the download folder, hash it:

Get-FileHash .\Shortcut-Remover-8.0.0-Windows-x64-Setup.exe -Algorithm SHA256

The command prints a fingerprint of the bytes on disk. It does not run the installer. For the 8.0.0 x64 setup, the publisher’s page shows:

5F01CDDCC013DD1CAD3086BA67A5AA0E2C2989774E1854901165CE7760EBB834

Compare every character. If the hash differs, delete the file and download again. Do not click through SmartScreen to “see what happens.” More hash commands are in How to check file hashes.

1. Run the setup only after the hash matches. The publisher says 8.0.0 installs for the current user and does not need administrator rights.
2. Select the USB drive, not C:. Start with a scan and read each finding. Check the target and arguments before you quarantine anything.
3. Quarantine reviewed items first. Permanent deletion is a later choice, after you can still open your files.
4. If you use the hidden-attribute repair, run it against the USB letter you wrote down. Then copy the recovered files to another disk.
5. If Defender is available, the optional verification scan is a second opinion. It does not mean every other threat on the PC has been ruled out.

The installer’s screens are not reproduced here, because button labels beyond this workflow are not quoted from the documentation. If a finding is unclear, leave it in place and scan the drive with Windows Security before you delete it.

Check the drive with Windows Security

Open Windows Security > Virus & threat protection > Scan options. Choose Custom scan, pick the USB drive, and start the scan. Custom scan looks at the folder you select. It is not a promise that every infection is found, and a clean result does not prove the shortcuts were harmless.

Leave real-time protection on while you do this. If Windows quarantines a file, read the detection name before you restore it. Restoring a quarantined file puts it back on disk.

If files still do not appear

Hidden attributes are the case where a command can help, and also the case where a wrong drive letter does real damage. The attrib command changes file attributes. It does not delete files, and it does not undelete them.

After you have copied anything you can already see, open Terminal or PowerShell and run the following only with the USB letter. The example uses E:. Replace E: if your stick has another letter. Do not point this at C:.

attrib -h -s /s /d E:\*.*

• -h clears the hidden attribute.
• -s clears the system attribute.
• /s walks subfolders.
• /d includes folders, not only files.

The consequence is that hidden and system items on that drive become easier to see, including any that were hidden on purpose. It does not remove shortcut files. Delete shortcuts only after you can see, and copy, the real files.

If Explorer then offers to format the disk, cancel. A format request means Windows cannot read the file system. Formatting will not “finish the cleanup.”

If the files are still absent, stop writing to the stick. Shortcut Remover will not rebuild them. A separate recovery tool that works from a copy, or a repair shop, is the next decision. This guide does not recommend a particular recovery product.

Lower the chance of a repeat

• Keep Windows Security on, including on the PC that shares this USB stick with other people.
• Do not open unexpected shortcuts from a stick someone else handed you.
• When you are done, use Safely remove hardware before you pull the drive out.
• If the stick is passed around a school or office, scan it when it comes back, before you copy new work onto it.
• Prefer downloading tools from the publisher page you checked, not from a repack with a similar name. Other projects titled “shortcut virus remover” are different programs.

Mistakes that make this worse

• Formatting first. You lose the hidden files you had not copied.
• Disabling antivirus to “let the cleaner work.” The publisher does not ask you to do that.
• Running attrib against the wrong letter. You can unhide a large part of another disk, or miss the USB stick entirely.
• Deleting every .lnk file on the PC. The Start menu and desktop depend on shortcuts. Limit removal to the USB drive, and review targets first.
• Trusting an unsigned download because the name matches. Compare the SHA-256. A matching name with a different hash is a different file.
• Opening the shortcut to “test it.” If the target is a command, testing it is how the payload runs.

FAQ

Is every shortcut on a USB drive a virus?

No. Windows uses .lnk shortcuts for legitimate programs and folders. A problem is more likely when your own documents have been replaced by shortcuts and the original files are missing from the normal view.

Will Shortcut Virus Remover restore deleted files?

No. The publisher says visibility repair can only unhide files that still exist. It cannot recreate files that were deleted, overwritten, or encrypted.

Should I format the USB drive first?

No. Formatting erases the volume. Copy off anything you can still open, and only format after you have decided the remaining data is not worth recovering.

Does this replace Microsoft Defender?

No. Shortcut Remover is a shortcut inspector. It can request a Defender scan when Defender is available. Leave Windows Security turned on.

The installer says the publisher is unknown. Is that expected?

For the 8.0.0 build, yes. The publisher says the installer is not code-signed and that you should compare the published SHA-256 before you run it. An unknown-publisher warning is not a reason to disable SmartScreen.

The files are still missing after a scan. What next?

Show hidden items in File Explorer and confirm the drive letter before you change attributes. If the files are gone rather than hidden, stop and consider a copy-only recovery tool. Do not keep writing new files to that USB stick.

Related guides

• How to Safely Download and Install Software on Windows — the path from a labeled button to the first launch.
• How to Check if a Windows Program Is Safe Before Installing It — signatures, SmartScreen, and a local scan.
• How to check file hashes — Get-FileHash and certutil.
• Windows security basics — leave the built-in protections on.

Related software

• Shortcut Virus Remover — the Softcoria page for Shortcut Remover 8.0.0, including the published hash notes.
• Security software for Windows — other catalog listings. They do not replace the checks above.