This page includes the complete solutions to remove shortcut virus from USB, pen drive, external hard drive, and PC without losing data.
|Workable Solutions||Step-by-step Troubleshooting|
|Fix 1. Shortcut virus remover cmd||Use attrib cmd to clear shortcut virus. Connect your USB to your PC. Click on "Search", type cmd...Full steps|
|Fix 2. Create BAT file to remove shortcut virus||You can simply run the BAT file and use it to clear shortcut virus from a pen drive or USB...Full steps|
|Fix 3. Use USB shortcut virus remover||You'll see a list of recommended tools that are can help you remove shortcut virus from your USB...Full steps|
|Fix 4. Remove Shortcut Virus on PC||Enable the firewall on Windows PC >turn on Virus & threat protection in Windows Defender...Full steps|
|Fix 5. Delete Suspicious keys to remove virus||Press Windows + R keys, type regedit, and hit Enter. Open Registry Editor and go to HKEY_...Full steps|
|Recover Lost Files due to Virus||If data loss occurs in the process of virus removal, use data recovery software to restore files...Full steps|
What Is Shortcut Virus
Shortcut virus, also known as 1kb shortcut virus, is a common Trojan virus that spreads widely using a USB drive or pen drive as a medium. The virus will hide all the folders on the root directory of the USB, and then create a shortcut with the same name as the folder. These shortcut files end with .EXE, .VBS. LNK or .INI suffixes and cannot be cleaned up. After the user clicks on the shortcut, it will run the virus and add it to start automatically.
How Does Shortcut Virus Spread
Shortcut virus is more like a virus program that hibernates an autorun.inf worm on your computer and it autoruns in the background. As a result, the existing files on infected devices become inaccessible, hidden, or encrypted into shortcuts with .lnk extension.
Here is the working pattern of shortcut virus that we concluded based on the explanations provided by many bloggers and geeks:
Affected devices: PC, laptop, USB, pen drive, SD card, external hard drive, camera, cellphone, etc.
Spread path: Shortcut virus worm infect computer > infect USB, pen drive, etc. (external hard drive) > infect saved files and data (hide or encrypt them, create shortcut files)
So how to remove shortcut virus from USB or pen drive and bring all lost files back? Continue reading, you'll find five solutions to remove shortcuts virus by using cmd, .bat files, shortcut virus remover, clearing shortcut virus on PC, as well as deleting suspicious keys in Registry Editor.
These solutions for USB shortcut virus removal in this tutorial are mainly provided by professional editors on geek websites like makeuseof.com and bloggers on tech forums like quora.com. All solutions are tested and practical. Hope the following tricks indeed work on resolving your case.
Method 1. Shortcut Virus Remover CMD
One of the top recommended methods to remove shortcut viruses from pen drives or USB flash drives is to use the attrib command.
- Be careful when using cmd. If you are not sure how to operate the command line, only enter commands from trusted sources. Improper use of cmd can result in serious damage to your system.
Here are the detailed steps:
Step 1. Connect your external hard drive to PC and right-click on "Start", select "Search".
Step 2. Type Command Prompt in the Search box and click Command Prompt to bring it up.
Sign in with your administrator account and password if the system asks.
Step 3. Type: E: and hit Enter. (Replace E: with the drive letter of your USB, pen drive.)
Step 4. Type: del *.lnk or del autorun.inf and hit Enter.
Step 5. Type: attrib -h - r -s /s /d E:\*.* and hit Enter. (Replace E: with the drive letter of your infected device).
Tip: If this didn't work, you are likely infected by another virus. Replace the autorun.inf with another virus extension such as *.exe to delete these suspicious viruses.
Method 2. Create BAT File to Remove Shortcut Virus from USB
By creating a BAT file, you can simply run the BAT file and use it to clear and remove the existing shortcut virus with the below steps:
Step 1. Connect your USB, pen drive, or SD card to your PC and create a new notepad on the desktop.
Step 2. Copy and save the below code in the new notepad:
- del *.lnk
- attrib -s -r -h G:\*.* /s /d /l
Note: Replace G: with the drive letter of your current infected storage device.
Step 3. Change the file extension of the notepad to .bat and save it on your desktop.
Step 4. Double-click the .bat file on your desktop and wait for the process to finish.
By now, you should have successfully removed the shortcut virus from your USB flash drive, pen drive, or SD card using cmd.
Method 3. Use Antivirus - USB Shortcut Virus Remover
When you search shortcut virus removal tool or virus removal software online, a tremendous search result is displayed on your browser.
Here, you'll see a list of recommended tools that are can help you remove shortcut virus from your USB, SD card, or other storage devices：
- Shortcut Virus Remover
- USB Shortcut Virus Remover
- USBFix Free
- USB Virus Remover
- Shortcut Virus Fixer
You can select one of the listed tools and apply them to remove and clean up the virus from your storage device then.
- All the above-provided methods can release your storage devices and files from the shortcut virus infection.
- When the virus removal process accomplishes, you can reopen your storage devices to check the saved data.
- If you can't see the files or lost part of data on your device, refer to the next Part to get a complete data recovery solution.
Method 4. Remove Shortcut Virus on Source PC
According to the former part, you've understood that most viruses spread from computers to storage devices. To fully get rid of the shortcut virus, we highly recommend you follow the guidelines here to get rid of the existing shortcut virus on your source PC first.
- 1. Stop using the USB drive, pen drive, SD card, memory card, or hard drive on your PC
The reason is that when the device gets infected, continuous usage of the infected device will only spread the virus to more devices, causing more file loss.
Therefore, you should stop using infected devices and unplug all external storage devices.
- 2. Clean up existing shortcut virus or malware on your computer
As you know that the virus on your external storage devices can be all traced from your PC. As a result, cutting the source of virus is the key point.
Here are some tips that you can follow to remove shortcut virus from Windows 10 PC: (steps on other Windows OS may be a tiny different)
Step 1. Enable the firewall on Windows PC
- Open Control Panel > click "Windows Defender Firewall" > Turn Windows Defender Firewall on or off.
- Check the boxes of "Turn on Windows Defender Firewall" and click "OK" to confirm.
Step 2. Turn on Virus & threat protection in Windows Defender Security Center
- Right-click Windows icon and select "Settings" > Click "Update and Security".
- On the Windows Security section, click "Open Windows Defender Security Center".
- Click "Virus & threat protection" on the new window > Go to Virus & threat protection settings.
- Turn on these three options: Real-time protection, Cloud-delivered protection, and Automatic sample submission.
Note: Do as Windows Defender Security Center requests if the virus is detected after turning on the Virus & threat protection feature. By doing so, it will remove all detected virus and malware.
Step 3. Run antivirus software to clear the hidden virus, malware, etc.
After this, you can follow solutions in the next part to permanently remove shortcut virus from your USB, pen drive, SD card or memory card, etc.
Method 5. Delete Suspicious Keys in Registry Editor to Remove Shortcut Virus from USB/Pen Drive
You should know that this method is more like to thoroughly remove suspicious keys that may be related to the shortcut virus and from your PC.
- Deleting wrong keys in the Registry Editor may cause serious results, including malfunction issues in programs or part of computer features.
- Be aware of the operations below while following to delete suspicious keys on your PC.
Step 1. Press Windows + R keys, type: regedit, and hit Enter.
Step 2. Open Registry Editor and go to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run.
Step 3. Find the suspicious keys like odwcamszas, WXXKYz, ZGFYszaas, OUzzckky and delete them.
Bonus Tip: Recover Data After Removing Shortcut Virus [IMPORTANT]
Some of you may have noticed that using cmd shortcut virus remover, somehow, can result in minor data loss. In case of further problems, we recommend you check your device if any files are missing after the shortcut virus removal process.
If some essential files are missing, don't worry. EaseUS Data Recovery Wizard can scan your device and locate deleted files. This reliable data recovery software can recover deleted files from Recycle Bin or recover data from virus/malware attacks, accidental deletion, hard drive formatting/corrupting, partition loss, and more.
Check our video tutorial to recover data:
After the scanning, you'll be able to view all recoverable files and restore them with a few simple clicks:
Step 1. Select the virus infected drive to scan
Run EaseUS virus file recovery software on your Windows PC. Select the disk attacked by the virus to scan for lost or hidden files. Note that:
- If it's an HDD where files were hidden or deleted by virus, it's better to install the software on a different volume or an external USB drive to avoid data overwriting.
- If the infected device is an external hard drive, flash drive or memory card, it doesn't matter to install the software on the local drive of the computer.
Step 2. Check all scanned results
EaseUS Data Recovery Wizard will immediately start a scan process to find your deleted or hidden files on the virus infected hard drive. To quickly locate the wanted files, you can use the Filter or type grouping feature to display only the pictures, videos, documents, emails, etc.
Step 3. Preview and recover deleted/hidden files
When the process finishes, you can preview the scanned files. Select the files you want and click the "Recover" button. You should save restored files to another secure location on your computer or storage device, not where they were lost.
How to Prevent USB, Pen Drive, or PC from Getting Infected with Shortcut Virus
As we all know, prevention is better than cure. Make sure you have full protection to avoid shortcut viruses or other viruses infecting your storage devices.
- Regularly remove viruses from USB, pen drive, SD card, external hard drive, PC, or laptop.
- Ensure your antivirus software and firewalls are up to date.
- Be sure to scan any removable disk before opening it.
- Creating a backup of valuable data and save to another storage device can also save you from a disaster.
To sum up, this page includes the complete solutions to help you completely clean up and remove shortcut virus from USB, pen drive, external hard drive, and PC. CMD, BAT file, deleting Registry keys, and virus removal software are all applicable ways to fix shortcut virus issue.
Moreover, we still introduce automated file recovery software like EaseUS Data Recovery Wizard to help you bring all missing files due to virus removal.
Shortcut Virus Remover CMD FAQs
If you also have any of the following frequently asked questions about shortcut virus remover, find solutions here.
How to remove shortcut virus from pendrive?
Pen drive shortcut virus remover CMD:
Step 1. Press Windows + R key to start the Run box. Type CMD and press Enter.
Step 2. Type the pen drive letter, such as G: and press Enter.
Step 3. Type ATTRIBUTE -H -R -S AUTORUN.
Step 4. Type DEL AUTORUN.
How to remove shortcut virus from USB without data loss?
Run Command Prompt as administrator. Type ATTRIBUTE -H -R -S AUTORUN. INF to remove shortcut virus from USB without data loss.
How to remove shortcut virus from external hard drive?
Run Command Prompt, After navigating to the infected drive, type del *. lnk command and press Enter to delete all the shortcuts from external hard drive. Then, type attrib -s -r -h /s /d * to restore the files hidden by the shortcut virus.
How can I delete virus using CMD?
Step 1. In the search bar, search for CMD. Right-click on Command Prompt and choose Run as an administrator.
Step 2. Type E: and press Enter. ( E: is the drive letter)
Step 3. Type attrib -s -h -r -a /s /d * and del autorun.inf in order.
Was This Page Helpful?
Cedric Grantham is one of the senior editors and data recovery specialists of EaseUS who lives and works in Chengdu, China. He mainly writes articles and how-to tips about data recovery tutorials on PC and Mac. He has handled 10,000+ data recovery cases and is mainly good at data recovery of NTFS, FAT (FAT32 and ExFAT) file systems, and RAID structure reorganization of RAID 0, 5, and 10.
Tracy joined in EaseUS in 2013 and has been working with EaseUS content team for over 10 years. Being enthusiastic in computing and technology, she writes tech how-to articles and share technical solutions to resolve Windows & Mac data recovery, data backup, partition management, data transfer, Windows update issues, etc.
Tracy King/Jul 20, 2023
Brithny/Jul 20, 2023
Jean/Jul 20, 2023
Tracy King/Jul 20, 2023