How to Remove Shortcut Virus from USB, Pen Drive, SD Card, Hard Drive

Roxanne updated on Dec 11, 2020 to File Recovery | How-to Articles

When the shortcut virus infects a device, all saved files would become inaccessible. To access your files, you can remove the shortcut virus from your USB drive, pen drive, or SD card using cmd, shortcut virus removal tool and other manual methods. If the virus or removal process resulted in some data loss, you can get your files back with EaseUS data recovery software.

how to remove shortcut virus from pendrive

How to remove shortcut virus from pen drive:

1. Go to Start and search for cmd. Right-click on cmd and click on "Run as administrator.

2. Navigate to you pen drive by typing drive letter, type E: and hit Enter. (Replace E: with the drive letter of your USB, pen drive.)

3. Type "del *. lnk "and hit Enter on your keyboard.

4. Now type "attrib -s -r -h *. * /s /d /l" and hit enter.

This page includes the complete solutions to remove shortcut virus from USB, SD card, pen drive, and even computer hard drive without losing data. 

Workable Solutions Step-by-step Troubleshooting
Fix 1. Use Attrib CMD  Enable the firewall on Windows PC >turn on Virus & threat protection in Windows Defender...Full steps
Fix 2. Create BAT file  Connect your external hard drive to PC. Click on "Search". Type: Command Prompt...Full steps
Fix 3. Delete Suspicious keys Press Windows + R keys, type regedit and hit Enter. Open Registry Editor and go to HKEY_...Full steps
Fix 4. Use virus removal tool You'll see a list of recommended tools that are can help you remove shortcut virus from your USB...Full steps

As you know that once a storage device gets infected by a shortcut virus, all existing files will be removed and replaced by .lnk shortcut files with the same original names. 

Most people don't even know what to do with their storage devices when the virus took over their devices. If your devices and files are infected with shortcut virus, read on and find the best way to retrieve your files and storage device.

How Does Shortcut Virus Spreads

Shortcut virus is more like a virus program that hibernates an autorun.inf worm on your computer and it autoruns in the background. As a result, the existing files on infected devices become inaccessible, hidden or encrypted into shortcuts with .lnk extension.

Here is the working pattern of shortcut virus that we concluded based on the explanations provided by many bloggers and geeks:

Affected Devices: Computer - PC/Laptops hard drive,  USB, pen drive, SD card, camera, cellphone, etc. 

Spread Path: Shortcut Virus worm infect Computer > Infect USB, etc. (external storage devices) > Infects Saved Files and Data (hide or encrypt them, create shortcut files)

Spread mode of shortcut virus. 

So how to get rid of the virus and bring all lost files back? Continue reading, you'll find the best solutions to resolve this issue.

Part 1. Clear Shortcut Virus on Source PC

According to the former part, you've understood that most viruses spread from computer to storage devices. To fully get rid of the shortcut virus, we highly recommend you to follow guidelines here to get rid of the existing shortcut virus on your source PC first.

  • 1. Stop using the USB drive, pen drive, SD card, memory card or hard drive on your PC

The reason is that when the device gets infected, continuous usage of the infected device will only spread the virus to more devices, causing more file loss.

Therefore, you should stop using infected devices and unplug all external storage devices.

  • 2. Clean up existing shortcut virus or malware on your computer

As you know that the virus on your external storage devices can be all traced from your PC. As a result, cutting the source of virus is the key point.

Here are some tips that you can follow to remove shortcut virus from Windows 10 PC: (steps on other Windows OS may be a tiny different)

Step 1.  Enable the firewall on Windows PC

  • Open Control Panel > click "Windows Defender Firewall" > Turn Windows Defender Firewall on or off.

Open Windows firewall.

  • Check the boxes of "Turn on Windows Defender Firewall"  and click "OK" to confirm.

Turn on firewall

Step 2. Turn on Virus & threat protection in Windows Defender Security Center

  • Right-click Windows icon and select "Settings" > Click "Update and Security".
  • On the Windows Security section, click "Open Windows Defender Security Center".

Open Windows Defender.

  • Click "Virus & threat protection" on the new window > Go to Virus & threat protection settings.
  • Turn on these three options: Real-time protection, Cloud-delivered protection, and Automatic sample submission.

Turn on Windows Denfender.

Note: Do as Windows Defender Security Center requests if the virus is detected after turning on the Virus & threat protection feature. By doing so, it will remove all detected virus and malware.

Step 3. Run antivirus software to clear the hidden virus, malware, etc.

After this, you can follow solutions in the next part to permanently remove shortcut virus from your USB, pen drive, SD card or memory card, etc.

Part 2. Permanently Remove Shortcut Virus from USB, Pen Drive

The solutions in this part are mainly provided by professional editors on geek websites like and bloggers on tech forums like All solutions are tested and practical. 

Hope the following tricks indeed work on resolving your case:

Method 1. Use Attrib CMD (1st Recommended)

One of the top recommended methods to remove shortcut virus is to use attrib command. 

Be careful when using cmd. If you are not sure how to operate the command line, only enter commands from trusted sources. Improper use of cmd can result in serious damage to your system.

Here are the detail steps:

Step 1. Connect your external hard drive to PC and right-click on "Start", select "Search".

Step 2. Type: Command Prompt in the Search box and click Command Prompt to bring it up.

Sign in with your administrator account and password if the system asks.

Step 3. Type: E: and hit Enter. (Replace E: with the drive letter of your USB, pen drive.)

Step 4. Type: del *.lnk or del autorun.inf and hit Enter.

Step 5. Type: attrib -h - r -s  /s /d E:\*.* and hit Enter. (Replace E: with the drive letter of your infected device).

Click to copy

Tip: If this didn’t work, you are likely infected by another virus. Replace the autorun.inf with another virus extension such as *.exe to delete these suspicious viruses. 

Method 2. Create BAT File (Similar to Attrib Command)

By creating a BAT file, you can simply run the BAT file and use it to clear and remove the existing shortcut virus with below steps:

Step 1. Connect your USB, pen drive or SD card to your PC and create a new notepad on the desktop.

Step 2. Copy and save the below code in the new notepad:

Click to copy

Note: Replace G: with the drive letter of your current infected storage device.

Step 3. Change the file extension of the notepad to .bat and save it on your desktop.

Step 4.  Double-click the .bat file on your desktop and wait for the process to finish.

By now, you should have successfully removed the shortcut virus from your USB flash drive, pen drive, or SD card using cmd.

Method 3. Delete Suspicious Keys in Registry Editor

You should know that this method is more like to thoroughly remove suspicious keys that may be related to the shortcut virus and from your PC.

Deleting wrong keys in the Registry Editor may cause serious results, including malfunction issues in programs or part of computer features. 
Be aware of the operations below while following to delete suspicious keys on your PC.

Step 1. Press Windows + R keys, type: regedit and hit Enter.

Step 2. Open Registry Editor and go to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run.

Step3. Find the suspicious keys like odwcamszasWXXKYzZGFYszaas, OUzzckky and delete them.

Delete Registry keys to remove shortcut virus.

Method 4. Use Shortcut Virus Removal Tools, Software

When you search shortcut virus removal tool or virus removal software online, a tremendous searching result display on your browser. 

Here, you'll see a list of recommended tools that are can help you remove shortcut virus from your USB, SD card or other storage devices:

  • Shortcut Virus Remover
  • USB Shortcut Virus Remover
  • USBFix Free
  • USB Virus Remover
  • Shortcut Virus Fixer

You can select one of the listed tools and apply them to remove and clean up the virus from your storage device then.

All the above-provided methods can release your storage devices and files from the shortcut virus infection.
When the virus removal process accomplishes, you can reopen your storage devices to check the saved data.
If you can't see the files or lost part of data on your device, refer to the next Part to get a complete data recovery solution. 

Part 3. Recover Data After Removing Shortcut Virus [IMPORTANT]

Some of you may have noticed that using cmd, deleting the Registry key or virus removal, somehow, can result in minor data loss. In case of further problems, we recommend you to check your device if any files are missing after the shortcut virus removal process.

If yes, and some essential files are missing, don't worry. Automated data recovery software can scan your device and locate deleted files. 

EaseUS file recovery software - Data Recovery Wizard scans deep into the data blocks of your storage device and locates any recoverable files that were lost due to deletion, formatting, or other errors.

After the scanning, you'll be able to view all recoverable files and restore them with a few simple clicks:

Step 1. Launch EaseUS Data Recovery Wizard. Select the disk partition or storage device where you lost files and click the "Scan" button.

select a location and click scan

Step 2. This program will quickly start a scanning process to find lost files. When the process accomplishes, you can double-click files to have a preview before selection.

scan deleted files

Step 3. Choose the files you want. Then click the "Recover" button to get them back. You should save the data to another safe spot in your PC/storage device, not where they lost.

Restore lost data from drive which was infected by virus

To sum up, this page includes the complete solutions of helping you completely remove and clean up shortcut virus from your PC and external storage devices. 

  • CMD, BAT file, deleting Registry keys, and virus removal software are all applicable ways for resolving this issue.
  • Automated file recovery software like EaseUS Data Recovery Wizard is the best choice to bring all missing files due to virus removal. 
  • Always keep in mind that the best way to protect your data and storage devices from virus infection is to run virus cleaner software to clean your device regularly.
  • Creating a backup of valuable data and save to another storage device can also save you from a disaster.

Was This Page Helpful?


Frequently Asked Questions

1. Why choose EaseUS Data Recovery Wizard?

"EaseUS Data Recovery Wizard is the best we've seen. It's far from perfect, partly because today's advanced disk technology makes data-recovery more difficult than it was with the simpler technology of the past, but it's fast and efficient..."PCMag

"The first thing you'll notice about EaseUS Data Recovery Wizard Pro is that its interface is very clear and uncluttered, with only a small collection of self-explanatory controls. You won't find lots of extra options hidden in a system of hidden menus, either; what you see really is what you get."techradar

"Recover lost files, even after deleting a partition or formatting your drive."Macworld

2. Why cannot I recover 2GB data for free?

It is recommended to check the version installed is Free or Trial because they are different versions.

Trial has data preview function but cannot save any files, while the Free version enables to recover 2 GB files. The default free space is 500 MB and you may share the product on social media to get another 1.5 GB.

3. Why cannot the recovered files be opened?

A file is saved as 2 parts on the storage device: directory info (which is comprised by file name, time stamp and size info, etc.) and data content.

If the files with original file names and folder structures cannot be opened, one possible reason is the corrupted directory info. There is still a chance to recover the data content with the RAW Recovery method in our software.

4. Why isn't it suggested to recover the files back to the original drive?

The storage structure of the lost files would be altered or damaged by any changes on the drive. If you save the recovered files back to the same drive, the original data structures and data content would be corrupted or overwritten, which causes permanent data loss. So you should prepare another disk to save the files.

5. How can I check whether my data is recoverable or not before purchase?

The Free version helps you save 2GB files, so verify the recovery quality of our product before purchase.

6. How long does it take to scan the drive?

It strongly depends on the capacity of your hard drive and the performance of your computer. As reference,most drive recoveries can be completed in around 10 to 12 hours for a 1-TB healthy hard drive in general conditions.

About Data Recovery Wizard

It's super easy to recover 250+ types of files after deletion, disk formatting and virus infection. Click the links and compare the difference of each version.