Remove Shortcut Virus from USB Flash Drive

Is your device infected with the shortcut virus? Follow the step-by-step tutorial to remove shortcut virus from USB flash drive, pen drive, SD card, hard drive using cmd and shortcut virus removal tools, etc., without losing data.

 Download for Win Recovery Rate 99.7%
 Download for Mac Trustpilot Rating 4.7

Page Table of Contents

Updated By


Written By

Tracy King

Updated on

20 May 2024

Min Reading

9 Min

This page includes the complete solutions to remove shortcut virus from USB, pen drive, external hard drive, and PC without losing data. 

Workable Solutions Step-by-step Troubleshooting
Fix 1. Shortcut virus remover cmd Use attrib cmd to clear shortcut virus. Connect your USB to your PC. Click on "Search", type cmd...Full steps
Fix 2. Create BAT file to remove shortcut virus You can simply run the BAT file and use it to clear shortcut virus from a pen drive or USB...Full steps
Fix 3. Use USB shortcut virus remover You'll see a list of recommended tools that are can help you remove shortcut virus from your USB...Full steps
Fix 4. Remove Shortcut Virus on PC Enable the firewall on Windows PC >turn on Virus & threat protection in Windows Defender...Full steps
Fix 5. Delete Suspicious keys to remove virus Press Windows + R keys, type regedit, and hit Enter. Open Registry Editor and go to HKEY_...Full steps
Recover Lost Files due to Virus  If data loss occurs in the process of virus removal, use data recovery software to restore files...Full steps

What Is Shortcut Virus

Shortcut virus, also known as 1kb shortcut virus, is a common Trojan virus that spreads widely using a USB drive or pen drive as a medium. The virus will hide all the folders on the root directory of the USB, and then create a shortcut with the same name as the folder. These shortcut files end with .EXE, .VBS. LNK or .INI suffixes and cannot be cleaned up. After the user clicks on the shortcut, it will run the virus and add it to start automatically. 

How Does Shortcut Virus Spread

Shortcut virus is more like a virus program that hibernates an autorun.inf worm on your computer and it autoruns in the background. As a result, the existing files on infected devices become inaccessible, hidden, or encrypted into shortcuts with .lnk extension.

Here is the working pattern of shortcut virus that we concluded based on the explanations provided by many bloggers and geeks:

Affected devices: PC, laptop, USB, pen drive, SD card, external hard drive, camera, cellphone, etc. 

Spread path: Shortcut virus worm infect computer > infect USB, pen drive, etc. (external hard drive) > infect saved files and data (hide or encrypt them, create shortcut files)

Spread mode of shortcut virus.

So how to remove shortcut virus from USB or pen drive and bring all lost files back? Continue reading, you'll find five solutions to remove shortcuts virus by using cmd, .bat files, shortcut virus remover, clearing shortcut virus on PC, as well as deleting suspicious keys in Registry Editor.

These solutions for USB shortcut virus removal in this tutorial are mainly provided by professional editors on geek websites like and bloggers on tech forums like All solutions are tested and practical. Hope the following tricks indeed work on resolving your case.

Method 1. Shortcut Virus Remover CMD

One of the top recommended methods to remove shortcut viruses from pen drives or USB flash drives is to use the attrib command.

Be careful when using cmd. If you are not sure how to operate the command line, only enter commands from trusted sources. Improper use of cmd can result in serious damage to your system.

Here are the detailed steps:

Step 1. Connect your external hard drive to PC and right-click on "Start", select "Search".

Step 2. Type Command Prompt in the Search box and click Command Prompt to bring it up.

Sign in with your administrator account and password if the system asks.

Step 3. Type: E: and hit Enter. (Replace E: with the drive letter of your USB, pen drive.)

Step 4. Type: del *.lnk or del autorun.inf and hit Enter.

Step 5. Type: attrib -h - r -s  /s /d E:\*.* and hit Enter. (Replace E: with the drive letter of your infected device).

Tip: If this didn't work, you are likely infected by another virus. Replace the autorun.inf with another virus extension such as *.exe to delete these suspicious viruses.

Method 2. Create BAT File to Remove Shortcut Virus from USB

By creating a BAT file, you can simply run the BAT file and use it to clear and remove the existing shortcut virus with the below steps:

Step 1. Connect your USB, pen drive, or SD card to your PC and create a new notepad on the desktop.

Step 2. Copy and save the below code in the new notepad:

@echo off

  1. del *.lnk
  2. attrib -s -r -h G:\*.* /s /d /l

@echo complete

Note: Replace G: with the drive letter of your current infected storage device.

Step 3. Change the file extension of the notepad to .bat and save it on your desktop.

Step 4. Double-click the .bat file on your desktop and wait for the process to finish.

By now, you should have successfully removed the shortcut virus from your USB flash drive, pen drive, or SD card using cmd.

Method 3. Use Antivirus - USB Shortcut Virus Remover

When you search shortcut virus removal tool or virus removal software online, a tremendous search result is displayed on your browser. 

Here is the most recommended tool that is can help you remove shortcut viruses from your USB, SD card, or other storage devices:


TotalAV is an Award Winning Antivirus and Security Software. It Provides Real-Time Protection from Viruses, Malware & Online Threats.

Get Protected Now

Antivirus Protection Enabled

You can download the antivirus tool - TotalAV and apply it to remove and clean up the virus from your storage device.

All the above-provided methods can release your storage devices and files from the shortcut virus infection.
When the virus removal process accomplishes, you can reopen your storage devices to check the saved data.
If you can't see the files or lost part of data on your device, refer to the next Part to get a complete data recovery solution. 

Method 4. Remove Shortcut Virus on Source PC

According to the former part, you've understood that most viruses spread from computers to storage devices. To fully get rid of the shortcut virus, we highly recommend you follow the guidelines here to get rid of the existing shortcut virus on your source PC first.

  • 1. Stop using the USB drive, pen drive, SD card, memory card, or hard drive on your PC

The reason is that when the device gets infected, continuous usage of the infected device will only spread the virus to more devices, causing more file loss.

Therefore, you should stop using infected devices and unplug all external storage devices.

  • 2. Clean up existing shortcut virus or malware on your computer

As you know that the virus on your external storage devices can be all traced from your PC. As a result, cutting the source of virus is the key point.

Here are some tips that you can follow to remove shortcut virus from Windows 10 PC: (steps on other Windows OS may be a tiny different)

Step 1.  Enable the firewall on Windows PC

  • Open Control Panel > click "Windows Defender Firewall" > Turn Windows Defender Firewall on or off.

Open Windows firewall.

  • Check the boxes of "Turn on Windows Defender Firewall"  and click "OK" to confirm.

Turn on firewall

Step 2. Turn on Virus & threat protection in Windows Defender Security Center

  • Right-click Windows icon and select "Settings" > Click "Update and Security".
  • On the Windows Security section, click "Open Windows Defender Security Center".

Open Windows Defender.

  • Click "Virus & threat protection" on the new window > Go to Virus & threat protection settings.
  • Turn on these three options: Real-time protection, Cloud-delivered protection, and Automatic sample submission.

Turn on Windows Denfender.

Note: Do as Windows Defender Security Center requests if the virus is detected after turning on the Virus & threat protection feature. By doing so, it will remove all detected virus and malware.

Step 3. Run antivirus software to clear the hidden virus, malware, etc.

After this, you can follow solutions in the next part to permanently remove shortcut virus from your USB, pen drive, SD card or memory card, etc.

Method 5. Delete Suspicious Keys in Registry Editor to Remove Shortcut Virus from USB/Pen Drive

You should know that this method is more like to thoroughly remove suspicious keys that may be related to the shortcut virus and from your PC.

Deleting wrong keys in the Registry Editor may cause serious results, including malfunction issues in programs or part of computer features. 
Be aware of the operations below while following to delete suspicious keys on your PC.

Step 1. Press Windows + R keys, type: regedit, and hit Enter.

Step 2. Open Registry Editor and go to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run.

Step 3. Find the suspicious keys like odwcamszasWXXKYzZGFYszaas, OUzzckky and delete them.

Delete Registry keys to remove shortcut virus.

Bonus Tip: Recover Data After Removing Shortcut Virus [IMPORTANT]

Some of you may have noticed that using cmd shortcut virus remover, somehow, can result in minor data loss. In case of further problems, we recommend you check your device if any files are missing after the shortcut virus removal process.

If some essential files are missing, don't worry. EaseUS Data Recovery Wizard can scan your device and locate deleted files. This reliable data recovery software can recover deleted files from Recycle Bin or recover data from virus/malware attacks, accidental deletion, hard drive formatting/corrupting, partition loss, and more.  

Check our video tutorial to recover data:

(External) Hard Drive Not Showing Files Though They Still Exist - Fixed

After the scanning, you'll be able to view all recoverable files and restore them with a few simple clicks:

 Download for Win Recovery Rate 99.7%
 Download for Mac Trustpilot Rating 4.7

Step 1. Select the virus infected drive to scan

Run EaseUS virus file recovery software on your Windows PC. Select the disk attacked by the virus to scan for lost or hidden files. Note that:

  • If it's an HDD where files were hidden or deleted by virus, it's better to install the software on a different volume or an external USB drive to avoid data overwriting.
  • If the infected device is an external hard drive, flash drive or memory card, it doesn't matter to install the software on the local drive of the computer.
select a location to scan

Step 2. Check all scanned results

EaseUS Data Recovery Wizard will immediately start a scan process to find your deleted or hidden files on the virus infected hard drive. To quickly locate the wanted files, you can use the Filter or search box feature to display only the pictures, videos, documents, emails, etc.

filter deleted or hidden files

Step 3. Preview and recover deleted/hidden files

When the process finishes, you can preview the scanned files. Select the files you want and click the "Recover" button. You should save restored files to another secure location or Cloud drive, not where they were lost.

Restore virus infected files

How to Prevent USB, Pen Drive, or PC from Getting Infected with Shortcut Virus

As we all know, prevention is better than cure. Make sure you have full protection to avoid shortcut viruses or other viruses infecting your storage devices.  

  • Regularly remove viruses from USB, pen drive, SD card, external hard drive, PC, or laptop. 
  • Ensure your antivirus software and firewalls are up to date.
  • Be sure to scan any removable disk before opening it.
  • Creating a backup of valuable data and save to another storage device can also save you from a disaster.

In Conclusion

To sum up, this page includes the complete solutions to help you completely clean up and remove shortcut virus from USB, pen drive, external hard drive, and PC. CMD, BAT file, deleting Registry keys, and virus removal software are all applicable ways to fix shortcut virus issue.

Moreover, we still introduce automated file recovery software like EaseUS Data Recovery Wizard to help you bring all missing files due to virus removal.

 Download for Win Recovery Rate 99.7%
 Download for Mac Trustpilot Rating 4.7

Shortcut Virus Remover CMD FAQs

If you also have any of the following frequently asked questions about shortcut virus remover, find solutions here. 

How to remove shortcut virus from pendrive?

Pen drive shortcut virus remover CMD:

Step 1. Press Windows + R key to start the Run box. Type CMD and press Enter. 

Step 2. Type the pen drive letter, such as G: and press Enter.


Step 4. Type DEL AUTORUN.

How to remove shortcut virus from USB without data loss?

Run Command Prompt as administrator. Type ATTRIBUTE -H -R -S AUTORUN. INF to remove shortcut virus from USB without data loss.

How to remove shortcut virus from external hard drive?

Run Command Prompt, After navigating to the infected drive, type del *. lnk command and press Enter to delete all the shortcuts from external hard drive. Then, type attrib -s -r -h /s /d * to restore the files hidden by the shortcut virus.

How can I delete virus using CMD?

Step 1. In the search bar, search for CMD. Right-click on Command Prompt and choose Run as an administrator.

Step 2. Type E: and press Enter. (  E: is the drive letter)

Step 3. Type attrib -s -h -r -a /s /d * and del autorun.inf in order.

  • Updated by

    Jaden is one of the editors of EaseUS, who focuses on topics concerning PCs and Mac data recovery. Jaden is committed to enhancing professional IT knowledge and writing abilities. She is always keen on new and intelligent products.…
  • Written by

    Tracy became a member of the EaseUS content team in 2013. Being a technical writer for over 10 years, she is enthusiastic about sharing tips to assist readers in resolving complex issues in disk management, file transfer, PC & Mac performance optimization, etc., like an expert.…
Why Trust EaseUSEditor Reviews


Years of experience


Countries and regions

72 Million+


4.7 +

Trustpilot Score

Data Recovery Service