Remove Shortcut Virus Using CMD | Fix USB Shortcut Virus

This page includes the complete solutions to remove shortcut virus from USB, pen drive, external hard drive, and PC without losing data. 

Shortcut virus, also known as 1kb shortcut virus, is a common Trojan virus that spreads widely using a USB drive or pen drive as a medium. The virus will hide all the folders on the root directory of the USB, and then create a shortcut with the same name as the folder. These shortcut files end with .EXE, .VBS. LNK or .INI suffixes and cannot be cleaned up. After the user clicks on the shortcut, it will run the virus and add it to start automatically. 

What Causes Shortcut Virus in USB Flash Drive

Shortcut virus is more like a virus program that hibernates an autorun.inf worm on your computer and it autoruns in the background. As a result, the existing files on infected devices become inaccessible, hidden, or encrypted into shortcuts with the .ink extension.

Here is the working pattern of the shortcut virus that we concluded based on the explanations provided by many bloggers and geeks:

• 🔍Affected devices: PC, laptop, USB, pen drive, SD card, external hard drive, camera, cellphone, etc. 
• ⚠️Spread path: Shortcut virus worm infects computer > infects USB, pen drive, etc. (external hard drive) > infects saved files and data (hides or encrypts them, creates shortcut files)

So how to remove shortcut virus from USB or pen drive and bring all lost files back? Continue reading, you'll find five solutions to remove shortcuts virus by using cmd, .bat files, shortcut virus remover, clearing shortcut virus on PC, as well as deleting suspicious keys in Registry Editor.

These solutions for USB shortcut virus removal in this tutorial are mainly provided by professional editors on geek websites like makeuseof.com and bloggers on tech forums like quora.com. All solutions are tested and practical. Hope the following tricks indeed work on resolving your case.

Method 1. How to Remove Shortcut Virus with CMD

One of the top recommended methods to remove shortcut viruses from pen drives or USB flash drives is to use the attrib command. Before running CMD, keep the following in mind:

• Make sure you select the correct USB drive letter.
• Avoid using the command on system drives.
• Run Command Prompt as administrator when possible.
• Back up important files if they are still accessible.

Here are the detailed steps:

Step 1. Connect your external hard drive to PC and right-click on "Start", select "Search".

Step 2. Type Command Prompt in the Search box and click Command Prompt to bring it up.

Sign in with your administrator account and password if the system asks.

Step 3. Type: E: and hit Enter. (Replace E: with the drive letter of your USB, pen drive.)

Step 4. Type: del *.lnk or del autorun.inf and hit Enter.

Step 5. Type: attrib -h - r -s  /s /d E:\*.* and hit Enter. (Replace E: with the drive letter of your infected device).

If this didn't work, you are likely infected by another virus. Replace the autorun.inf with another virus extension such as *.exe to delete these suspicious viruses. If you prefer a visual guide, the short video below shows how to run the CMD commands step by step and check whether your USB files are restored successfully：

 

You can share this helful guide on social media and help more users solve shortcut virus issues by themselves with Command Prompt!

Method 2. Create BAT File to Remove Shortcut Virus from USB

By creating a BAT file, you can simply run the BAT file and use it to clear and remove the existing shortcut virus with the below steps:

Step 1. Connect your USB, pen drive, or SD card to your PC and create a new notepad on the desktop.

Step 2. Copy and save the below code in the new notepad:

Note: Replace G: with the drive letter of your current infected storage device.

Step 3. Change the file extension of the notepad to .bat and save it on your desktop.

Step 4. Double-click the .bat file on your desktop and wait for the process to finish.

By now, you should have successfully removed the shortcut virus from your USB flash drive, pen drive, or SD card using cmd.

Method 3. Use Professional USB Shortcut Virus Remover

When you search shortcut virus removal tool or virus removal software online, a tremendous search result is displayed on your browser. 

Here is the most recommended tool that is can help you remove shortcut viruses from your USB, SD card, or other storage devices:

TOTALAV

TotalAV is an Award Winning Antivirus and Security Software. It Provides Real-Time Protection from Viruses, Malware & Online Threats.

 Get Protected Now

Antivirus Protection Enabled

You can download the antivirus tool - TotalAV and apply it to remove and clean up the virus from your storage device.

Method 4. Remove Shortcut Virus on Source PC

According to the former part, you've understood that most viruses spread from computers to storage devices. To fully get rid of the shortcut virus, we highly recommend you follow the guidelines here to get rid of the existing shortcut virus on your source PC first.

• 1. Stop using the USB drive, pen drive, SD card, memory card, or hard drive on your PC

The reason is that when the device gets infected, continuous usage of the infected device will only spread the virus to more devices, causing more file loss.

Therefore, you should stop using infected devices and unplug all external storage devices.

• 2. Clean up existing shortcut virus or malware on your computer

As you know that the virus on your external storage devices can be all traced from your PC. As a result, cutting the source of virus is the key point.

Here are some tips that you can follow to remove shortcut virus from Windows 10 PC: (steps on other Windows OS may be a tiny different)

Step 1.  Enable the firewall on Windows PC

• Open Control Panel > click "Windows Defender Firewall" > Turn Windows Defender Firewall on or off.

• Check the boxes of "Turn on Windows Defender Firewall"  and click "OK" to confirm.

Step 2. Turn on Virus & threat protection in Windows Defender Security Center

• Right-click Windows icon and select "Settings" > Click "Update and Security".
• On the Windows Security section, click "Open Windows Defender Security Center".

• Click "Virus & threat protection" on the new window > Go to Virus & threat protection settings.
• Turn on these three options: Real-time protection, Cloud-delivered protection, and Automatic sample submission.

Note: Do as Windows Defender Security Center requests if the virus is detected after turning on the Virus & threat protection feature. By doing so, it will remove all detected virus and malware.

Step 3. Run antivirus software to clear the hidden virus, malware, etc.

After this, you can follow solutions in the next part to permanently remove shortcut virus from your USB, pen drive, SD card or memory card, etc.

Method 5. Delete Suspicious Keys in Registry Editor to Remove Shortcut Virus from USB/Pen Drive

You should know that this method is more like to thoroughly remove suspicious keys that may be related to the shortcut virus and from your PC.

Step 1. Press Windows + R keys, type: regedit, and hit Enter.

Step 2. Open Registry Editor and go to HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Run.

Step 3. Find the suspicious keys like odwcamszas, WXXKYz, ZGFYszaas, OUzzckky and delete them.

Bonus Tip: Recover Data After Removing Shortcut Virus [IMPORTANT]

Some of you may have noticed that using the CMD shortcut virus remover, somehow, can result in minor data loss. In case of further problems, we recommend you check your device for any missing files after the shortcut virus removal process.

If some essential files are missing, don't worry. EaseUS Data Recovery Wizard can scan your device and locate deleted files. This reliable data recovery software can recover deleted files from the Recycle Bin or recover data from virus/malware attacks, accidental deletion, hard drive formatting/corrupting, partition loss, and more.

Check our video tutorial to recover data:

 

After the scanning, you'll be able to view all recoverable files and restore them with a few simple clicks:

Step 1. Select the virus infected drive to scan

Run EaseUS virus file recovery software on your Windows PC. Select the disk attacked by the virus to scan for lost or hidden files. Note that:

• If it's an HDD where files were hidden or deleted by virus, it's better to install the software on a different volume or an external USB drive to avoid data overwriting.
• If the infected device is an external hard drive, flash drive or memory card, it doesn't matter to install the software on the local drive of the computer.

Step 2. Check all scanned results

EaseUS Data Recovery Wizard will immediately start a scan process to find your deleted or hidden files on the virus infected hard drive. To quickly locate the wanted files, you can use the Filter or search box feature to display only the pictures, videos, documents, emails, etc.

Step 3. Preview and recover deleted/hidden files

When the process finishes, you can preview the scanned files. Select the files you want and click the "Recover" button. You should save restored files to another secure location or Cloud drive, not where they were lost.

Don't forget to share this tutorial on social media and help more friends recover data!

How to Prevent USB, Pen Drive, or PC from Getting Infected with Shortcut Virus

As we all know, prevention is better than cure. Make sure you have full protection to avoid shortcut viruses or other viruses infecting your storage devices.  

• Regularly remove viruses from USB, pen drive, SD card, external hard drive, PC, or laptop. 
• Ensure your antivirus software and firewalls are up to date.
• Be sure to scan any removable disk before opening it.
• Creating a backup of valuable data and save to another storage device can also save you from a disaster.

In Conclusion

To sum up, this page includes the complete solutions to help you completely clean up and remove shortcut virus from USB, pen drive, external hard drive, and PC. CMD, BAT file, deleting Registry keys, and virus removal software are all applicable ways to fix shortcut virus issue.

Moreover, we still introduce automated file recovery software like EaseUS Data Recovery Wizard to help you bring all missing files due to virus removal.

USB Shortcut Virus Remover FAQs

If you also have any of the following frequently asked questions about the shortcut virus remover, find solutions here. 

Why doesn't antivirus software detect shortcut viruses?

Many shortcut viruses only change file attributes and hide original files instead of causing obvious system damage. Because of this, some antivirus programs do not treat them as high-risk threats and may fail to detect them. In addition, outdated virus definitions or limited system permissions can also affect detection results.

Can a shortcut virus spread between USB drives?

Yes. Shortcut viruses commonly spread through USB flash drives and other removable storage devices. When an infected USB drive is connected to another computer, the virus can copy itself to the system and then infect other USB drives connected to the same machine, especially on shared or public computers.

How to remove shortcut virus from pendrive?

Pen drive shortcut virus remover CMD:

Step 1. Press Windows + R key to start the Run box. Type CMD and press Enter. 

Step 2. Type the pen drive letter, such as G: and press Enter.

Step 3. Type ATTRIBUTE -H -R -S AUTORUN.

Step 4. Type DEL AUTORUN.

How to remove shortcut virus from USB without data loss?

Run Command Prompt as administrator. Type ATTRIBUTE -H -R -S AUTORUN. INF to remove shortcut virus from USB without data loss.

How to remove shortcut virus from external hard drive?

Run Command Prompt, After navigating to the infected drive, type del *. lnk command and press Enter to delete all the shortcuts from external hard drive. Then, type attrib -s -r -h /s /d * to restore the files hidden by the shortcut virus.

How can I delete virus using CMD?

Step 1. In the search bar, search for CMD. Right-click on Command Prompt and choose Run as an administrator.

Step 2. Type E: and press Enter. (  E: is the drive letter)

Step 3. Type attrib -s -h -r -a /s /d * and del autorun.inf in order.