What to do right now
- Do not double-click the shortcuts. That can spread the malware to the PC.
- Scan the USB stick and the PC with antivirus software first.
- Clear the hidden attribute to see the originals, and scan for anything that was deleted.
Step by step
Do not open the shortcuts
The shortcuts pretend to open your hidden files while running the malware. Turn off AutoPlay and work only in File Explorer.
Run an antivirus scan
Scan the USB stick and the whole PC with Microsoft Defender or another antivirus. It removes the malicious files and leaves the hidden originals. If an original was quarantined, check the protection history.
Clear the hidden attribute
Open Command Prompt and, if the USB stick is drive E:, run attrib -h -r -s /s /d E:\*.* to make hidden folders and files visible again. The originals are often collected in a folder with a blank name.
Copy important files first
Copy the files that reappeared to another disk on the PC first. Then delete the leftover shortcuts and any executable you do not recognise.
Scan for missing files
If files are still missing, the malware or the antivirus may have deleted them. Scan the USB stick with FileFix Ultimate to find deleted files and save them to the PC.
Why the space is used but the files are gone
This malware does not delete your files. It sets hidden and system attributes so File Explorer does not show them, then creates shortcuts with the same names, which is why the used space does not change. Turning off hide protected operating system files in the folder options shows the originals too, but clearing the attributes with attrib is cleaner.
If the space is free as well, it is a different story: the files were really deleted. Save nothing to the stick and scan it for deleted files right away.
Avoiding it next time
This malware spreads when a USB stick is plugged into an infected PC. Scan sticks used on shared computers before plugging them into your own, and keep Windows and your antivirus up to date.
When recovery is difficult
- The malware actually deleted the originals and other data was written over them.
- Ransomware that encrypts files cannot be undone this way.
- A stick that shows as RAW or asks to be formatted has a different problem.
How FileFix Ultimate helps
- Finds deleted files on FAT32, exFAT and NTFS sticks with their names and folders.
- Writes nothing to the stick and saves results to another disk on the PC.
- A fake-capacity check shows whether the stick itself is the problem.
- Checks that recovered files open.
FileFix Ultimate is free, works offline and never writes to the drive you are recovering from. Check the signature before you run it.
Frequently asked questions
My USB files turned into shortcuts. Where are the originals?
Usually hidden on the same stick. After an antivirus scan, clear the hidden attribute with attrib and they reappear.
I clicked one of the shortcuts.
The PC may be infected. Scan the whole PC with antivirus software before plugging in other USB drives.
The files are still missing after attrib.
The malware or antivirus may have deleted them. Save nothing to the stick and scan it with a recovery tool.