You plug in a flash drive or memory card and every folder has become a small shortcut icon, or the drive looks empty even though it says it is full. This is the shortcut virus, common on drives that pass through printing shops, school computers and cyber cafés.
The good news: your files are almost always still there. The virus hides them and puts shortcuts in their place. Clicking a shortcut runs the virus and spreads it, so do not open the shortcuts.
Get the files back (Windows)
- Plug in the drive. Do not open anything on it.
- Open File Explorer and note the drive's letter, for example E:.
- Click the Start button, type
cmd, and open Command Prompt. - Type the following, replacing E with your drive letter, and press Enter:
attrib -h -r -s /s /d E:\*.*
- Wait for it to finish. It can take a minute on a full drive. Nothing appears while it works.
- Open the drive. Your folders should be visible again, alongside the shortcuts.
Clean the drive
- Delete every shortcut (the icons with a small arrow), and any file ending in .lnk, .vbs, .js or .exe that you did not put there. A folder with no name or a strange name is often where the virus hides your files; open it and move your files out first.
- Copy your files to your computer.
- Run a Full scan in Windows Security on both the computer and the drive.
- For peace of mind, format the drive (right-click it in File Explorer, Format) and copy your files back.
If the files are really missing
If the drive shows as full but nothing appears even after the command, try free recovery software such as PhotoRec or Recuva before formatting. Do not copy anything new onto the drive until you have recovered what you need.
On an Android phone
Phones are not infected by this virus, and a file manager on Android shows hidden files. If you have no computer, plug the drive into your phone with an OTG adapter, use a file manager with Show hidden files turned on, and copy your files off.
Stop catching it
- Keep Windows Security turned on and updated. It detects the common variants.
- When you print at a shop, send the file by email or WhatsApp instead of handing over a flash drive.
- Scan any drive that has been in another computer before opening files on it.
- Keep a copy of important files in Google Drive or OneDrive. A flash drive is a way to carry files, not a place to keep the only copy.