USB Files Turned Into Shortcuts? Here's the Exact Fix (Windows 10 & 11)

You plug in your USB flash drive. Everything looked fine last time. But now — instead of your folders, there are shortcuts. Little arrow icons everywhere. Your actual files seem to have disappeared.

Don't panic. Don't reformat.

This is one of the most common USB problems in the Philippines — especially in shared computers, internet cafés, office PCs, and school computers. A virus or worm hid your files and replaced the folder icons with shortcuts. But the files are almost certainly still there.

I've been fixing this problem for officemates and family members for years. The fix is quick, free, and works in Windows 10 and Windows 11.

Why did my USB folders become shortcuts? A virus or worm infected your USB drive and changed your file and folder attributes — making them hidden and system-protected while creating shortcut files that look like your folders. Your actual files are still there. They're just hidden. The fix involves revealing them using Command Prompt and then scanning the drive.

Why This Happens

The culprit is almost always a shortcut virus — also called a USB shortcut virus or autorun worm. It spreads through USB drives and typically comes from shared computers: internet cafés, office workstations, school computers, or any PC where multiple people plug in their drives.

When an infected USB is inserted into a computer that's also infected, the virus copies itself onto your drive, hides all your files and folders by changing their attributes to hidden and system, and creates shortcut files with the same names as your folders. The shortcuts look convincing — but clicking them runs the virus and spreads it further.

The important thing to understand: your files are not deleted. They're just hidden. The attrib command below will unhide them.

Method 1 — The Command Prompt Fix (Most Effective)

This is the faster and more thorough method. It works on Windows 10 and Windows 11.

Step 1 — Plug in your USB drive. Open File Explorer and note what drive letter Windows assigned to your USB. It's usually E:, F:, or G:.

Step 2 — Open Command Prompt as Administrator. Click the Start button. Type CMD. Right-click Command Prompt and select Run as administrator. This is important — the attrib command needs admin access.

Step 3 — Type this command:

attrib -r -a -s -h /s /d F:\*.*

Replace F: with your actual USB drive letter. Then press Enter.

What this command does:

• -r removes the Read-only attribute
• -a removes the Archive attribute
• -s removes the System attribute — this is the key one that hides your files
• -h removes the Hidden attribute
• /s applies to all files in all subfolders
• /d applies to folders as well as files

Wait for it to finish. No confirmation message means it worked. Open your USB drive in File Explorer — your original folders should now be visible.

Method 2 — Show Hidden Files Through Settings

This method is quicker but less thorough — it only makes hidden files visible, it doesn't remove the system attribute. Use this as a supplement to Method 1, not a replacement.

For Windows 10 and Windows 11:

Open File Explorer. Click the View tab in the ribbon at the top. Check the box that says Hidden items.

Your USB drive folders should now appear — they'll look slightly faded to indicate they're still marked as hidden. After running Method 1's Command Prompt fix, they'll appear normally.

Step 3 — Remove the Shortcut Files

After your real folders are visible, you'll still see the shortcut files — the ones with the little arrow icons that pretended to be your folders. Select and delete all of them. They serve no purpose and running them can reinfect your drive.

You can identify them easily: shortcut files have a .lnk extension or show a small arrow on the icon. Your real folders will not have these.

Step 4 — Scan Your USB and Your PC

This is the step most people skip — and it's the most important one.

The attrib command unhid your files. But the virus is still on your drive and possibly on the computer you used. If you plug the USB into another computer without scanning, it will spread again.

Scan your USB drive with an updated antivirus. Windows Defender — built into Windows 10 and 11 — works for this. Right-click your USB drive in File Explorer and select Scan with Microsoft Defender.

Also scan the computer you plugged it into. If you picked up the virus at an internet café or shared office computer, those machines need to be cleaned too — but that's outside your control. Just make sure your own devices are clean before plugging in again.

Free antivirus options for deeper scanning:

• Malwarebytes Free — malwarebytes.com — excellent for removing USB shortcut viruses
• Windows Defender — already built into Windows 10/11, free, regularly updated

How to Prevent This From Happening Again

Disable AutoRun/AutoPlay on your Windows PC. The shortcut virus spreads partly through Windows' AutoRun feature — the automatic popup that appears when you insert a USB. Disabling it prevents the virus from automatically executing when a USB is inserted.

To disable AutoPlay on Windows 10/11:

1. Go to Settings → Bluetooth & devices → AutoPlay
2. Toggle off "Use AutoPlay for all media and devices"

Don't plug your USB into unfamiliar computers without protection. Internet cafés and shared office computers are the #1 source of USB shortcut viruses in the Philippines. If you must use one, scan your USB immediately after on a clean computer.

Keep an antivirus updated on your main computer. Windows Defender is sufficient for most users and requires no additional installation — just make sure it's updated and running.

Consider write-protecting your USB for important data. Some USB drives have a physical write-protect switch on the side. When enabled, nothing can be written to the drive — including viruses. Check if your drive has this feature.

Why This Is Still Relevant in 2026

I wrote the original version of this post in 2013 — when Windows XP was still common and internet cafés were everywhere.

In 2026, the USB shortcut virus is still circulating. It's less prevalent than it was a decade ago, but it hasn't disappeared. The rise of USB drives as a way to transfer files at government offices, schools, and small businesses in the Philippines means shared computers with inadequate antivirus protection are still a vector for this specific type of infection.

I still encounter this in the office. Someone plugs in a USB that's been through a few shared computers, and suddenly their folders are shortcuts. Same virus. Same fix. A decade later.

The Command Prompt command hasn't changed either. attrib -r -a -s -h /s /d has been working since the Windows XP days and it still works perfectly in Windows 11.

Some things stay useful. 😄

Mavs' Final Diagnosis

Your files are not gone. The virus just hid them. The attrib command unhides them, the antivirus removes the threat, and disabling AutoPlay prevents it from happening again.

Three steps. All free. All built into Windows.

And please — scan before you plug into another computer. Spreading a virus to your officemate's machine is not a great way to end the workday. 🙏

Have you encountered the USB shortcut virus before? Did this fix work for you? Drop it in the comments — especially if you found it on a work or school computer. 

Source:

https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/attrib