5 Ways to Remove Shortcut Virus from External Hard Disk

4
1
Remove Shortcut Virus from External Hard Disk

Shortcut virus is just like any other virus program. It acts like a worm, hibernating in the autorun.inf file and it runs in the background.

If your external hard drive has this virus, you will not be able to access the files stored in it. These files will be either hidden or encrypted into shortcuts using the .lnk extension.

There are some quick steps to remove the shortcut virus from your external hard drive, as described in this article. Follow the steps carefully and regain control of your hard drive and access the files stored in it.

KEY TAKEAWAYS

  • You may run a couple of commands in the Command Prompt to remove the shortcut virus from your external hard drive.
  • Restoring the system files and deleting the autorun files is another way to remove shortcut virus from a USB or pen drive.
  • Anything suspicious in the Windows Registry must also be deleted to remove the virus.
  • Another useful solution to remove shortcuts virus from the external hard drive is by creating a .bat file.
  • There are lots of third-party software tools or shortcut virus remover that you can also use to remove the virus from your external hard drive.

What Causes Shortcut Virus and Its Spreading?

There may be a virus or malware on your computer system itself that may cause this issue. A shortcut virus is created by a combination of malware, Trojan horse, and worms.

A shortcut virus can infect your external storage through the following:

  • Online malware
  • Infected or corrupted storage
  • Inactive antivirus

There is a specific pattern or path in which the shortcut virus spreads. It will first infect the computer system and then move on to the external hard drives such as pen drive and USB drive to infect them.

It will then infect the files stored in the external hard drive, encrypting or hiding them, or by creating shortcut files.

Other than that, the shortcut virus can also spread in other ways, such as:

  • From email attachments
  • From pop-up or banner ads
  • From files downloaded from any unreliable or unofficial websites
  • Bundled programs
  • Illegal peer-to-peer networks

Sometimes, cybercriminals and intruders may take control of your computer system by making use of its vulnerabilities and inject the shortcut virus.

How to Remove Shortcut Virus from External Hard Disk?

You can use the Command Prompt to run a few commands and even delete the values that you cannot identify in the Windows Registry to remove the shortcut virus from your external hard drive.

One easy way to remove the shortcut virus from the external hard drive is to run a system check and clean the virus and malware from the source computer. Then, you must enable the Windows Defender Firewall protection.

Read Also:  What is Screen Flickering & How to Fix? (5 Methods)

Some other ways to remove the shortcut virus from your hard drive are:

Using any reliable third-party software tool is also another way to remove the shortcut virus from an external hard drive.

Method 1: Using the Command Prompt

Running a couple of specific commands in the Command Prompt will remove the shortcut virus from your external hard disk. Assume that its volume label is H.

STEPS TO FOLLOW:

  • Open Command Prompt and administrator by typing cmd in the quick search box next to the start menu, right-clicking on the best match, choosing Run as administrator and hitting Enter on your keyboard.
  • In the Command prompt window, type H: and hit Enter.

H is the volume letter of the drive, which can be D or E or any other letter in your case. Replace H with that letter.

  • Next, type the command del * .lnk and hit Enter.
  • Sometimes it may ask for confirmation from you. If it does Press ‘y’ and hit Enter again.

Wait until the process is complete.

  • Now type attrib -s -r -h *.* /s /d /l and hit Enter.

Typing attrib -s -r -h *.* /s /d /l

Wait again for the command to be executed successfully.

  • Finally, type exit and hit Enter to close the Command Prompt.

Restart your computer and check whether the issue has been fixed or not. If the problem still exists, try the next solution.

Method 2: Use the Registry Editor

In this method you will need to delete anything that looks suspicious in the Registry Editor.

STEPS TO FOLLOW:

  • Press the Windows and R keys on your keyboard together to open the Run dialog box.
  • Type regedit in the box and hit Enter.
  • Click on the ‘Yes’ button on the User Account Control window when it appears.

When the Registry Editor window appears, from the left-hand menu options, click on the small arrow next to each of these following folders in the exact sequence mentioned below to expand them:

  • HKEY_CURRENT_USER
  • SOFTWARE
  • Microsoft
  • Windows
  • CurrentVersion

Once you reach here, scroll down here to look for the Run folder and click on it.

  • On the right-hand side of the window, look for any suspicious entry. (IDMan in this case).
  • Right-click on it.
  • Choose Delete from the drop-down options.

Deleting IDMan

Similarly, delete everything that looks suspicious to you or you cannot identify. If you do not have any clue about any particular value, search it on Google before deleting.

Note: Deleting anything from the Windows Registry that is useful may cause severe damage to the system and affect its performance drastically.

Method 3: Create a BAT File

Creating a BAT file and then running it as an administrator may also remove the shortcut virus from the external hard drive.

Read Also:  How to Fix DHCP Not Working Properly?

STEPS TO FOLLOW:

  • Right-click on a blank space on your desktop.
  • Click on New from the drop-down menu.
  • Click on Text Document from the drop-down submenu.

Clicking on Text Document

In the Notepad, type the following command:

@echo off

attrib -h -s -r -a /s /d F: *.*

@echo complete

It is shown in the image below for your better understanding:

Make sure that you replace the Letter ‘F’ with your drive letter.

  • Now, click on the File tab at the top of the Notepad.
  • Click on Save As.

Clicking on Save As

  • Give the file a name. You can give any name, ‘virus’ in this case.
  • Type .bat after the name.
  • Click on the ‘Save’ button.

Clicking on the ‘Save’ button

  • Now, right-click on the newly created virus.bat file.
  • Click on Run as administrator from the options that pops up.

Clicking on Run as administrator

This will remove all shortcut viruses from your external hard drive. You may now copy the files in your external hard drive, save them in another drive on your PC, and format the pen drive.

Method 4: Restore System Files and Delete Autorun Files

When you open your external hard drive from the File Explorer after connecting it, you may get to see only a shortcut with an icon. Do not click on it since it can be a virus and can trigger another virus.

Restore the operating system files and delete the autorun files to remove the shortcut virus.

STEPS TO FOLLOW:

  • Open File Explorer and go to This PC.
  • Go to the View tab on top.
  • Select Options.

Selecting Options

  • Click on the View tab on the Folder Options window.
  • Check the small circular button next to ‘Show hidden files, folders, and drives.’
  • Click to uncheck the small square box next to ‘Hide protected operating system files (Recommended).’

Clicking to uncheck the small square box next to ‘Hide protected operating system files (Recommended).’

  • Click on the Yes button in the Warning window that appears.

Clicking on the Yes button in the Warning window

  • Click on the OK button in the previous Folder Options window to save the changes and close it.
  • This will unhide the System Volume Information files and others.
  • Delete the shortcut icon.
  • Double-click on the blank section with no image, icon or name.

Double-clicking on the blank section with no image, icon or name

  • If you see autorun files in it, delete them.

autorun files

Now, copy the remaining content and store it in another drive and format the external hard drive.

Method 5: Make Changes in the Windows Script Host Settings

Sometimes the issue with the Windows Script Host Settings may cause this issue. You can make your external hard drive free from the shortcut virus by making changes in these settings.

STEPS TO FOLLOW:

  • Open the Run dialog box as before.
  • Type wscript.exe and hit Enter.

Typing wscript.exe

  • Under the Script tab in the following Windows Script Host Settings window, click on the small square box next to ‘Stop script after specified number of seconds.’
  • Click on the Apply button, and then on the OK button to close the window and save the changes.
Read Also:  7 Ways to Fix Media Disconnected Error in Windows

Windows Script Host Settings

  • Now, press the CTRL + SHIFT + ESC keys on your keyboard together to open the Task Manager.

Opening the Task Manager

  • Scroll down under the processes tab to find wscript.exe or wscript.vbs file.
  • Select it.
  • Click on the End Task button.

However, you may not always find it. If you do not, close Task Manager and proceed with the next steps.

  • Press the Windows and E keys on your keyboard to open another File Explorer window.
  • Go to the search bar at the top and type wscript.exe and hit Enter.

Typing wscript.exe

  • It will take some time, and you will see a lot of wscript.exe files will open.
  • Press CTRL + A to select them all.
  • Right-click on the selection.
  • Click on Delete from the drop-down option.

Clicking on Delete from the drop-down option

  • During the process, if you see the File Access Denied window saying that ‘You need permission to perform this action, check the small square box next to ‘Do this for all current items.’
  • Click on the Skip button.

Clicking on the Skip button

Now close all windows and restart your PC.

You may also try to find wscript.exe files in another way.

  • Open the Run dialog box again as before.
  • Type msconfig.
  • In the System Configuration window, go to the Startup tab.
  • Look for Microsoft Windows Script Host.
  • If you find it there, click on the small square next to it to uncheck it.
  • Click on the Apply button and then on the OK button.

Your system will now be free from shortcut virus. Restart your computer system

After the system reboots, open the Command Prompt as before. Run the command attrib -s -r -h *.* /s /d /l and hit Enter as you did in Method 1.

This will recover the files stored in your external hard drive.

Create a backup of these files in another storage and format the external hard drive in the following way:

  • Right-click on the drive > Click on Format from the options.
  • Click on the box next to Quick Format under Format options.
  • Click on the Start button.

Clicking on the Start button

  • Click on the OK button in the WARNING window.

Clicking on the OK button in the WARNING window

  • Click on the Yes button in the following window.

Clicking on the Yes button

  • Click on the OK button when a window shows ‘Format Complete’.

Clicking on the OK button when a window shows ‘Format Complete’

Now restart your computer system. When it reboots, you can save the files on the external hard drive again.

Conclusion

So, these are the steps to remove a shortcut virus from the external hard drive.

Follow any one of them to prevent replacing the files and folders stored in your USB drive with fake shortcuts and prevent lower system performance, data loss or damage to your PC.

About Taylor

AvatarTaylor S. Irwin is a freelance technology writer with in-depth knowledge about computers. She has an understanding of hardware and technology gained through over 10 years of experience.

4 Comments
Oldest
Newest
Inline Feedbacks
View all comments