Note (October 2026): Earlier versions of this guide said the shortcut virus cannot be removed by well-known antivirus programs; Microsoft states that Microsoft Defender detects and removes the Jenxcus shortcut worm family. The attrib command has also been corrected.
To remove the shortcut virus from a USB drive or PC, first scan the device with up-to-date antivirus software such as Microsoft Defender Antivirus. Then open Command Prompt as administrator and run attrib -h -r -s /s /d X:\*.* (X is the drive letter) to unhide your files, copy them off, and format the drive.
Key Takeaways
- The shortcut virus is a worm, such as the Jenxcus family Microsoft documents, that copies itself to removable drives and creates shortcut links while hiding your real files.
- Microsoft states that Microsoft Defender detects and removes Jenxcus, so the claim that antivirus cannot remove the shortcut virus is out of date.
- The attrib command only unhides files by clearing the hidden, read-only and system attributes; it does not remove the malware.
- On a PC, a full scan plus a Microsoft Defender Offline scan, which runs outside Windows, is the most thorough built-in option.
- Never open the shortcuts on an infected drive; opening them can run the malware again.
How to remove shortcut virus from Laptop, Computer and Pendrive: It is frustrating when a PC or USB drive gets infected with malware and your files suddenly turn into shortcuts. Most infections can be removed with an up-to-date antivirus program, although older guides claimed that antivirus tools failed against malware such as the Shortcut Virus. In practice, Microsoft says Microsoft Defender detects and removes the best-known shortcut worm family. This guide explains what the virus is and the practical ways of removing shortcut virus from USB and Computer.
How to Remove the Shortcut Virus from a Pen Drive or Computer
What Is Shortcut Virus?
The shortcut virus is a worm that spreads through USB flash drives, computers and SD cards and creates shortcut links that point to its own copy, so the shortcuts look like your files and folders while the originals are hidden. In many cases, everything on the drive seems to disappear because the real files have been hidden. It can be categorized into two types:
1) Flash Drive Shortcut Virus
2) File and Folder Shortcut Virus
Older guides said this virus could not be removed even by well-known antivirus programs, but that is no longer accurate: Microsoft states in its threat encyclopedia that Microsoft Defender detects and removes the Jenxcus worm family. Manual steps are still useful for getting hidden files back, and the sections below cover the ways to remove this Shortcut Virus from USB/Computer.
How to Remove Shortcut Virus from USB?
Before trying any other method, scan the external drive with up-to-date antivirus software, such as Microsoft Defender Antivirus, which Microsoft provides for Windows 11, Windows 10 and Windows 8.
There are two main methods for cleaning a USB device:
1) Using Command Prompt
Open Command Prompt with administrator rights. On Windows 10 and Windows 11, type “cmd” in the Start search box, right-click Command Prompt and choose Run as administrator (older instructions: for windows 7 and earlier versions: Windows key + R > Type CMD & ENTER, Windows 8: Search for “CMD” > Right click to CMD and Select “Run as Administrator”.
Connect the USB device to your computer and scan it with your antivirus program. If the antivirus finds a threat, let it quarantine or remove it.
Now type (attrib -h -r -s /s /d D:\*.*) in command prompt where “D” is your drive. Replace D with the letter File Explorer shows for your USB drive. The command clears the hidden, read-only and system attributes from every file and folder on the drive, so the original files become visible again. It does not delete the malware itself, which is why the antivirus scan matters. Once your files are visible, follow these steps: delete unnecessary files and folders > copy important data to your computer > format the USB device > again re-copy all USB data back.
2) Using Software
Shortcut Virus Remover: Several free tools are marketed for removing shortcut malware, and USB fix is one name that appears in many guides. Tools like this need no coding or technical knowledge: you follow a few on-screen steps. Download any third-party tool only from its developer’s official site, and treat Microsoft’s own free tools, Microsoft Defender Antivirus and Microsoft Safety Scanner, as the first choice.
Because these tools change Windows settings, restart the computer after the clean-up.
How to Remove Shortcut Virus from Computer?
It is not as easy to remove shortcut virus from computer as cleaning a USB drive. A computer cannot simply be formatted like a USB stick, the malware may have added itself to startup settings, and you cannot undo its changes with a single Ctrl+Z.
On an infected computer, the shortcut virus keeps running in the background, and Microsoft notes that the Jenxcus worm adds a registry entry so it starts every time Windows starts. Ending the script process in Task Manager (the original guide calls it Wscript) stops new shortcuts for the moment, but the malware comes back after a restart unless it is removed. Tools often named for removing it include:
- Shortcut Virus Remover
- USB fix
- Shortcut Virus Fixer
- Free Shortcut Remover
The CMD method described above can also help to remove shortcut virus from computer.
Tips to Make your Computer Faster
File Download Manager for Windows
Clean up Junk Files in Windows
That’s It. 😀 With these steps you should be able to remove shortcut virus from your PC, laptop and memory card successfully. If you have a problem when removing shortcut virus, then you can tell us by commenting below. Enjoy 😀
What Causes the Shortcut Virus?
The shortcut virus is a family of worms, many of them small scripts rather than one single program. Microsoft’s threat encyclopedia describes Worm:VBS/Jenxcus, a VBScript worm, in detail. According to Microsoft, Jenxcus copies itself into every folder of a removable drive connected to the PC and creates a shortcut link pointing to its copy on that drive.
Microsoft lists several ways the worm reaches a computer: a drive-by download, a compromised webpage, or an infected removable drive. Once installed, it changes a Run registry key so it starts every time Windows starts, and it can install itself in folders such as %APPDATA%, %TEMP% and the startup folder.
The shortcut virus is more than a nuisance. Microsoft says Jenxcus can give an attacker control of the PC, download and run files, and steal online user names and passwords. For that reason, Microsoft advises changing your passwords after the threat has been removed.
How to Remove the Shortcut Virus Step by Step
The following order works for both a USB drive and a Windows PC, and it keeps your files safe while the malware is removed.
- Do not open the shortcuts. Double-clicking a shortcut on an infected drive can run the malware again.
- Update and scan. Open the Windows Security app, go to Virus and threat protection, check for protection updates, and run a full scan of the PC and a custom scan of the USB drive.
- Run an offline scan if the problem returns. Microsoft Defender Offline restarts the PC and scans from the Windows Recovery Environment, where persistent malware finds it harder to hide. Microsoft says the scan takes about 15 minutes.
- Unhide your files. Open Command Prompt as administrator and run attrib -h -r -s /s /d X:\*.* with X replaced by the drive letter.
- Copy your files to a safe location. Copy only the real documents, photos and folders. Leave behind any .lnk shortcuts and any unknown .vbs or .exe files.
- Format the USB drive. Formatting erases everything on the drive, including the copied malware.
- Scan the copied files again before you open them, then change your passwords.
Which Free Microsoft Tools Remove the Shortcut Virus?
Microsoft names three free tools for detecting and removing Jenxcus on its threat page. The table below compares them using details from Microsoft’s own documentation, as of October 2026.
| Tool | What it does | Good to know |
|---|---|---|
| Microsoft Defender Antivirus | Real-time protection plus quick, full, custom and offline scans in the Windows Security app | Built into Windows; the offline scan runs from the Windows Recovery Environment |
| Microsoft Safety Scanner | A portable scanner that finds malware and tries to reverse its changes | Scans only when you start it, expires 10 days after download, and does not replace an antivirus |
| Windows Malicious Software Removal Tool | A Microsoft removal tool for malware | Listed by Microsoft as a removal option for Jenxcus |
According to Microsoft, the one-click offline scan is built into Windows 10 version 1607 and later and into Windows 11. If BitLocker is turned on for the system drive, Microsoft advises suspending BitLocker protection before the offline scan; otherwise you may be asked for the BitLocker recovery key when the PC restarts. For more on scans that look below the surface of the operating system, see our guide on what a rootkit virus scan is and why you need it.
What Does the attrib Command Do?
The attrib command is a built-in Windows command that displays, sets or removes file attributes. Microsoft’s documentation explains each part of the command used in this guide:
- -h clears the Hidden attribute.
- -r clears the Read-only attribute.
- -s clears the System attribute.
- /s applies the command to matching files in the current folder and all subfolders.
- /d applies the command to folders as well as files.
Microsoft notes that a file with the Hidden or System attribute set must have that attribute cleared before other attributes can be changed, which is why the command clears them together. The command changes only attributes, so it does not delete the shortcut virus.
What If Files Are Still Missing After Cleaning?
If files are still missing after the attrib command, the malware may have deleted them rather than hidden them. Stop writing new data to the drive and try a recovery tool before formatting. Our guide on how to recover a formatted hard drive for free covers the general approach, and regular backups, explained in why it is important to back up and recover data in the cloud, are the best protection against losing files this way.
How to Prevent the Shortcut Virus
- Keep Microsoft Defender or another antivirus up to date and scan every USB drive that has been used on a shared or public computer.
- Keep AutoRun disabled. Microsoft says Jenxcus tries to use the Windows AutoRun function to spread through removable drives. According to Wikipedia’s article on autorun.inf, Windows 7 removed this AutoRun behaviour, and a patch for Windows XP and Vista followed.
- Show hidden items in File Explorer so that a drive full of shortcuts is easy to spot.
- Do not run unknown .vbs, .js or .exe files found on a USB drive.
- Treat shared drives with care. Our article on whether flash drives present a security risk explains the wider risks of USB storage.
Frequently Asked Questions
Can antivirus remove the shortcut virus?
Yes. Microsoft states that Microsoft Defender detects and removes the Jenxcus worm family, a well-known shortcut virus. Microsoft also lists Microsoft Safety Scanner and the Windows Malicious Software Removal Tool as free removal options. Run a full scan, and an offline scan if the infection returns.
Will formatting a USB drive remove the shortcut virus?
Formatting a USB drive erases everything on it, including the malware copies. Copy your real files off first, using the attrib command to unhide them, and scan those files before opening them. Formatting the USB drive does not clean a PC that is still infected.
Does the attrib command delete the shortcut virus?
No. The attrib command only clears the hidden, read-only and system attributes so your original files become visible again. The malware files stay on the drive until an antivirus removes them or the drive is formatted.
Is the shortcut virus dangerous?
The shortcut virus can be dangerous. Microsoft says the Jenxcus worm can give an attacker control of the PC and steal online user names and passwords, so change your passwords after removing it.
How do I remove the shortcut virus without losing data?
Scan the drive, run attrib -h -r -s /s /d X:\*.* (with your drive letter) to unhide the files, copy the real files to a safe place, and only then format the drive. Do not open the shortcut files at any point.
Justwebworld has published guides since 2012. How we write and update articles Report an error
7 Comments
Thanks for Sharing Awesome Tutorial. Now my pen drive is safe..
Nice post . It was help me to remove shortcut virus from computer and usb.. thank you..
Wow awesome i follow this tips then i remove shortcut virus in my pc
thank for sharing.
Welcome Anytime Abid.
Thanks Akshat 🙂
Great tutorial for removing viruses from your pendrive. 😀
Thank you. It help me a lot. the short cuts in my USB/ flash drive have been removed.