The call comes in from around South Queensferry more often than people would guess — a parent up on Springfield Road whose child brought a USB drive back from school, an accountant near the Hawes Inn who moved a client’s files on a stick from a home PC to the office, an older resident on Rosebery Avenue who had loaded holiday photos onto a memory stick to show the grandchildren. The stick has always worked. Today, when it goes into the PC, every folder and file on it has been replaced with a shortcut icon. The little curled arrow is in the corner of every name. Double-click one and either nothing happens or a random file opens for a moment and closes again. The files look gone.
The files are not gone. This is one of the most identifiable USB-borne infections there is — a family of worms named after the researchers who first catalogued them: Gamarue (also called Andromeda), Bondat, and a handful of copycats. They have been on USB drives passing between home PCs, school computers, print shops, and internet cafes for well over a decade, and they are still one of the most common ways a home PC gets infected in 2026. The reason to write about it is that most people’s instinct is exactly the wrong one: they format the drive to “get rid of the virus”, and their photos, coursework, and tax records go with it. There is a specific order that recovers the real files and cleans the machine, and it is worth ten minutes to do it correctly. If you would rather just bring the drive in and have us do it, that is what our virus & malware removal in South Queensferry workflow is for.
1. What Actually Happened to the USB Drive
The worm is a small executable that copied itself onto the USB stick the last time it was plugged into an infected PC. When it copied itself, it did two things: it renamed each of your real folders with the “hidden” and “system” file attributes, so Windows stops displaying them by default, and then it created a shortcut with the same name as each of the hidden folders. The shortcut’s target isn’t your folder — it’s a two-part command that first runs the worm’s executable from a hidden location on the drive, and only then opens your real folder to make the trick look normal. So every time someone clicks a shortcut hoping to open their photos, the worm launches on the host PC and then, so nothing feels wrong, the correct folder opens a second later. That is why the infection spreads so quickly: the drive is designed to reinfect every PC it touches, and it does so without any prompt.
The good news is that your actual files are still on the drive. The bad news is that pressing Format wipes them just as effectively as any other Format — the files are hidden, not deleted, and Windows treats them like every other file it’s about to overwrite. Do not format the drive yet. On the bench, this is the point where I unplug the USB stick, plug it into a clean workstation running Windows Sandbox or a locked-down Linux machine, and start with the recovery step below before anything else.
2. First — Do Not Delete the Shortcuts
The shortcuts look like the problem, so the first instinct is to select all of them, hit Delete, and start again. Do not do that yet either. The shortcuts share their names with your real hidden folders, and depending on how Windows handles the delete (particularly when the drive is FAT32 and the entries are on the same short-name table), the delete operation can chain into the hidden entries and take your real folders with it. Even when it doesn’t, deleting the shortcuts before you unhide the originals leaves you looking at an empty drive and no obvious way to confirm the files are still there. Leave every shortcut in place until step 3 is done.
While you are being patient, disconnect the drive from the internet-facing PC where you first noticed the shortcuts, and unplug any other USB drive on that machine at the same time. The worm doesn’t always sit still — it monitors for new drives and infects them in the background — so if a second USB stick was mounted while the first one was there, treat it as suspect too.
3. Recover the Real Files with attrib — Five Minutes
This is the step that gives everyone their files back, and it takes about five minutes. Plug the affected USB drive into a PC that you are already going to clean anyway (there is no point in exposing a healthy PC to an active worm; use the same one that infected it and clean it fully in the next step). Open Command Prompt as administrator, work out which drive letter Windows has assigned to the stick — usually E:, F: or G: — and run:
attrib -h -r -s /S /D E:\*.*
Replace E: with your actual drive letter. What that command does, in plain terms, is walk every file and folder on the drive (/S for subdirectories, /D for directories themselves) and remove three attributes: hidden (-h), read-only (-r), and system (-s). Because the worm relied on setting all three to make the originals invisible, taking them off makes the originals appear again immediately. Open the drive in File Explorer and every real folder you used to have is back, sat next to a matching shortcut. Do not click the shortcuts — each of them is still a landmine that reinfects the current PC. Copy the real folders somewhere safe (an external drive, OneDrive, a second USB stick that has never touched this one) before doing anything else. On a fast drive with a couple of gigabytes of coursework and photos, this whole step is done in five minutes.
4. Find and Remove the Worm Itself
Once your files are copied off, the drive still contains the worm’s payload and often a leftover autorun.inf file from older variants. Show hidden and system files on the drive (View → Show → Hidden items, and untick “Hide protected operating system files” in Folder Options) and you will find one or two files that don’t belong — commonly a RECYCLER or System Volume Information folder with an .exe inside, or a small file with a randomly-generated name and no extension. On the host PC, run a full offline scan: Windows Security → Virus & threat protection → Scan options → “Microsoft Defender Offline scan”. That reboots the machine and scans before Windows loads user-space, which is the only reliable way to catch a worm that persists as a scheduled task or a registry Run key. Recent Defender builds catch the whole Gamarue/Bondat family cleanly, but I still like to follow it with a Malwarebytes scan for confidence — Malwarebytes tends to be quicker at flagging the LNK dropper variants that Defender occasionally treats as generic.
Windows Defender being turned off, or its exclusions list mysteriously containing your USB drive letter, is a symptom we go into on the Windows Security turned off malware guide — it’s a common trick the same worm families use to buy themselves more time, and worth checking whether Defender still looks normal or has been quietly disabled.
5. Check Every PC the Drive Has Touched
This is the step most tutorials skip and the one that decides whether the infection comes back next week. A USB worm doesn’t just live on the drive — the first thing it does on any PC it’s plugged into is drop a copy of itself into the user’s AppData folder and set a scheduled task or registry Run key so it launches again at every login. If the drive has been between the home PC, a partner’s laptop, a school computer, and a work machine, every one of those is a candidate to be reinfecting whatever drive is currently plugged in. Run the same Defender Offline scan on each PC, and check Task Scheduler for anything with a random-looking name whose “Actions” tab launches an .exe out of %APPDATA%\Roaming, %LOCALAPPDATA%, or %PUBLIC%. If you find one, delete it, then reboot and re-scan.
This is the same pattern of silent, self-hiding malware we covered in the hidden malware on a laptop that just runs hot and in the wider signs your PC has a virus guide — when the symptoms are quiet, the persistence trick is almost always a scheduled task or a Run key, not the file you can see. If any of the PCs is a small-business machine and the drive has been used between it and a home PC, this is the right point to escalate to a proper business IT support look at the whole workgroup rather than cleaning each machine one by one.
6. Reformat the Drive — But Only Now
Once every real file has been copied off and confirmed openable on the clean machine, and every PC the drive has touched has been scanned, then and only then is it safe to format the drive. Right-click the drive in File Explorer → Format → File system exFAT (better than FAT32 for anything over 4 GB and less brittle than the drive’s original NTFS), untick “Quick Format” for a proper full write, click Start. A full format on a 32 GB stick takes about ten minutes on a USB 3 port; on an older USB 2 stick it can be closer to half an hour. Wait for it to finish, then eject and re-insert the drive; the shortcuts and hidden payload are all gone and the stick is safe to reuse.
If the drive is the kind you would rather not risk (a branded stick from a supplier, or an SD card with important business data), and the shortcut-arrow trick appeared on it before you noticed, that is a case for a proper cleanroom look. It is possible for the worm to write its dropper into a hidden partition on lower-quality flash media, and formatting the visible volume doesn’t always clear it. That is the sort of drive we would rather image first as a data recovery job and then reformat — because if there was anything sensitive on it, we would rather it be gone properly than gone hopefully.
7. Stop It Happening Again
The two habits that keep this out of a household are simple. First, turn off AutoPlay on removable drives: Settings → Bluetooth & devices → AutoPlay → set “Removable drive” to “Take no action”. Modern Windows already blocks the old autorun.inf auto-execution, but AutoPlay still opens File Explorer to the drive automatically, which is enough for a curious click on a shortcut. Second, when you do plug a USB stick in, look at the icons before you click anything — if the drive’s contents are “all shortcuts”, close the window and treat the drive as infected until you have run the recovery steps above. Any USB drive that has been in a shared machine (a school library, a print shop on the High Street, a college computer lab) is worth a quick scan when it comes home, whether the icons look right or not.
For a home office that shares files between several PCs and a household USB drive, the cleaner long-term fix is to stop moving the stick around entirely — a small NAS drive or a shared OneDrive folder does the job without the transport risk. If you would prefer someone else looked at the affected machines rather than working through the checks yourself, a short remote support session is usually enough to run the scans and clear any scheduled-task persistence in about twenty minutes. And if the drive is critical — a business record, a dissertation, an accountant’s working file — bring it in physically and we’ll image it before anything else touches it.
Last updated: 19 September 2026