Windows shortcuts are legitimate files used to open programs or documents. In a USB/LNK infection, however, a shortcut created without permission may point to an unexpected script or executable instead of the intended document.
What makes a shortcut suspicious
A USB drive where every folder suddenly becomes a shortcut deserves attention. Other warning signs include targets invoking scripting tools, unusual paths and real documents that seem hidden.
Risks of opening it
A malicious shortcut can launch components containing instructions the user never sees. Even if a folder eventually opens, that does not prove the steps leading to it were safe.
What to do
Do not execute newly created shortcuts or copy them to other USB drives. Scan the drive and Windows, preserve original data and only then remove components confirmed to be part of the infection chain.
How ANTÍDOTO helps
The V1.6.3 MAYUNDO engine can correlate shortcuts, scripts, persistence and hidden content. In validated scenarios, remediation addressed the identified chain and recovered affected legitimate documents.
Related reading
- start.js and profile.js: when these files may be part of MAYUNDO
- Did your files disappear? MAYUNDO may have hidden them
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.