A USB drive with hidden files may be infected, but it may also have permission or filesystem problems. Responsible identification starts by observing multiple indicators, not diagnosing a threat from the first symptom.
Symptoms worth investigating
Unexpected .lnk shortcuts; folders that appear to have vanished; new scripts in unusual locations; the same behavior on different USB drives; and symptoms returning after reconnecting a device.
Indicators requiring context
Files named start.js and profile.js, wscript.exe/cscript.exe processes, startup entries and specifically named artifacts can be legitimate. Behavior, origin and relationships are essential.
How to document the incident
Note when the shortcuts appeared, which devices were used, whether other computers show symptoms and whether drive space is still used. Save a scan report and preserve original documents before repairing attributes.
When not to call it MAYUNDO
If there are only hidden folders or a single JavaScript file, there is not enough evidence. Look for a compatible chain and treat uncertain findings as suspicious items needing verification.
Related reading
- What is MAYUNDO? Understanding the USB shortcut threat
- MAYUNDO and false positives: why a suspicious filename is not enough
A safer scan with ANTÍDOTO
If you recognize these symptoms, you can download ANTÍDOTO and run a free scan of Windows and external devices. Review the findings before deciding on remediation, which requires a license. See the licensing plans and Resource Center. Detections and outcomes depend on the individual case.