Understand the symptom before taking action.
Practical guides for shortcut malware, hidden files, recurring USB infections and the indicators observed during ANTÍDOTO development.
Shortcut virus: what it is, why it returns and how to remove it
When folders and documents are replaced by shortcuts, the problem may be on the external drive, in Windows, or both. The first goal is…
Read guide →USB drive full of shortcuts: what to do before formatting
If your USB drive turned into shortcuts and files seem to have disappeared, formatting immediately can destroy useful data without fixing the source of…
Read guide →Hidden files on a USB drive: why they disappear and what to do
The drive still shows used space, but folders are gone? USB malware can change file attributes and hide legitimate content without necessarily deleting it.
Read guide →Does the virus return after formatting a USB drive? Here is why
If a USB drive is formatted, appears clean, and turns into shortcuts again after connecting to the same PC, the source may be Windows.
Read guide →How to tell whether Windows is reinfecting USB drives
When different removable drives become affected after passing through the same computer, Windows is worth investigating as a possible source of reinfection.
Read guide →How to recover files hidden by USB malware
If malware hid your documents, the goal is to restore visibility without running suspicious shortcuts or destroying the original data.
Read guide →USB-Explorer.exe: what it is and how ANTÍDOTO identifies it
USB-Explorer.exe is a filename observed in the malicious USB infection pattern analyzed during ANTÍDOTO development. The filename alone is not a classification.
Read guide →GPLControl.exe: Windows persistence and reinfection
GPLControl.exe was observed in the real infection pattern that led to ANTÍDOTO, associated with startup persistence in Windows.
Read guide →MAYUNDO: how ANTÍDOTO detects and remediates the infection chain
Learn which MAYUNDO indicators ANTÍDOTO V1.6.3 correlates and what its controlled tests actually demonstrated.
Read article →Formatted the USB drive but it returned? MAYUNDO may persist in Windows
Why formatting a USB drive may leave a MAYUNDO-related infection source in Windows and how to prevent reinfection.
Read article →start.js and profile.js: when these files may be part of MAYUNDO
The names start.js and profile.js do not prove infection. See how ANTÍDOTO evaluates context and USB/LNK chains.
Read article →Did your files disappear? MAYUNDO may have hidden them
Missing USB files are not always deleted. Learn what was recovered in the MAYUNDO lab scenarios.
Read article →What is MAYUNDO? Understanding the USB shortcut threat
A clear introduction to MAYUNDO, symptoms on USB drives and what ANTÍDOTO testing has established.
Read article →How to recognize MAYUNDO indicators without misdiagnosing
A symptom checklist, correlated indicators and signs that alone cannot confirm MAYUNDO.
Read article →.lnk shortcuts and MAYUNDO: why an unexpected click is risky
Learn the difference between ordinary shortcuts and malicious associations on removable drives.
Read article →MAYUNDO and RunHelper: understanding Windows persistence
What the Run/Helper persistence observed in V1.6.3 MAYUNDO scenarios actually means.
Read article →wscript.exe and cscript.exe in MAYUNDO: what do they mean?
Why these Windows processes may appear in a script chain and must not be treated as malware automatically.
Read article →Files named 1.lock and 2.lock: are they MAYUNDO indicators?
Understand the contextual relevance of 1.lock and 2.lock without deleting legitimate files by mistake.
Read article →MAYUNDO on external HDDs and SSDs: what precautions apply?
External drives also carry files and shortcuts: understand risks and safe inspection steps.
Read article →MAYUNDO: how to preserve documents before cleanup
What to record and protect before correcting shortcuts, hidden files or suspected reinfection.
Read article →Windows ↔ USB reinfection: understanding a MAYUNDO-related chain
How Windows persistence can cause symptoms to reappear on removable drives.
Read article →MAYUNDO in offices: protecting shared computers and USB drives
Practical measures to reduce risky shortcuts and scripts on shared office computers.
Read article →How to run a free scan for MAYUNDO indicators with ANTÍDOTO
A walk-through of download, free Windows/USB scanning, reports and optional licensed remediation.
Read article →MAYUNDO V1.6.3 tests: what was and was not proven
Technical results, recovered documents and limitations of ANTÍDOTO’s MAYUNDO lab evidence.
Read article →MAYUNDO and false positives: why a suspicious filename is not enough
How to interpret indicators without accidentally removing legitimate scripts, shortcuts or processes.
Read article →Checklist: what to do when you suspect MAYUNDO on a USB drive
First-response steps to preserve files, avoid reinfection and document a suspicious USB drive.
Read article →Start with a free diagnosis.
ANTÍDOTO shows the indicators it finds before any remediation.