When different removable drives become affected after passing through the same computer, Windows is worth investigating as a possible source of reinfection.
Signs that the PC may be involved
Clean USB drives turn into shortcuts, the same executable appears on multiple drives, or the symptoms return shortly after connection. No single sign proves the source, but the combined pattern is meaningful.
Persistence worth checking
Run/RunOnce, Startup and scheduled tasks are legitimate Windows mechanisms that malware can also abuse. Diagnosis should distinguish expected entries from suspicious combinations of location, name, hash and behavior.
Avoid spreading the incident
Until the computer is analyzed, avoid connecting new USB drives or external disks used to move important files. This reduces the chance of extending the propagation cycle.
Confirm after cleanup
Remediation should be followed by a new scan of Windows and the external drive. The goal is to confirm that known indicators and supported reinfection mechanisms are no longer detected.
“No known indicator found” is different from promising that a computer contains no malware of any kind.
Scan first. Decide after.
ANTÍDOTO shows the detected indicators before remediation.