All Folders Turned into Shortcuts in Windows: How to Fix It

Folders Turned into Shortcuts in Windows: What It Usually Means

If every folder on a drive suddenly appears as a small shortcut with an arrow icon, the most common cause is shortcut malware. This type of infection usually hides your real folders, creates fake .lnk shortcut files with the same names, and runs a malicious script when you open one of those shortcuts.

How to Recognize a Shortcut Virus on a USB Drive or Disk

The problem often appears after using a USB drive on another computer, copying files from an unknown source, or connecting a memory card to an infected PC. The drive may look almost normal, but the visible folders are actually shortcut files.

First Actions Before Fixing Shortcut Folders in Windows

Treat the affected drive as potentially infected until you finish scanning. The goal is to avoid launching the malware again while still preserving the original files.

1. Do not double-click any shortcut that appeared unexpectedly on the drive.
2. Disconnect other USB drives, external disks, cameras, and memory cards from the computer.
3. Do not copy the fake shortcut files to another computer.
4. Open File Explorer using Win + E, but avoid running unknown files from the affected drive.
5. If the drive contains critical business or legal files, make a read-only image or ask a professional recovery service before deleting anything.

Show Hidden Files to Check Whether Your Original Folders Still Exist

Shortcut malware often does not delete the original folders. It marks them as hidden and system-protected, then places shortcuts in front of them. First, make Windows show hidden items.

Windows 11

1. Open File Explorer.
2. Click View on the command bar.
3. Select Show and enable Hidden items.
4. Click Options, open the View tab, and temporarily disable Hide protected operating system files.

Windows 10

1. Open File Explorer.
2. Go to the View tab.
3. Enable Hidden items.
4. Open Options → View and temporarily clear Hide protected operating system files.

Recover Hidden Folders with the Attrib Command

If the drive still shows used space but your folders are hidden, use Command Prompt to remove the hidden, system, and read-only attributes from files and folders on the affected drive.

1. Connect the affected drive to a computer that has antivirus protection enabled.
2. Open Start, type cmd, right-click Command Prompt, and choose Run as administrator.
3. Run the command below, changing the drive letter first.

Command Prompt — replace E: with your drive letterattrib -h -r -s /s /d E:\*.*

After the command finishes, open the drive again. The original folders should become visible. If you see both real folders and fake shortcuts, open only the real folders. Do not open the shortcut copies.

Scan the Infected Drive and Remove Shortcut Malware

Recovering hidden folders is not the same as removing the infection. You still need to scan the computer and the affected drive. Otherwise, the shortcuts may return after the next reboot or when you connect another USB drive.

Run a Full Scan in Windows Security

1. Open Start and search for Windows Security.
2. Open Virus & threat protection.
3. Click Scan options.
4. Select Full scan and start the scan.
5. After that, scan the removable drive directly from File Explorer if the option is available in the context menu.

Delete Malicious Shortcuts, Autorun Files, and Script Leftovers

After scanning, you can remove obvious remnants from the affected drive. Be careful: delete fake shortcuts and suspicious scripts, not your recovered folders.

Items that are often safe to remove after recovery

• Shortcut copies of your folders with the .lnk extension.
• Unknown .vbs, .js, .cmd, .bat, or .scr files in the drive root.
• Suspicious autorun.inf files on removable media.
• Duplicate folders with strange names, random characters, or executable extensions.

You can also use Command Prompt to list shortcut and script files on the affected drive before deleting anything:

List suspicious file types — replace E: firstdir E:\*.lnk /a

dir E:\*.vbs /a

dir E:\*.js /a

dir E:\*.cmd /a

dir E:\autorun.inf /a

Check Windows Startup if Shortcut Folders Keep Coming Back

If the same drive gets infected again immediately, the malware may still be launching from the Windows user profile, Startup folder, Registry, or Task Scheduler. Check these areas only after running antivirus scans.

When You Should Back Up Files and Format the Drive

If the affected drive is removable, formatting it after recovery is often the cleanest final step. Format only after you have copied the real files to a safe location and scanned that backup location.

How to format after recovery

1. Copy recovered files to a clean folder on another drive.
2. Scan the copied files with antivirus software.
3. Open This PC.
4. Right-click the affected removable drive and choose Format.
5. Use exFAT for broad compatibility or NTFS for Windows-only storage with permissions and large files.
6. After formatting, copy back only clean, recovered files.

How to Prevent Folders from Turning into Shortcuts Again

Shortcut malware spreads mostly through removable drives and careless execution of scripts. Prevention is mainly about keeping automatic execution disabled, scanning unknown drives, and avoiding suspicious shortcuts.

• Keep Windows Security and security intelligence updates enabled.
• Scan USB drives before opening files from them.
• Do not open unexpected .lnk, .vbs, .js, .cmd, or .scr files.
• Keep file extensions visible in File Explorer so fake files are easier to notice.
• Avoid using personal USB drives on untrusted public computers.
• Back up important files to at least one location that is not always connected to the PC.

Show file extensions in Windows

1. Open File Explorer.
2. In Windows 11, choose View → Show → File name extensions.
3. In Windows 10, open the View tab and enable File name extensions.

FAQ: Folders Became Shortcuts in Windows

Related Windows Troubleshooting Articles