Do not double-click an unexpected .lnk file on a USB stick, as it may execute malware. 2. Right-click the file and check its Properties, especially the Target field, to see if it points to a suspicious executable or script. 3. Enable viewing of hidden files via File Explorer and Folder Options to reveal any hidden malicious files like .exe, .vbs, or .ps1 with the same name. 4. Delete both the .lnk file and any associated hidden malicious files, then empty the Recycle Bin. 5. Scan the USB stick with trusted antivirus software such as Windows Defender or Malwarebytes. 6. Optionally, back up clean files after scanning and perform a full format of the USB drive to ensure complete removal. 7. Prevent future risks by disabling AutoRun for removable drives in AutoPlay settings, keeping antivirus software updated, avoiding unknown USB sources, and scanning external drives before use. Always treat unexpected .lnk files as potentially harmful and inspect before interacting.

If you find an .lnk file on a USB stick, it’s important to handle it carefully—especially if you didn’t create it. .lnk files are Windows shortcut files, and while they can be harmless, they’re often used in malware attacks to execute malicious code when opened. Here's how to deal with one safely and effectively.

Understand What an .lnk File Is

A .lnk file is a shortcut created by Windows to point to another file, folder, or program. Normally, they’re created when you pin something to the Start menu or desktop. However, malware can generate hidden malicious files and use .lnk files to automatically execute them—especially through features like AutoRun.

Be suspicious if:

• The .lnk file has a generic name like autorun.lnk, open.lnk, or photos.lnk
• It appeared out of nowhere on a USB stick
• The USB stick also contains hidden executable files (like .exe, .bat, .vbs)

Do NOT Double-Click It

Never open the .lnk file by double-clicking it. Malicious shortcuts can trigger scripts or executables without your knowledge, especially if the target file is a disguised payload.

Instead:

• Right-click the file and choose Properties
• In the "Target" field, check what file or command it’s pointing to
• If the target is a suspicious .exe, .bat, PowerShell command, or script, do not proceed

Safely Inspect and Remove It

1. Enable viewing of hidden files

   • Open File Explorer → View tab → Check "Hidden items"
   • Also go to Folder Options → View → Select "Show hidden files, folders, and drives"

2. Look for hidden malicious files
   Often, malware creates a hidden .exe or script on the drive and pairs it with a .lnk file to run it. Check for files with the same name as the shortcut but with .exe, .js, .vbs, or .ps1 extensions.

3. Delete both the .lnk and any suspicious associated files

   • Delete the .lnk file
   • Delete any hidden executable that matches its target
   • Empty the Recycle Bin afterward

4. Scan the USB stick with antivirus software
   Use a trusted antivirus tool (like Windows Defender, Malwarebytes, etc.) to scan the drive thoroughly.

5. Consider formatting the USB stick (optional but safe)
   If you're unsure whether all traces are gone, back up any clean files (after scanning them), then format the drive using the full format option—not quick format.

Prevent Future Issues

• Disable AutoRun for USB devices:
  Go to Settings → Devices → AutoPlay and turn it off for removable drives.

• Keep your antivirus updated.

• Avoid using USB sticks from unknown sources.

• Regularly scan external drives before opening any content.

Basically, treat unexpected .lnk files like suspicious links online—don’t click, inspect first, and remove if in doubt.

The above is the detailed content of How to handle an lnk file found on a USB stick. For more information, please follow other related articles on the PHP Chinese website!