Files hidden by trojan in USB can make important data seem missing. This guide explains how to unhide files hidden by virus in USB and safely recover lost data using proven Windows methods and recovery tools.
Unable to access data in flash drive infected by a Trojan: Win32/Lodbak.
I have cleaned a flash drive infected by a Trojan: Win32/Lodbak. When I access it, it only shows a shortcut to my drive. When I click the shortcut, it gives an error. What should I do to access data? Thanks in advance.
- Question from Ahmed
USB flash drives are widely used for transferring and storing important files, so it can be alarming when your data suddenly seems to disappear. Many users encounter a situation where files hidden by Trojan in USB make the drive appear empty, even though the used space clearly shows the data is still there. This not only interrupts normal work but also raises concerns about possible data loss or infection spread.
In most cases, the files are not truly deleted. Instead, a Trojan virus modifies file attributes or creates malicious shortcuts that hide the original data. Common signs include folders turning into shortcuts, files becoming invisible in File Explorer, unexplained autorun behavior, or the USB showing occupied space with no visible content.
Before attempting to unhide or recover files hidden by Trojan, you must first eliminate the Trojan infection. If the malware remains active, it can repeatedly hide files, recreate malicious shortcuts, or even spread to your computer. Performing a clean and thorough scan ensures the USB environment is safe and prevents newly recovered data from being affected again.
✂️Disconnect from the internet (temporarily). This reduces the chance of the Trojan downloading additional payloads during cleanup.
🛠️Remove Trojan Virus on your USB. Scan the USB with Microsoft Defender or a reliable antivirus program. Follow these steps to remove the Trojan from USB drive:
Step 1. Insert the USB into your computer. It’s best to use a virtual machine or an old, unimportant computer. Even if the virus spreads, it won’t affect your main computer.
Step 2. Locate the USB drive in File Explorer and right click on it, then choose "Scan with Microsoft Defender" from the context menu. This will perform a quick scan of your drive without taking too much time.
Step 3. If any suspicious files or threats are detected, remove or quarantine them.
Step 4 (Optional). If needed, you can select "Full Scan" after the quick scan to perform a comprehensive scan of all hard drives, running programs, and files on your computer. However, this will take a longer time.
💡Delete suspicious shortcut files and autorun.inf (if present). These are commonly created by USB Trojans to mask real folders.
💽Safely eject and reconnect the USB after cleaning. This helps confirm the malware is no longer actively modifying the drive.
After confirming the USB is clean, the next step is to restore visibility of your data. Trojan infections typically hide files by modifying attributes rather than deleting them, so recovery often starts with simple visibility fixes and progresses to deeper methods if needed. Follow the solutions below in order to safely recover your files.
In many cases, Trojan malware only changes file attributes to Hidden or System, which prevents File Explorer from displaying them. Enabling hidden file visibility is the quickest and safest first step. This method does not modify your data and works well when files still physically exist on the USB but are simply concealed.
Step 1. Insert the cleaned USB drive and open File Explorer.
Step 2. Click the "View" tab and check the box of "Hidden items". If files appear, copy them immediately to another safe location.
In addition, Trojan viruses can also target system-protected files that are already hidden. These files are critical for the proper operation of the operating system. You can check them using the steps below to ensure they are safe.
Step 1. Open File Explorer and go to "View" tab.
Step 2. Expand "Options" and click "Change folder and search options".
Step 3. Under the "View" tab, uncheck the "Hide protected operating system files (Recommended)" option and click "Yes" to confirm the changes.
If File Explorer still shows an empty USB, the Trojan may have applied more restrictive attributes. Using the attrib command can forcibly remove hidden, system, and read-only flags in bulk. This method is more powerful and commonly resolves files hidden by Trojan without altering file content.
Step 1. Type "Command Prompt" in the Start menu and right click on it, then choose "Run as administrator".
Step 2. Enter the following command: attrib -h -r -s /s /E *.*. Replace the drive letter "E" with your actual USB letter.
Step 3. Wait for the process to complete. Open the USB to check if the hidden files by Trojan reappear. If your data becomes visible, back it up immediately to prevent future issues.
If the hidden files in your USB still do not show up, it may be because the Trojan has deleted your files. In such a case, the professional data recovery software MyRecover can help you quickly recover the files deleted by the virus. Its read-only scanning technology locates recoverable data without writing to the infected drive, making it safe for beginners. It features a user-friendly interface and a high recovery success rate. Even beginners can complete data recovery independently with just a few clicks.
Step 1. Download and install MyRecover on a healthy drive (not the USB) from Microsoft Store.
Step 2. Launch MyRecover and select the infected USB drive, and click "Scan" to search for recoverable files.
Step 3. After scanning, select the files you want to restore from the recoverable lists and click "Recover".
Step 4. Choose a different safe location to save the recovered files.
Once the recovery process is done, the message "Files have been recovered successfully" will pop up. Then, you can access the recovered files in the destination folder by clicking on the "Browse" button.
After successfully recovering your files, it’s important to strengthen your USB security practices. Trojan infections commonly spread through removable media, but most incidents can be avoided with a few preventive habits. Implementing the following measures will significantly reduce the risk of future infections and help keep your data safe.
🔥Always scan USB drives before opening: Make it routine to right-click the drive and run an antivirus scan, especially when using USB devices from unknown or shared computers.
🔥Avoid using USB drives on untrusted machines: Public or shared computers are frequent sources of shortcut viruses and Trojans that silently modify USB contents.
🔥Keep your antivirus and system updated: Regular updates ensure your security software can detect newer variants of USB-borne malware.
🔥Back up important USB data regularly: Maintain copies on your computer or cloud storage so you can recover quickly if the drive becomes infected or corrupted.
🔥Use write protection when possible: If your USB drive has a physical write-protect switch, enable it when transferring files to prevent unauthorized modifications.
In summary, files hidden by a Trojan in a USB drive are often not lost but deliberately concealed through modified attributes or malicious shortcuts. By first ensuring the USB is completely clean, users can safely restore visibility using File Explorer settings or the attrib command.
If the malware has actually deleted data, professional recovery software like MyRecover provides a reliable fallback. Upgrading to Professional edition of MyRecover, you can enjoy unlimited data recovery capability and get files back from crashed Windows.