How to remove shortcut virus from USB

How to remove shortcut virus from USB – Dinihou – Houdini Worm.VBScript



What it is ? :

1 Star2 Stars3 Stars4 Stars5 Stars
(26 votes, average: 4.38 out of 5)

It’s a recent worm having already infected scores of computers all around the world. It is also called Houdini.
Depending on the antivirus used, it is detected as :

It is spread through USB peripherals such as pendrives, external drives, but also smartphones or digital cameras through their memory cards.
Once the media is connected, for users, the contents appear normal. Here’s a view showing 2 photos and a MP3 audio-file :

Shortcut virus

But here is what the key really contains (which is “hidden” to users).

Shortcut virus

On the file on the right, we can notice a small arrow in the bottom left corner of the icon; it means this is a shortcut, and may be a sign of the infection

Shortcut virus

In 1, we can see the shortcuts (visible to users) and we may think they are real files; but in fact, these shortcuts, once clicked, will launch the infection (2) and then, open the original file (hidden to users).
You feel you have launched the file you wanted, and you won’t be aware the malware has been launched a few milli-seconds before.


Shortcut virus

What it does ?

The file is a VBS (Microsoft Visual Basic script).
This type of script is commonly used by managers of operating systems and networks, to make small programs aiming at making repetitive tasks automatic.

Shortcut virus

Without entering technique too much,let’s say the malware is complexly encoded to camouflage itself, and so avoid detection by anti-virus.

Shortcut virus
Shortcut virus
  • Once loaded into the memory (RAM) of the computer, the malware  will make copies of its code in some precise folders of the system : temporary files and start.
Shortcut virus

  • It will make itself persistent, by creating 2 registry keys, in order to be launched when system re-starts
Shortcut virus
  •  it, then, will search for all removable peripherals, and infect them, thus, making new vectors of propagation.

On the hacker’s side :

The malware connects to the C&C server, to transmit some information :

  • Serial numbers of drives
  • Name of the computer and session
  • Operationg system
  • Name of the anti-virus (if any)
Shortcut virus

The hacker, thus, will be able to take control of the “victim” computer to :

  • Steal data
  • Update the malware (or delete it)
  • Install other malwares
  • He may also re-use the code, change it, enrich it

Here is a view of an ad for this type of malware :

Shortcut virus

Here is a view of a managing console (what the hacker can see on his scren) :

Shortcut virus
Shortcut virus

Even if the code is relatively simple, it is enough to corrupt the security of a whole organization, and retrieve personnal or confidential information from a great numberof people.

Shortcut virus

What to do ?

  • Not to be infected :

See this article :
In particular the passage : “How to avoid this type of infection?”

We recommend you, either firms, or particulars, to adopt a full antivirus protection like Bitdefender Internet Security.

bitdefender 2015

Bitdefender 2015 :

  • It offers protection against most viruses and other internet dangers
  • Light, silent, and quick
  • It protects your on-line shopping, and make your digital identification safe
  • It informs you about your children’s activities, and provide filter tools if needed
  • It integrates a firewall to protect your internet connexion
Get Bitdefender

If you are infected, UsbFix can deal with this type of infection.

  • Download UsbFix on your computer, and execute it.
  • It will launch automatically, and a shortcut will be created on your desktop.
  • Connect all your external data sources to your PC (Usb keys, external drives, etc…) Do not open them.
  • Choose “Clean” option.
  • A pop-up will follow :

Connect all your external data sources to your PC (Usb keys, external drives, etc…)

  • Once you’re ready, click “OK”.
  • While cleaning, you will loose access to your desktop, but this is normal.
  • The numbers of analysed and infected éléments are displayed.
  • Once cleaning is over, you’ll be suggested to donate the author, El Desaparecido.
  • Donation is not compulsory, but is useful to go on developping the software, and meet the expense to maintain our website server.
  • Once you’ve made a choice, a report will open.
  • You can find a copy of this report on your desktop, and another at : C:\UsbFix\Log\UsbFix [Clean 1] Your PC.txt
  • Copy/paste it on the board you’ve asked for help.
  • If you are not taken care, we invite you to create a subject on the forum of disinfection SosVirus and to transmit the report for analysis.

Free Support

Forum SosVirus
All Tutorial

Help UsbFix

Rate this post :

1 Star2 Stars3 Stars4 Stars5 Stars
(26 votes, average: 4.38 out of 5)


  1. KAT August 9, 2015 at 11:14 AM

    i got an error, 44205,,, what is this?

    • KAT August 9, 2015 at 11:17 AM

      but it worked anyway! THANX a zillion! 🙂
      Sorry I am somewhere I can’t donate from…

  2. Star Cab May 7, 2015 at 6:42 PM

    hello!! so i tried it on my computer. and i checked my usb and those little shortcut arrows disappeared. does that mean my computer and usb is now safe to use (safe for other usbs and for other computers)? if so thanks so much!!! can’t donate right now but i’ll definitely share it!!

    sorry i’m pretty much a noob and desperate since i’m almost at the end of my thesis. i think i saw a fellow university student here who experienced the same problem. can’t remember which computer shop i got it from though.

  3. hopa January 26, 2015 at 2:02 PM

    checking if letting to comment

  4. uzuacious January 13, 2015 at 4:20 AM

    thanks even though I had to format my system some time ago because I could not get rid of it by any means then. wish I had this software then

  5. Lelia November 22, 2014 at 11:43 PM

    I will try it thnxs

  6. PunKizz October 29, 2014 at 2:03 AM

    TE AMOOOO!!!!!!

  7. ekramy October 29, 2014 at 12:00 AM


  8. bhea October 24, 2014 at 10:43 AM


  9. Olore Adewale October 6, 2014 at 12:09 AM

    Thanks, it worked. You guys just saved my day!

  10. joyerivero October 2, 2014 at 2:36 AM

    Voy a probarlo!!. Muy buena la explicación.

  11. ernest October 2, 2014 at 12:37 AM

    thanks guys….i am fully relieved!!!

  12. Joseph September 23, 2014 at 5:37 AM

    Woow. This software is a life saver my autorun problem is now solved. :))

  13. Gunners September 16, 2014 at 2:42 PM

    Thanx, USBFix remove the virus succefully after a lot of tries with other tools .. thanx again ..

  14. Insiya September 12, 2014 at 7:33 AM

    this totally works, thankyou! i tried so hard to remove the shortcut virus from USB/ flash drive and nothing worked, but USBFIX did the work in less than 5 minutes thankyou!

  15. ankit July 21, 2014 at 4:12 PM

    thank you very much. realy it works….

  16. ahmed atef July 13, 2014 at 1:57 PM

    1st thank u very much for your hard work
    2nd there is no other solution on the web dose any thing for this shortcut virus
    i searched for 5 days and crabs keep coming up rather from youtube or another shit site
    but you are a pro , this usbfix worked perfectly and remove the virus from my labtop and my flash-driver
    thank you again

  17. nicky July 11, 2014 at 10:14 AM

    thanku….vry much yo guyz save my laptop thankuuuuuuu thankuuuu am vry fan of urs usb fix
    its..just not only work its totally fucked tha..basterd shortcut virus am vry haappy to downlod this thank

  18. Bella July 4, 2014 at 9:59 PM

    It’s hard to find your blog in google. I
    found it on 22 spot, you should build quality backlinks , it will help you to rank to google top 10.
    I know how to help you, just type in google – k2 seo

  19. dlaryea July 4, 2014 at 6:01 PM

    Thanks a lot for saving me from my frustration. I have tried antiviruses and malwares but non fixed this problem. Thanks t USBFix I was able to fix the shortcuts. God bless you.

  20. Perfect June 23, 2014 at 5:12 PM

    perfect explanation, i will try to fix it, it also infect my symbian nokia e7 with word wia bluetooth…

  21. Michelle June 20, 2014 at 9:37 AM

    This was probably the most informative and easy to understand article I have read in a long time! I actually understood it and learned from it.

    Thank you so much!

  22. saikat guha June 16, 2014 at 1:46 PM

    thank u it really worked. i have shared it on my facebook wall. may others benifit from it.btw i noticed a small thing. if any virus file is being accesed by your app then avira antivirus will pop up and ur process is paused even though i deactivated avira realtime protection

  23. kalaiselvan May 26, 2014 at 11:48 AM

    oh…it really works welll…thanks for the developer

  24. Baby May 22, 2014 at 3:21 PM

    It really worked !!!!!! Thank you very much….I recommend it for all who are facing problems from vbs virus…

  25. Karim May 19, 2014 at 1:24 AM

    Thank you very much, it really worked, this worm was just annoying, good job guys

  26. Ashraf George May 8, 2014 at 2:29 AM

    wow thanks guys this really works , this virus really had its effect on me but your meathod solved the problem with out deleting my files thanks

    • rkpaluri July 30, 2014 at 7:24 AM

      For months, I was worrying whether I will be able to view my data and photos.Wow! USBFix is certainly doing a wonderful job by removing the shortcut virus. However, it is not permanently solving the problem. Everytime I attach my mobile hard disk, I find the shortcuts appearing again and I have to use USBFix. Also, there is no information on what is ‘vaccination’. Could anyone guide me on how to fix the shortcuts permanently. Thanks in advance.

      • El Desaparecido
        El Desaparecido July 30, 2014 at 8:04 AM


        Everytime I attach my mobile hard disk, I find the shortcuts appearing again

        So, connect this disk on your computer and Run UsbFix with Clean option : )

        For “vaccination”, in french sorry .. , La vaccination à l’heure actuelle n’est plus vraiment utile car Microsoft depuis Windows Vista, a désactivé la lecture automatique des médias amovibles.
        Il est vrai que je communique peut sur ce point. Tout simplement parce que je travail sur une nouvelle méthode de vaccination qui se transformera certainement par un module de protection en temps réel.

        Best Regards.

        • rkpaluri July 31, 2014 at 4:45 AM

          Sir, what I am asking is whether there is any solution for permanently solving the problem without running USBFix again and again, because, eventhough I clean with USBFix, everytime I remove the mobile hard disk and attach it again to the computer, the shortcuts are reappearing.

          Best regards.

Leave A Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.