Home Guides How to remove drive.bat shortcut virus

How to remove drive.bat shortcut virus

2 min read
Get rid of drive.bat computer virus that makes data on thumb drives and SD memory cards inaccessible by replacing their folders and files with shortcuts.

The ill-famed shortcut virus has become a buzzword over the years that’s it has been circulating, but not everyone knows there’s a number of its spinoffs that operate somewhat differently. One of the mutations spreads via a Windows batch file named drive.bat, which is effectively an object that forces the host operating system to execute certain commands. Regarding the concept proper, it’s quite bizarre that an infection as ostensibly primitive as this is still in the wild in the era of high-profile threats like ransomware, rootkits and banking trojans. And yet, the fact remains that lots of users around the globe keep catching the thumb drive shortcut malware through physical means, that is, by inserting their removable media into contaminated computers which, most likely, got infected via a virus-tainted memory stick themselves. Why the cybercrooks behind this plague are distributing it is quite a puzzle, but it does cause a lot of harm to victims despite the whole simplicity.

drive.bat shortcut virus
drive.bat shortcut virus

Now, back to the point – the drive.bat virus transforms all the contents of an infested memory medium into shortcuts, usually 1 KB in size, which open up blank or cannot be opened at all. At the first blush, this predicament looks like a complete loss of data stored on the drive. In fact, though, the infection simply corrupts the display of data hierarchy, which is good news to anyone that’s hit. A thumb drive becomes a carrier of the contagion when it’s plugged into a Windows machine with the virus on board. The PC, in its turn, may get exposed to the malady after the user unknowingly downloads the drive.zip file off of the Internet. This may be a stealthy drive-by download invisible to the naked eye, or a part of a bundle trespassing on the system with packaged installations of freeware or shareware. One way or another, the drive.zip archive is automatically extracted to every USB drive or SD card inserted into the computer henceforth. So much for the propagation routine.

Once drive.bat is copied to removable media, it runs automatically and causes all the files and directories to morph into shortcuts. Another likely adverse effect is the termination of popular antimalware suites running on the system at the time of the attack. This is, obviously, a more straightforward and aggressive methodology than the commonplace AV evasion. To top it off, the virus may also prevent the victim from accessing Registry Editor. Fortunately, all the information hidden behind the veil of shortcuts can be reinstated in its original form. Peruse the troubleshooting part below to find out how.

Automated removal of drive.bat virus

Owing to an up-to-date database of malware signatures and intelligent behavioral detection, the recommended software can quickly locate the infection, eradicate it and remediate all harmful changes. So go ahead and do the following:

1. Download and install the antimalware tool. Open the solution and have it check your PC for PUPs and other types of malicious software by clicking the Start Computer Scan button

Download drive.bat shortcut virus remover

2. Rest assured the scan report will list all items that may harm your operating system. Select the detected entries and click Fix Threats to get the troubleshooting completed.

Use batch file to remove drive.bat virus and restore data

• Open Notepad and paste the following command in it, replacing “F” with the infected drive name:
@echo off
attrib -h -s -r -a /s /d F:*.*
@echo complete

Batch command in Notepad

• Save the Notepad file as fixvirus.bat or similar – the .bat part is mandatory.
.bat file to be executed

• Double-click the .bat file you just created. This will run the executable. The shortcuts for affected drive and its contents should now be replaced with normal data objects. If this didn’t help, try the following recommendations.

Use Command Prompt to fix the drive.bat problem

• Type cmd in your Windows Search box and press Enter to open the command-line interface
Open command-line interpreter

• Now type the following string in the command-line interpreter (put the name of the infected drive instead of “F” in the example):
attrib -h -s -r -a /s /d F:*.*
CMD string to fix drive.bat issue

• Hit Enter to execute the command. You should be good to go now.

Revise your security status

Post-factum assessment of the accuracy component in malware removal scenarios is a great habit that prevents the comeback of harmful code or replication of its unattended fractions. Make sure you are good to go by running an additional safety checkup.

Download drive.bat shortcut virus removal tool


  1. Jelo Fojas

    February 7, 2017 at 3:11 pm

    is this legit ?


  2. Atif Ali Bashir Ibrahim

    February 21, 2017 at 10:11 am

    I am facing a problem with this virus file. please send me the procedure to get rid of it. thanks


  3. Hubert Monzon

    February 4, 2018 at 3:24 pm

    Is this process correct too?

    first i display hidden files.

    I tried deleting the folder inside c:/Users/lg(may vary)/AppData/Roaming,then find the unusual named file with “.js” files inside it. Then, delete it,at first you can’t delete it because it is running in microsoft host blah blah, so you have to open task manager and end process the microsoft host blah blah (?) from processes tab, then after that, delete the folder with .js files…


  4. mike

    November 9, 2018 at 12:30 am

    ive done this several times and not able to get past the cmd command
    always says access denied. ive made the external drive as im owner and still not able to do this


Leave a Reply

Your email address will not be published. Required fields are marked *