The Pen Drive That Turned Files into Shortcuts
Rohit copies a 38-slide presentation and 12 photographs onto a 16 GB pen drive to print at a cyber café near the bus stand. The folder is named Final Project. At the café he opens the drive and finds that the folder's icon has changed to a shortcut, the original folder is invisible, one file is named project.docx.exe, and the drive shows 12.5 GB free. He had not scanned the drive, and the café computer had no antivirus. When he reaches school, the office Windows computer says the .docx file is “in use by another user” although nobody else has it open. His teacher needs the printout the next morning. The school has one Windows computer with updated antivirus and one Linux computer.
1. What has most likely happened to the pen drive? Identify the evidence and explain why double-clicking the shortcut is dangerous.
Read the worked answer
The evidence strongly suggests a USB shortcut worm, a class of malware that spreads through removable drives:
- The real folder is hidden and replaced by a shortcut with the same name.
- A file has a double extension, project.docx.exe; Windows may hide the .exe and show it as a Word document.
- The café PC had no antivirus, which is a common infection route.
- Free space has changed, suggesting hidden files or copies.
Double-clicking the shortcut can run the malware, which may copy itself to the school computer, hide more files and create more shortcuts. It may also install a startup entry so that it returns after cleaning.
However, the evidence does not prove that the document content is destroyed. The original files are often still present but hidden and marked with system attributes. The safe assumption is that the drive is infected until scanned, and it must not be connected to a shared school computer without protection.
2. Give an ordered recovery plan using only the school's Windows and Linux computers, and explain the “in use by another user” message.
Read the worked answer
Recovery order matters:
- Do not double-click anything on the drive. On the Windows PC, disable Autorun/Autoplay for removable media first.
- Scan the pen drive with the updated antivirus and note what it detects; do not delete files until the report is clear.
- On the Linux PC, mount the drive read-only and copy the photographs and presentation to a new folder. Linux does not run Windows .lnk shortcuts or .exe files automatically, so it is safer for copying.
- On Windows, enable “show hidden files” and “show file extensions”, remove the shortcut files and any autorun.inf, then scan again.
- Copy the recovered files to a clean, newly formatted pen drive; scan once more before printing.
The “in use by another user” message usually comes from a temporary Word lock file such as ~$project.docx, left behind when Word crashed, or from the file being open on another machine. Close Word, delete the stale lock file if it is safe, or open a copy under a new name.
3. Explain why showing file extensions and using clear file names would have helped Rohit, and state two file-naming rules he should follow.
Read the worked answer
Windows hides known file extensions by default. With extensions hidden, project.docx.exe appears as “project.docx” with a Word icon, so a dangerous executable looks like a document. Turning on “file name extensions” in File Explorer makes the true type visible and gives Rohit a chance to stop before running it. The same setting helps him notice that a file is really a .lnk shortcut rather than the folder itself.
Two practical naming rules:
- Use a descriptive name with date and version, such as
Class10_Project_Rohit_2025-02-10_v2.docx, so the latest copy is identifiable without opening it. - Avoid spaces at the start or end, and avoid the characters
\ / : * ? " < > |, which Windows does not allow in file names; keep the extension correct rather than typing it manually.
He should also keep a second copy by email or cloud storage, because a single pen drive is a single point of failure. The backup should be scanned before it is restored.