Follow these steps
1
Disconnect the flash disk from other computers to avoid spreading the infection.
2
On a clean Windows PC, open File Explorer and note the flash disk letter, for example E:.
3
Open Command Prompt as Administrator and type: attrib -h -r -s /s /d E:\*.* — replace E with your drive letter.
4
Delete only suspicious shortcut files (.lnk) after confirming your real folders are visible.
5
Run a full scan using Windows Security or trusted antivirus software on both the flash disk and computer.
6
Copy recovered files to a safe folder, then format the flash disk only after the backup is complete.