Your instinct is right, this is the classic shortcut virus and the good news within it is that the real files are almost always still there, hidden, not deleted, so recovery then cleanup:

Understand what happened, because it explains the recovery: the shortcut malware hides your real files and folders by setting them hidden and system, then creates shortcuts with the same names that, when clicked, both open your file and re run the malware, spreading it. Your real files take the same space as before because they are physically present and merely hidden, which is why recovery is usually complete.

Recover the real files, the attrib command: open an admin command prompt, navigate to the affected drive, X: and enter, then attrib -h -s -r /s /d *.* which clears the hidden, system and read only attributes from all files and folders recursively, making your real files reappear. This single command restores what the malware hid across the whole drive, the core recovery step.

Delete the shortcuts and clean the malware: once real files show, delete the fake shortcuts, which are the malware's decoys, then run a full malware scan with your antivirus and a dedicated tool like Malwarebytes, since the attrib command reveals your files but does not remove the malware that hid them and skipping the cleanup means it rehides them and reinfects other drives you connect.

Prevent reinfection, the loop this creates: the shortcut virus spreads through USB drives, so clean every drive that touched the infected machine with the same attrib and scan and disable autorun to stop it launching from connected drives, since the common pattern is cleaning one drive while an infected USB reinfects the machine minutes later, the cycle that makes this feel unfixable until every drive is cleaned together.