One of the common method that virus use to spread themselves is through USB flash drives. All they need to do is create an autorun.inf file at the root of the USB flash drive and points it to a malicious executable file. When the USB flash drive is plugged in to a computer that is running Windows, double clicking the drive letter from My Computer will immediately process the autorun.inf file and launching the virus… That’s why I always advice people NOT to access the USB flash drive from My Computer. Use the shortcut key [Win + E] to open up Windows Explorer then go to the USB flash drive letter.
Another way is to scan the USB flash drive right after plugging in. It’s not perfect, but at least an updated antivirus program will protect you from most viruses. I believe most of us don’t scan our pen drive before using. The only people I know that does that is a bunch of teachers in an institute where the printers are connected to the their laptop. So whenever student wants to print a document, they’ll plug in their USB flash drive to the teacher’s laptop.
Since manually scanning USB flash drive is troublesome, I found a way to automatically scan the USB flash drive whenever it is inserted or plugged in to a Windows computer.
USBVirusScan is a small program that will launch any program you provide as a command line parameter each time a USB stick is inserted. The author use it to start a full virus scan on the inserted USB drive, hence the name. If not, I think maybe he’ll call it “USBConnectRUN” or something similar since it can use to run any program when a USB flash drive is plugged in. USBVirusScan is definitely not for beginners because it doesn’t have graphical user interface (GUI). The configuration is done from a batch file and it only has an About screen that looks like the image below.
Many people thought that USBVirusScan is an antivirus program but it’s NOT. It is a monitoring tool to detect if a USB flash drive has been plugged in the computer and will automate running any programs. If you’re still unsure of how USBVirusScan works, you can see it in action at YouTube. The video will show that the batch file (start.bat) which contains the configuration is being launched first. Then a USB flash drive is connected. USBVirusScan detected the USB flash drive and immediately runs McAfee antivirus to scan the drive.
Can’t see anything from the low quality youtube video? Download a high resolution video here and play it on your favorite media player.
Basically you’ll need an antivirus installed first. Then you’ll need to find out the command line that can perform a scan. Once you have the command line, just edit the start.bat file. I know the command line part can be a bit confusing for computer beginners. So I’ve provided a few command line for some popular antivirus.
AVG FREE 7.5
USBVirusScan.exe "C:\Program Files\Grisoft\AVG7\avgscan.exe" /clean %%c:Kaspersky Anti-Virus 7
USBVirusScan.exe "C:\Program Files\Kasperksy Lab\Kaspersky Anti-Virus 7.0\avp.com scan /i3 %%cKaspersky Internet Security 7
USBVirusScan.exe "C:\Program Files\Kasperksy Lab\Kaspersky Internet Security 7.0\avp.com scan /i3 %%cNorton AntiVirus 2008
USBVirusScan.exe "C:\Program Files\Norton Antivirus\navw32.exe" %%c:ESET NOD32 Antivirus
USBVirusScan.exe "C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe" /action=clean %%c:ClamWin
USBVirusScan.exe "C:\Program Files\ClamWin\bin\clamscan.exe" --database="C:\ProgramData\.clamwin\db" %%c:
Note: ClamWin is a bit tricky because you need to specify the virus definition database location. What I provided above is the default database location in Windows Vista. To check the location of the virus definition database, run ClamWin, go to Tools > Preferences > File Locations.
Windows Defender
Not Supported because doesn't offer scanning specific locationBitDefender
Not Supported because doesn't have command line scanningAvira AntiVir PersonalEdition Classic
Not Supported because doesn't have command line scanningMcAfee VirusScan 12
Not Supported because none of the Home products has this featureavast! 4 Professional
USBVirusScan.exe "C:\Program Files\Alwil Software\Avast4\ashCmd.exe %%c /P=[31]
Note: avast! 4 Home Edition does not support command line scanning.
There are other features such as hiding USBVirusScan from appearing and etc. Do check out the official website for more information.
[ Download USBVirusScan | USBVirusScan Website ]
Related posts:
Hello Aermus,
Use the folowing code for “Forefront Client Security” :
START “IE” “C:\USBVirusScan\USBVirusScan.exe” -d “C:\Program Files\Microsoft Security Client\AntiMalware\MpCmdRun.exe” -scan %%c:
The location of USBVirusScan can differ. Fill in your own location instead.
Regards,
Wesley
Has anyone figured this out yet?
Thanks in advance,
Aermus
I figured out this code but it does not show a report or message that FEP is scanning the drive.
START “IE” “C:\USBVirusScan\USBVirusScan.exe” -d “C:\Program Files\Microsoft Security Client\AntiMalware\MpCmdRun.exe” -scan %%c:
Hello Raymond,
Is it possible to use this program in combination with “MS Forefront Endpoint Protection”? I cant get it to work, i know FEP has this build in but it doesn’t always detect the USB drives.
Thanks in advance,
Aermus
hi raymond could you please send me the command line for Trend Micro since i am not able to execute it.
Thanks in advance
hi Raymond..
I’m using eScan antivirus. Can u please provide the command line for this antivirus?
Thanks in advance!
Does this support Trend Micro OfficeScan? Thanks
how can i be able not to view it in the tray icon and automatically start it every time i start windows ? where will i put the command ? -i
hey mr. raymond. but in our school it’s avira personal but it automatically scan when i insert a flash drive how is it possible???
Fascinating!! I’ve been searching for such a program. I use AVG 8.0 and Avast 4.8 pro. But not able to trigger the scan when I insert the flash drive. I modified the start.bat to suit my drive letter configuration. Is it necessary to modify the C program too? Pl help.
avast Home (free) does have a command-line to be used:
C:\Program Files\Alwil Software\Avast4\ashQuick.exe
what’s the command line param for AVG8?
Where do i get mcafee for Usb.please give me the link to the website.Thanx in Advance
hello raymond ,
please help me out,
i am using quickheal antivirus software, but somehow i am not able to use this utility. Your help will be highly appreciated
Hi, this is really good stuff , I just wanted to know how it will work with quickheal antivirus software. I have tried everthing , can anyone help me
Thanks m8 appreciate alot
@gerry & ammaro: I’ve added the command line to scan with avast!. However, Home Edition doesn’t have command line.
@grey_yellow: KIS 7.0 command line scanning added.
@yh: McAfee VirusScan doesn’t support command line.
Thanks raymond
whats the command line for avast anti virus? My anti virus is avast.
It’s ok. I’m using KIS 7.0
Your AV won’t recognize your USB drive. The USBVirusScan tool will. I’ve already included nod32 command line.
I was wondering how will the AV recognizes my USB Drive letter say for eg: c: D: and e: are my local drives and f: G: are my DVD and Virtual Drive when i plug in it gotta be here after means how will the commmand line parameter will recognize this …and by the way i USE NOD 32
eBRo
@ammaro
yes, this was originally developed and tested on XP
Neat program.. Thanks for the info raymond, I\’m gonna introduce this program to all my mates :)
how about mcafee virusscan 12?
@zmir: /i3 for Kaspersky means “Treat infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.” As for %%c, it is the drive letter.
@ammaro: I am sure this can be used on both XP and Vista.
@Humayun Khan: If you already manually scan your USB drive, then you won’t be needing this.
I use KAV 7.0 please give the step by step procedure to configure my system.
I do a virus scan on usb drives everytime i insert one into my PC do i need this tool if i do scanning manually?
is this only for vista or xp also
my anti virus avast
hmmmmmm. looks interesting. i have almost been infected several times but i have gotten used to it.
when i get back home i start up a linux live cd (so it cant get infected either) and then delete those files.
but i think this will be a better way.
Thx Raymond
Thanks for the program, will test it out soon
But i was wondering about the command line scanning, does anyone know what the ‘/i3 %%c’ parameters is for in kaspersky scanning?