Home > Computer > Automatic Scan for Virus When Plug in USB Flash Drive
Donation Goal
Donate Now Goal amount for this year: 799 USD, Received: 100 USD (13%)
Please donate to help support this website. The funds will be used to purchase owned license of LiteSpeed Web Server Enterprise (2-CPU). It provides superior performance in terms of raw speed, scalability and anti-DDoS capabilities.

Automatic Scan for Virus When Plug in USB Flash Drive

Posted By Raymond In Category: Computer

Apr
13
2008

One of the common method that virus use to spread themselves is through USB flash drives. All they need to do is create an autorun.inf file at the root of the USB flash drive and points it to a malicious executable file. When the USB flash drive is plugged in to a computer that is running Windows, double clicking the drive letter from My Computer will immediately process the autorun.inf file and launching the virus… That’s why I always advice people NOT to access the USB flash drive from My Computer. Use the shortcut key [Win + E] to open up Windows Explorer then go to the USB flash drive letter.

Another way is to scan the USB flash drive right after plugging in. It’s not perfect, but at least an updated antivirus program will protect you from most viruses. I believe most of us don’t scan our pen drive before using. The only people I know that does that is a bunch of teachers in an institute where the printers are connected to the their laptop. So whenever student wants to print a document, they’ll plug in their USB flash drive to the teacher’s laptop.

Since manually scanning USB flash drive is troublesome, I found a way to automatically scan the USB flash drive whenever it is inserted or plugged in to a Windows computer.


USBVirusScan is a small program that will launch any program you provide as a command line parameter each time a USB stick is inserted. The author use it to start a full virus scan on the inserted USB drive, hence the name. If not, I think maybe he’ll call it “USBConnectRUN” or something similar since it can use to run any program when a USB flash drive is plugged in. USBVirusScan is definitely not for beginners because it doesn’t have graphical user interface (GUI). The configuration is done from a batch file and it only has an About screen that looks like the image below.

USB Flash drive antivirus

Many people thought that USBVirusScan is an antivirus program but it’s NOT. It is a monitoring tool to detect if a USB flash drive has been plugged in the computer and will automate running any programs. If you’re still unsure of how USBVirusScan works, you can see it in action at YouTube. The video will show that the batch file (start.bat) which contains the configuration is being launched first. Then a USB flash drive is connected. USBVirusScan detected the USB flash drive and immediately runs McAfee antivirus to scan the drive.

Can’t see anything from the low quality youtube video? Download a high resolution video here and play it on your favorite media player.

Basically you’ll need an antivirus installed first. Then you’ll need to find out the command line that can perform a scan. Once you have the command line, just edit the start.bat file. I know the command line part can be a bit confusing for computer beginners. So I’ve provided a few command line for some popular antivirus.

AVG FREE 7.5
USBVirusScan.exe "C:\Program Files\Grisoft\AVG7\avgscan.exe" /clean %%c:

Kaspersky Anti-Virus 7
USBVirusScan.exe "C:\Program Files\Kasperksy Lab\Kaspersky Anti-Virus 7.0\avp.com scan /i3 %%c

Kaspersky Internet Security 7
USBVirusScan.exe "C:\Program Files\Kasperksy Lab\Kaspersky Internet Security 7.0\avp.com scan /i3 %%c

Norton AntiVirus 2008
USBVirusScan.exe "C:\Program Files\Norton Antivirus\navw32.exe" %%c:

ESET NOD32 Antivirus
USBVirusScan.exe "C:\Program Files\ESET\ESET NOD32 Antivirus\ecls.exe" /action=clean %%c:

ClamWin
USBVirusScan.exe "C:\Program Files\ClamWin\bin\clamscan.exe" --database="C:\ProgramData\.clamwin\db" %%c:
Note: ClamWin is a bit tricky because you need to specify the virus definition database location. What I provided above is the default database location in Windows Vista. To check the location of the virus definition database, run ClamWin, go to Tools > Preferences > File Locations.
ClamWin Virus database location

Windows Defender
Not Supported because doesn't offer scanning specific location

BitDefender
Not Supported because doesn't have command line scanning

Avira AntiVir PersonalEdition Classic
Not Supported because doesn't have command line scanning

McAfee VirusScan 12
Not Supported because none of the Home products has this feature

avast! 4 Professional
USBVirusScan.exe "C:\Program Files\Alwil Software\Avast4\ashCmd.exe %%c /P=[31]
Note: avast! 4 Home Edition does not support command line scanning.

There are other features such as hiding USBVirusScan from appearing and etc. Do check out the official website for more information.

[ Download USBVirusScan | USBVirusScan Website ]


Related posts:
  • Scan Your Computer with Multiple Anti Virus for FREE
  • How To Check and Test USB Flash Drive
  • How To Make a USB Flash Drive Bootable
  • Kaspersky Offers FREE Tool to Scan and Remove Virus
  • Fix AutoPlay Dialog Box Not Appearing When Plug in External Device
    • Zmir

      Thanks for the program, will test it out soon
      But i was wondering about the command line scanning, does anyone know what the ‘/i3 %%c’ parameters is for in kaspersky scanning?

    • Fabian23

      hmmmmmm. looks interesting. i have almost been infected several times but i have gotten used to it.

      when i get back home i start up a linux live cd (so it cant get infected either) and then delete those files.

      but i think this will be a better way.

      Thx Raymond

    • ammaro

      is this only for vista or xp also
      my anti virus avast

    • Humayun Khan

      I use KAV 7.0 please give the step by step procedure to configure my system.

      I do a virus scan on usb drives everytime i insert one into my PC do i need this tool if i do scanning manually?

    • http://www.raymond.cc/ Raymond

      @zmir: /i3 for Kaspersky means “Treat infected objects, and if disinfection fails, delete and delete all compound objects completely if the infected attachments cannot be deleted.” As for %%c, it is the drive letter.

      @ammaro: I am sure this can be used on both XP and Vista.

      @Humayun Khan: If you already manually scan your USB drive, then you won’t be needing this.

    • yh

      how about mcafee virusscan 12?

    • whoami

      Neat program.. Thanks for the info raymond, I\’m gonna introduce this program to all my mates :)

    • https://DidierStevens.com Didier Stevens

      @ammaro

      yes, this was originally developed and tested on XP

    • Ram

      I was wondering how will the AV recognizes my USB Drive letter say for eg: c: D: and e: are my local drives and f: G: are my DVD and Virtual Drive when i plug in it gotta be here after means how will the commmand line parameter will recognize this …and by the way i USE NOD 32

      eBRo

    • http://www.raymond.cc/ Raymond

      Your AV won’t recognize your USB drive. The USBVirusScan tool will. I’ve already included nod32 command line.

    • grey_yellow

      It’s ok. I’m using KIS 7.0

    • gerry

      whats the command line for avast anti virus? My anti virus is avast.

    • Humayun Khan

      Thanks raymond

    • http://www.raymond.cc/ Raymond

      @gerry & ammaro: I’ve added the command line to scan with avast!. However, Home Edition doesn’t have command line.

      @grey_yellow: KIS 7.0 command line scanning added.

      @yh: McAfee VirusScan doesn’t support command line.

    • blakd33p

      Thanks m8 appreciate alot

    • sandy

      Hi, this is really good stuff , I just wanted to know how it will work with quickheal antivirus software. I have tried everthing , can anyone help me

    • sandy

      hello raymond ,
      please help me out,
      i am using quickheal antivirus software, but somehow i am not able to use this utility. Your help will be highly appreciated

    • http://McafeeVirusScanforUSB nyote

      Where do i get mcafee for Usb.please give me the link to the website.Thanx in Advance

    • harold

      what’s the command line param for AVG8?

    • Tech

      avast Home (free) does have a command-line to be used:

      C:\Program Files\Alwil Software\Avast4\ashQuick.exe

    • balajigade

      Fascinating!! I’ve been searching for such a program. I use AVG 8.0 and Avast 4.8 pro. But not able to trigger the scan when I insert the flash drive. I modified the start.bat to suit my drive letter configuration. Is it necessary to modify the C program too? Pl help.

    • clyde

      hey mr. raymond. but in our school it’s avira personal but it automatically scan when i insert a flash drive how is it possible???

    • clyde

      how can i be able not to view it in the tray icon and automatically start it every time i start windows ? where will i put the command ? -i

    • John

      Does this support Trend Micro OfficeScan? Thanks

    • zack

      hi Raymond..

      I’m using eScan antivirus. Can u please provide the command line for this antivirus?

      Thanks in advance!

    • Vimal

      hi raymond could you please send me the command line for Trend Micro since i am not able to execute it.

      Thanks in advance

    • Aermus

      Hello Raymond,

      Is it possible to use this program in combination with “MS Forefront Endpoint Protection”? I cant get it to work, i know FEP has this build in but it doesn’t always detect the USB drives.

      Thanks in advance,

      Aermus

    • Aermus

      I figured out this code but it does not show a report or message that FEP is scanning the drive.

      START “IE” “C:\USBVirusScan\USBVirusScan.exe” -d “C:\Program Files\Microsoft Security Client\AntiMalware\MpCmdRun.exe” -scan %%c:

    • Aermus

      Has anyone figured this out yet?

      Thanks in advance,

      Aermus

    • Wesley

      Hello Aermus,

      Use the folowing code for “Forefront Client Security” :

      START “IE” “C:\USBVirusScan\USBVirusScan.exe” -d “C:\Program Files\Microsoft Security Client\AntiMalware\MpCmdRun.exe” -scan %%c:

      The location of USBVirusScan can differ. Fill in your own location instead.

      Regards,

      Wesley

    Copyright © 2005-2012 - Raymond.CC Blog