[louzhi]

1. How would I be able to tell if there is a virus on my USB?

2. Would encrypting my USB provide added protection against viruses while connected to an infected PC?

3. Would reformatting my USB remove any viruses which were once on the USB?

my main concern is how to keep my USB from infecting a whole bunch of devices I own...

thanks for the help!!!

[Hashflare]

What makes you think your USB has a virus?

[louzhi]

What makes you think your USB has a virus?

Nothing, I'm just speaking hypothetically. I'd like to know how to prevent such a thing from happening.

[Armada]

1. How would I be able to tell if there is a virus on my USB?

2. Would encrypting my USB provide added protection against viruses while connected to an infected PC?

3. Would reformatting my USB remove any viruses which were once on the USB?

my main concern is how to keep my USB from infecting a whole bunch of devices I own...

thanks for the help!!!

1(a) - Ensure your system has Autorun for USB disabled (Most all recent versions of windows do by default)
(b) - Install/Update your Anti virus ensure it is a registered copy, and fully functional and activated, no freeware crap.
© - Plugin the USB device and do a full scan of the USB drive.

2. No - you still have to decrypt the files, and secondly it likely could still be placed in the USBs free space.

3. Yes, do a full format, not a quick format however.

🤝

[louzhi]

1(a) - Ensure your system has Autorun for USB disabled (Most all recent versions of windows do by default)
 (b) - Install/Update your Anti virus ensure it is a registered copy, and fully functional and activated, no freeware crap.
 © - Plugin the USB device and do a full scan of the USB drive.

2. No - you still have to decrypt the files, and secondly it likely could still be placed in the USBs free space.

3. Yes, do a full format, not a quick format however.

🤝

thanks! I appreciate the help! 😁

also,
how would you scan a usb on Linux? would it even be necessary?

[SysAdmin]

1(a) - Ensure your system has Autorun for USB disabled (Most all recent versions of windows do by default)
 (b) - Install/Update your Anti virus ensure it is a registered copy, and fully functional and activated, no freeware crap.
 © - Plugin the USB device and do a full scan of the USB drive.

2. No - you still have to decrypt the files, and secondly it likely could still be placed in the USBs free space.

3. Yes, do a full format, not a quick format however.

🤝

Adding onto Armada's post, the Anti-Virus part is a bit.. Difficult to go by. With the amount of crypters and obfuscation around that even skids can use, bypassing an Anti-Virus scan isn't as hard as it seems.

[Mad76e]

1. How would I be able to tell if there is a virus on my USB?

2. Would encrypting my USB provide added protection against viruses while connected to an infected PC?

3. Would reformatting my USB remove any viruses which were once on the USB?

my main concern is how to keep my USB from infecting a whole bunch of devices I own...

thanks for the help!!!

1. Nerver use any undentified USB stick in your computer
2. Well it depends on the virus actually. In worst case scenario you will end up with corrupted files, or infected files when youre trying to decrypt EM
3. Yeah

[CyberStrike]

Well OP why wouldn't you use an AV in linux to scan your USB? Don't you want to know what you may have spread about your computers? At least now you can have some IOC's (indicators of compromise) so you can fix it. ClamAV and yes you can use a front end ClamTK to scan the device.

Something further you may want to dedicate an older machine to scan USB devices before you plug in to your other computers. Also if you already infected multiple USB keys you may want to start placing logging/tools on your WIndows computers.

https://www.nirsoft.net/utils/usb_log_view.html
https://www.pcworld.com/article/2940859/...ports.html
https://docs.microsoft.com/en-us/windows...er/usbview

I tend to believe that I want to know what I am dealing with before nuking it, that way I can quickly deal with multiple machines that maybe infected with the same crap. And formatting should get rid of it,

[louzhi]

Well OP why wouldn't you use an AV in linux to scan your USB? Don't you want to know what you may have spread about your computers? At least now you can have some IOC's (indicators of compromise) so you can fix it.  ClamAV and yes you can use a front end ClamTK to scan the device.  

Something further you may want to dedicate an older machine to scan USB devices before you plug in to your other computers. Also if you already infected multiple USB keys you may want to start placing logging/tools on your WIndows computers.



I tend to believe that I want to know what I am dealing with before nuking it, that way I can quickly deal with multiple machines that maybe infected with the same crap. And formatting should get rid of it,

You're right, I don't know why I didn't think of using Linux based anti virus...also the "use an old pc to test USB's" is a good idea that I'm definitely going to do.

[CyberStrike]

Cool hope it helps here are a couple of resources:

https://community.spiceworks.com/topic/6...or-malware

https://en.wikipedia.org/wiki/Sheep_dip_(computing)

Most important thing make sure you keep clamav updated I am sure that upon detection of a USB being plugged in you can probably do it with just a shell script where it queries lsusb even df if it automounts the USB and if anything "new" is plugged in then it executes an update of clamav and then scans the drive. Also allow it to scan large files clamav has an option for ignoring over 20 MB files.

If you really are not sure on a file you can have linux as the base OS and run a Windows VM have processhacker/wireshark/procmon and see what it does see where it writes to files being downloaded..etc If you find odd behaviour and want you can also use vboxmanage to dump the RAM then use volatility to see all that happened there as well.

https://askubuntu.com/questions/166420/h...usb-device