Windows Defender and USB flash drives

Page 1 of 2 12 LastLast

  1. Posts : 985
    Windows 10 Home 21H1
       #1

    Windows Defender and USB flash drives


    Ive read that Windows Defender doesn't automatically scan any attached removable drives such as USB flash drives when a Full Scan is performed.
    If that's correct. Lets say that you insert a USB flash drive that has somehow become unknowingly infected with malware. How does Windows Defender detect it and keep it from infecting your PC if it doesn't scan this flash drive immediately when it is inserted into a USB port on the PC?
      My Computer


  2. NMI
    Posts : 947
    Windows 10 Pro, Version 20H2
       #2

    Note:

    If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives.

    Configure Windows Defender Antivirus scanning options


    You can set a group policy that allows you to manage whether or not Windows Defender scans for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.

    Removable drives can always be scanned during a quick scan and custom scan.

    Enable Windows Defender Scan Removable Drives in Windows 10
      My Computer


  3. Posts : 985
    Windows 10 Home 21H1
    Thread Starter
       #3

    NMI said:
    Note:

    If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives.

    Configure Windows Defender Antivirus scanning options


    You can set a group policy that allows you to manage whether or not Windows Defender scans for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan.

    Removable drives can always be scanned during a quick scan and custom scan.

    Enable Windows Defender Scan Removable Drives in Windows 10
    Thanks for providing the links. I don't want to start making Group Policy changes etc. I prefer to leave those things well alone at their default settings. If I want to manually scan a USB flash drive I right click on the drive and select Scan with Windows Defender from the context menu. Ive never used the Custom Scan option and I never do manual quick scans either because Defender does automated quick scans itself. I perform a once weekly manual Full Scan.
    I always have Real Time Protection turned on which seems to mean, judging by those links you show, that when a USB flash drive is inserted into a USB port that Windows Defender will automatically scan the drive for malware. Have I got that right?
    I'd be interested to know how others use Windows Defender to protect their PC when real time protection is on 24/7 as in my case. When you have Real Time Protection turned on does that mean that all Removable Drives are automatically protected?
    Last edited by sportsfan148; 08 Sep 2019 at 13:53.
      My Computer


  4. Posts : 26,971
    Windows 10 (Pro and Insider Pro)
       #4

    sportsfan148 said:
    Thanks for providing the links. I don't want to start making Group Policy changes etc. I prefer to leave those things well alone at their default settings. If I want to manually scan a USB flash drive I right click on the drive and select Scan with Windows Defender from the context menu. Ive never used the Custom Scan option and I never do manual quick scans either because Defender does automated quick scans itself. I perform a once weekly manual Full Scan.

    I always have Real Time Protection turned on which seems to mean, judging by those links you show, that when a USB flash drive is inserted into a USB port that Windows Defender will automatically scan the drive for malware. Have I got that right?

    I'd be interested to how others use Windows Defender to protect their PC when real time protection is on 24/7 as in my case. When you have Real Time Protection turned on does that mean that all Removable Drives are automatically protected?

    No, You have the answer above:

    files are scanned before they are accessed and executed

    meaning, when you open that folder, files will be scanned (assuming default system options are set - no indexing of removable drives etc..)

    Edit:
    I'll leave that written above, to remind me about read more careful. WD will scan content, if real time is enabled...
    :end
    If you want to change that, set appropriate options, like shown in Tutorials posted in previous post.

    There is an app to set all the options in Windows defender via graphical interface, but non experienced user could get into some problems.

    It is called ConfigureDefender.
    Last edited by AndreTen; 08 Sep 2019 at 17:11.
      My Computers


  5. Posts : 985
    Windows 10 Home 21H1
    Thread Starter
       #5

    AndreTen said:
    No, You have the answer above:

    files are scanned before they are accessed and executed

    meaning, when you open that folder, files will be scanned (assuming default system options are set - no indexing of removable drives etc..)

    If you want to change that, set appropriate options, like shown in Tutorials posted in previous post.

    There is an app to set all the options in Windows defender via graphical interface, but non experienced user could get into some problems.

    It is called ConfigureDefender.
    So in the case of a USB flash drive. If files are scanned before they are accessed and executed then you wouldn't know it had malware until you came to use the flash drive.
    Lets say the flash drive was your bootable Windows 10 installation media that you had created several months before. If you were going to now use it for a clean installation and it had somehow got infected with malware you wouldn't know until after the installation..unless you manually scanned the flash drive before using it
      My Computer


  6. Posts : 26,971
    Windows 10 (Pro and Insider Pro)
       #6

    Without any special options.. any file would be scanned in the process of reading from original and writing.
    USB is also scanned in the moment of connection, but only the structure and files that are accessed (drive structure table and any files that are processed...

    If files would be altered after that, I'm not sure, but guess you're right.

    Admit, you got me to talk about things I'm not precisely familiar about.. There are some experts here..
      My Computers


  7. Posts : 11,360
    Windows 10 Home x64 Version 21H2 Build 19044.1706
       #7

    WD scans the whole of any connected drive if you leave it connected long enough.

    You can see this for yourself if your connected drive has an activity light. Connect it, do whatever job you wanted to do, leave it connected afterwards. The activity light will start blinking after a short period.

    Denis
      My Computer


  8. Posts : 26,971
    Windows 10 (Pro and Insider Pro)
       #8

    Try3 said:
    WD scans the whole of any connected drive if you leave it connected long enough.

    You can see this for yourself if your connected drive has an activity light. Connect it, do whatever job you wanted to do, leave it connected afterwards. The activity light will start blinking after a short period.

    Denis
    I think it is Search indexer that is accessing the drive.. as a consequence, WD will check the files that are accessed
      My Computers


  9. Posts : 11,360
    Windows 10 Home x64 Version 21H2 Build 19044.1706
       #9

    AndreTen said:
    I think it is Search indexer that is accessing the drive.. as a consequence, WD will check the files that are accessed
    I never set indexing to include any external drives.

    I have experienced WD warning dialogs that it has found a malicious component within files on an external drive [often EaseUS installation files] proving that it is WD scanning them.

    Denis
      My Computer


  10. Posts : 26,971
    Windows 10 (Pro and Insider Pro)
       #10

    Try3 said:
    I never set indexing to include any external drives.

    I have experienced WD warning dialogs that it has found a malicious component within files on an external drive [often EaseUS installation files] proving that it is WD scanning them.

    Denis
    I have to correct myself. (Thanks Denis...) . this is where you get if trust third person Quotes (in second post)

    WD documentation says:

    If real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives.
    But, I have this option enabled... default should be Disabled:

    Scan removable drives during full scans only Scan > Scan removable drives Disabled -DisableRemovableDriveScanning
      My Computers


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 21:10.
Find Us




Windows 10 Forums