How to Scan a USB Drive for Viruses: Safe Steps, Best Tools, and Prevention Tips

How to Scan a USB Drive for Viruses

USB drives are convenient, but they are also a common way for malware to spread between computers.

Knowing how to scan USB drive for viruses helps you catch threats before they open files, encrypt data, or compromise a network.

This guide explains practical scanning methods on Windows, macOS, and Linux, plus what to do if your flash drive is already infected.

Why USB Drives Can Carry Malware

USB storage devices can hold more than documents and photos.

They can also contain malicious files, hidden shortcuts, scripts, or payloads designed to run when someone opens the drive contents.

• Autorun files can trigger unsafe actions on older systems.
• Shortcut viruses may hide folders and replace them with deceptive links.
• Trojanized installers can look legitimate but install malware.
• Macro-enabled documents may launch harmful code when opened in Microsoft Office.

Because USB drives move between devices, they are especially risky in offices, schools, labs, and shared households.

How to Scan a USB Drive for Viruses on Windows

Windows users can scan removable media with Microsoft Defender or another reputable antivirus product.

The important step is to inspect the drive before opening files.

Use Microsoft Defender

1. Insert the USB drive into the computer.
2. Wait a moment for Windows to recognize it.
3. Open File Explorer and right-click the USB drive.
4. Select Scan with Microsoft Defender.
5. Review the results and follow the recommended cleanup action.

If the context-menu option is unavailable, open Windows Security, go to Virus & threat protection, and run a custom scan targeting the removable drive.

Run a custom antivirus scan

A custom scan is useful if you suspect a deeper infection.

In Microsoft Defender, you can choose the USB drive specifically instead of scanning the whole system.

Third-party antivirus tools such as Bitdefender, ESET, Norton, Kaspersky, and Avast also support removable-drive scans.

If the file system is large or the drive has many nested folders, allow the scan to finish.

Interrupting it can leave threats undiscovered.

How to Scan a USB Drive on macOS

macOS does not include the same built-in removable-media scan workflow as Windows, so many users rely on security software from vendors such as Malwarebytes, Bitdefender, Avast, or Sophos.

The process is usually simple:

1. Connect the USB drive.
2. Open your antivirus app.
3. Select the USB volume or run a custom scan.
4. Quarantine or delete any flagged items.

Before scanning, avoid opening unknown files from the drive, especially app installers, archive files, and documents that request permission to enable macros or access system settings.

How to Scan a USB Drive on Linux

Linux systems often use ClamAV or another command-line scanner for removable storage.

ClamAV is widely used because it is free, open source, and suitable for on-demand scans.

Common ClamAV workflow

1. Mount the USB drive.
2. Update virus definitions with freshclam.
3. Scan the drive with clamscan or clamdscan.
4. Review detected threats and remove or quarantine them.

For example, you can scan a mounted drive path such as /media/username/USB.

The exact path depends on your distribution and mount settings.

Signs That a USB Drive May Be Infected

A virus scan is the best verification method, but some warning signs suggest you should scan immediately.

• Files or folders disappear and are replaced by shortcuts.
• The drive shows unknown files with strange names or extensions.
• Your antivirus warns about a threat when the USB is inserted.
• The drive becomes slow, inaccessible, or read-only.
• Documents, scripts, or installers appear that you do not recognize.

Do not assume the drive is safe just because it opens normally.

Some malware stays quiet until a file is opened or copied to another system.

What to Do Before and During the Scan

To reduce risk, disconnect from unnecessary networks and avoid opening any files until the scan completes.

If your antivirus supports it, enable real-time protection so suspicious files are intercepted automatically.

• Keep the USB drive plugged into only one trusted machine at a time.
• Do not run unknown executables from the drive.
• Avoid double-clicking suspicious shortcuts or archives.
• If possible, scan the drive before transferring files to important workstations.

For shared environments, scan the drive on a machine that is fully updated and protected by current security definitions.

What to Do If the Scan Finds a Virus

If your antivirus detects malware, follow the action it recommends: quarantine, delete, or clean.

Quarantine is often safest because it isolates the file without immediately removing it.

After the initial cleanup, rescan the drive to confirm no additional threats remain.

If the infection keeps returning, reformatting the USB drive may be necessary.

When should you reformat the USB drive?

Reformatting is a strong option when the drive contains repeated malware, damaged files, or persistent shortcut behavior.

Back up only trusted, scanned files first, and avoid copying suspicious executables or scripts back onto the device.

If the drive belongs to work or school, follow your organization’s incident-response policy before erasing evidence.

Some environments need logs or a forensic review.

How to Prevent USB Malware in the Future

The safest USB strategy is to prevent infections before they start.

That means controlling what you plug in, what you open, and where the drive has been used.

• Use trusted antivirus software with real-time protection.
• Disable AutoRun and AutoPlay where applicable.
• Keep your operating system updated with the latest security patches.
• Scan any borrowed or found USB drive before accessing its contents.
• Use separate drives for personal, work, and public transfers.
• Back up important files so cleanup does not cause data loss.

If you manage multiple computers, consider restricting removable-media use through endpoint security tools or group policy settings.

That can reduce the chance of malware spreading across a fleet.

Best Practices for Safer File Transfers

In some cases, a USB drive is not the best transfer method.

Cloud storage, secure file-sharing links, or managed synchronization tools can reduce the need for physical media and lower malware exposure.

If USB is still required, keep the drive labeled, dedicated to a specific purpose, and scanned regularly.

A known-clean device is easier to trust than one that has been used in many different environments.

For especially sensitive data, use encrypted USB drives and verify the files after transfer.

Encryption protects confidentiality, while antivirus scanning helps protect integrity.

FAQs About Scanning USB Drives

Can a USB drive infect a computer just by being plugged in?

In most modern systems, simply inserting a USB drive does not automatically infect the computer.

The risk increases when you open infected files, run executables, or interact with malicious shortcuts or scripts.

Is online virus scanning enough for USB drives?

Online scanners can help, but local antivirus protection is more reliable for removable media.

A local scan checks the files directly on the drive and can catch threats before you open them.

Should I scan every USB drive?

Yes.

Even if a drive looks familiar, it may have been used on another device that was infected.

Scanning every removable drive is a simple habit that can prevent costly problems.

What files are most dangerous on a USB drive?

Executable files, scripts, compressed archives, macro-enabled Office documents, and shortcut files deserve extra caution.

These file types are commonly used to distribute malware.