Automatically Scan Thumbdrives

[sizmo]

Is there a way to make Avast automatically scan thumdrives inserted into the USB port? Its a major gateway for viruses in my company's PCs. Otherwise, is there any software that restricts usage of USB ports on a PC? Thanks!

[YoKenny]

http://www.technade.com/2007/04/how-to-disable-usb-ports-in-your.html

Google is your friend.

[kubecj]

Autoscanning of removable media is an old song for us  From 1.44" diskettes, thru zip drives, cd roms, dvds, now flash. The problem is, that such scan would be too long (and too slow) for the users, so this is simply not feasible.

[DavidR]

There is always USBVirusScan do a google search for it, you can run that program and it enables you to enter the path to your AV scanner, C:\Program Files\Alwil Software\Avast4\ashQuick.exe.

This would then use the ashQuick scan to scan any USB when you plug it in, you obviously have to have the USBVirusScan program running before you pop-in your USB.

I have a batch file created so I only run it when I am going to use a USB device that hasn't been in my control or has been used on another system. So the program isn't always running and as kubecj said there is an overhead with scanning USBs when you insert them, but if you are happy with that then this is an option.

Code: [Select]

"E:\Utilities\USBVirusScan\USBVirusScan.exe" -c "C:\Program Files\Alwil Software\Avast4\ashQuick.exe" /target %%c: /secure /quiet /log vScanlog.txt

A forum search for USBVirusScan should find more info.

[sizmo]

Hi Everyone,

Thanks very much for all yr help.

I have decided to use 2 methods to secure thumbdrive transmitted malware- a thumbdrive firewall (see link below) and a thumbdrive antivirus auto scan as described by DavidR.

Anyone who faces the same problem can also read this webpage for possible solutions 10 Practical Ways to Prevent USB-Borne Virus Infection

[DavidR]

You're welcome, thanks for the feedback and link.

[sizmo]

There is always USBVirusScan do a google search for it, you can run that program and it enables you to enter the path to your AV scanner, C:\Program Files\Alwil Software\Avast4\ashQuick.exe.

This would then use the ashQuick scan to scan any USB when you plug it in, you obviously have to have the USBVirusScan program running before you pop-in your USB.

I have a batch file created so I only run it when I am going to use a USB device that hasn't been in my control or has been used on another system. So the program isn't always running and as kubecj said there is an overhead with scanning USBs when you insert them, but if you are happy with that then this is an option.

Code: [Select]

"E:\Utilities\USBVirusScan\USBVirusScan.exe" -c "C:\Program Files\Alwil Software\Avast4\ashQuick.exe" /target %%c: /secure /quiet /log vScanlog.txt

A forum search for USBVirusScan should find more info.

Hi David

I have downloaded and installed USBVirusScan and use the following instructions in the batch file:

    USBVirusScan.exe -c -i -s -d "C:\Program Files\Alwil Software\Avast4\ashQuick.exe" /target %%e:

However, when Avast starts to scan the thumbdrive, the following message appears:

    The scan was completed with error. The system cannot find the specified path

The Avast scanner window indicates that it is trying to scan drive a: , instead of the target drive e:

Why is Avast trying to scan drive a: instead of drive e: ?

[DavidR]

First usb said when avast starts scanning the USB drive, so I assume that it is scanning the usb drive letter.

Also not in my example I have used /target %%c and not tried as you appear to have done indicate a specific drive letter (/target %%e), from my limited knowledge of USBVirusScan the %%c is like a place holder that will substitute the drive letter of the location where the USB device is plugged in.

So I would suggest you try it with my exact example the only difference being the location you have the USBVirusScan.exe in, leave the rest the same. There is also a lot of information on the DidierStevens.com site, that is what I used when I set-up my batch file, not to mention a forum search as I suggested in my first post about the program.

[sizmo]

Hi David

Thanks, it now works as it should. I didn't know replacing %%e: with %%c: was the difference cos according to instruction on Didier Stevens' website, this placeholder was supposed to be the target drive for the scan.

Is there a way to remove the 'Cancel' button in the scan dialog box? Forcing anyone who uses their thumbdrive to scan before use is the whole idea of this excercise. If they have an option to cancel, the virus infections will merely continue.

[DavidR]

You're welcome.

The problem is one of your use of English as a second language and the instructions not being particularly clear. A place holder is like a picture frame, a space reserved for a/the picture, the picture might change but the place holder/picture frame doesn't change.

For example if you had a USB storage device already plugged in then the next one plugged in wouldn't be E: but F: that is why the place holder is there as it 'imports' the drive letter of the newly inserted USB storage device, so that you don't have to hard code it.

Unfortunately there is no way to remove the Cancel button as that is a part of the avast ashQuick.exe (right click, avast Quick scan), so normally this is initiated by the user to check a single file, etc. so they have to have the option to cancel a scan that 'they' initiated.

So the use of the ashQuick.exe in this way with the USBVirusScan isn't how it is meant to be used, but rather is a workaround to allow for USBs to be scanned. You can't stop someone from cancelling, so you have to educate people who use 'your' system that this scan will take place and it must be allowed to run (or they can't use your system, reasonable).

I have just done a scan of a USB containing 532MB of small files and it didn't take very long, but my system isn't slow.