USB Drive Viruses — How to Detect, Remove & Prevent Malware on USB
A USB drive can carry infected files, launch deceptive shortcuts, or impersonate another device. This guide explains how to inspect a drive safely, clean common infections, reduce future risk, and protect the data stored on it.
USB Safety Desk Editorial TeamUpdated July 202618 min read
QUICK ANSWER
Do not open an unfamiliar USB drive immediately. Scan it with current security software, show hidden files, inspect unexpected shortcuts or executables, and copy only verified files. Formatting usually removes file-based malware, but it does not reliably address malicious USB firmware such as BadUSB. For sensitive data, combine safe handling with encryption and a trusted-device policy.
Disconnect the drive from other computers, update your antivirus, reconnect it without opening files, and run a custom scan of the USB volume. Quarantine detected items, reveal hidden files, and verify documents before copying them to a clean location. If the infection keeps returning, wipe and reformat the drive after backing up only known-safe files.
Does Formatting a USB Drive Remove Viruses?
A full format generally removes malware stored in the visible file system. A quick format may leave recoverable data, and neither method proves that device firmware is trustworthy. Replace a drive that behaves like an unexpected keyboard, network adapter, or other device.
How to Remove Virus from a Flash Drive
Use the same isolate, scan, quarantine, verify, and reformat sequence. Avoid random “USB cleaner” downloads. Use your operating system’s security tools or security software from a known vendor.
Threat context
Why USB Drives Are a Major Security Risk
File-based
Infected files
Documents, installers, scripts, archives, and shortcuts can carry or launch malware. The risk increases when file extensions are hidden or when users open files before scanning.
Device behavior
BadUSB and HID attacks
A reprogrammed device may identify itself as a keyboard or network adapter. Traditional file scanning cannot inspect all controller firmware.
Data exposure
Loss and copying
An unencrypted drive can expose private files if it is lost, borrowed, or connected to a compromised computer. Write protection and encryption address different parts of this risk.
Detection
How to Detect a Compromised USB Drive
Inspect the physical device
Check for a broken shell, altered label, unexpected adapter, loose connector, or signs that the enclosure has been opened. Treat unexplained changes as a reason to replace the drive.
Connect only to a low-risk, updated computer
Do not test a suspicious drive on a production workstation or a computer that holds irreplaceable data. Organizations should use an isolated scanning station.
Scan before browsing
Run a custom scan against the drive letter or mounted volume. Keep real-time protection enabled and avoid double-clicking the drive in an old or unpatched environment.
Look for behavioral warning signs
Unexpected command windows, rapid automated typing, new network interfaces, disabled security controls, missing files, shortcut-only folders, or repeated reinfection are serious warning signs.
Signs of a shortcut virus
Your folders appear as shortcuts, original files become hidden, unfamiliar .lnk, .vbs, .cmd, or .exe files appear, or the infection returns after deleting visible shortcuts.
Method 1
How to Remove Virus from USB Drive Using Built-In Tools
Windows: scan, reveal, verify, then reformat if needed
Update Windows Security and disconnect other removable drives.
Insert the USB drive while holding off on opening any files.
Open Windows Security, choose Virus & threat protection, Scan options, Custom scan, and select the USB drive.
Quarantine detected items and restart if Windows requests it.
In File Explorer, enable file-name extensions and hidden items. Do not open suspicious shortcuts or scripts.
Copy only verified personal files to a temporary clean folder, scan them again, then format the USB drive when confidence is low.
Best for Common file-based malware and shortcut infections.
Limitation Cannot establish that USB controller firmware is clean.
Optional owner-safe command
The following command removes hidden and system attributes from files so you can inspect them. Replace E: with the correct USB drive letter. It does not remove malware by itself.
attrib -h -r -s /s /d E:\*.*
Confirm the drive letter carefully. Never run destructive commands against a drive you have not positively identified.
Mac: scan with trusted software and erase when necessary
macOS does not include a general-purpose manual USB malware scanner comparable to a custom Windows Security scan. Keep macOS and its built-in protections current, inspect files carefully, and use reputable security software when the drive came from an untrusted source. To erase and encrypt a device, use Disk Utility, select the physical device, and choose an appropriate format. Erasing destroys existing data.
My situation is…
Choose the safest next step
Where did the drive come from?
Does it show suspicious behavior?
How sensitive is the computer?
Prevention
USB Safety Best Practices
Trust the source
Use organization-issued or personally purchased drives. Never connect a USB device found in public, received unexpectedly, or handed out without a clear chain of custody.
Highest impact
Scan first
Keep security software current and scan the mounted volume before opening files. Enable file extensions so a disguised executable is easier to spot.
Easy
Limit write access
Use a physical write-protect switch where available, or mount media read-only in controlled workflows. This reduces accidental changes but does not neutralize malicious device firmware.
Situational
Encrypt sensitive data
Use BitLocker To Go, encrypted APFS storage, a cross-platform encrypted container, or a dedicated USB protection tool. Store recovery information separately.
For lost-drive risk
Avoid public computers
A password-protected drive can still be exposed after you unlock it on a compromised computer. Use a trusted device, secure browser workflow, or a disposable transfer process.
Travel
Firmware-level risk
The BadUSB Threat — How It Works and How to Prevent It
BadUSB describes attacks that alter a USB controller’s firmware so the device can impersonate another class of peripheral. A storage drive may also present itself as a keyboard and issue commands, or as a network adapter and influence traffic. Because the malicious behavior is below the ordinary file system, deleting files or formatting the storage partition is not a dependable fix.
Practical defenses
Do not connect unknown devices.
Use device allowlisting and block unnecessary USB classes in managed environments.
Use dedicated transfer stations for high-risk or air-gapped networks.
Buy tamper-evident or security-focused devices from traceable suppliers.
Replace a drive that unexpectedly identifies as multiple devices.
Data protection
How USB Encryption Protects Your Data
Encryption protects files if the drive is lost or stolen. It does not block malware already on the device, and it cannot make an untrusted USB controller safe.
Windows encryption for removable drives. It is convenient in Windows-centered environments and can protect FAT, FAT32, exFAT, and NTFS removable volumes. Recovery-key handling is essential.
Best for Windows
Encrypted APFS
Mac users can erase and format a removable device with encryption through Disk Utility. Native convenience is strong, while Windows interoperability is limited.
Best for Mac
Cross-platform software
Tools such as encrypted containers or portable USB protection can support mixed environments. Verify platform support, update requirements, and recovery options before deployment.
The tool we recommend for straightforward USB locking
USB Secure makes password protection easier to carry between PCs
Of the options covered here, we recommend USB Secure for people who want a focused, portable way to password-protect files on a USB drive without managing a more technical encrypted-container workflow. It is developed by NewSoftwares.net.
Its limitation matters: USB Secure protects access to data. It does not replace antivirus scanning, device-control policies, or defenses against malicious USB firmware.
Security software compares files and behavior against signatures, reputation data, and detection rules. It helps with file-based threats but cannot prove firmware integrity.
Encryption transforms stored data so it cannot be read without the key. A user-facing lock may control access to an encrypted area or protected application workflow.
Hardware write protection can stop the host from modifying storage contents. Software policies can restrict writing too, but administrative control and device behavior affect reliability.
Native formats and encryption work best inside their own ecosystems. Mixed Windows and Mac use often requires exFAT plus a compatible protection layer, or separate transfer procedures.
Platform-specific notes
Cross-Platform USB Encryption — Mac and Windows
Choose the protection method based on every computer that must unlock the drive. A format that mounts on both operating systems does not guarantee that its encryption layer will work on both.
Air-gapped networks need stricter controls
Encryption protects confidentiality during transfer, but removable media can bridge otherwise isolated systems. Use dedicated drives, one-way workflows where possible, an isolated scanning station, device inventories, and explicit approval for every transfer.
Do not reuse the same drive between internet-connected and critical systems without an approved sanitization process.
Recovery design matters more than convenience claims
Cross-platform use
Often OS-independent after unlock
Depends on software and format
Test on managed endpoints
Cost
Higher per device
Free to moderate
Include support and replacement costs
Certification
Some models validated
Product and environment dependent
Check the exact module and certificate status
BadUSB exposure
Not automatically eliminated
Not addressed
Firmware trust is a separate control
What FIPS 140-2 or FIPS 140-3 means
FIPS validation applies to a specified cryptographic module and configuration, not every security claim made about a product family. Organizations should verify the exact certificate, status, module version, and required operating conditions rather than relying only on packaging language.
Common errors and fixes
USB Drive Troubleshooting Guide
Problem
Likely cause
Safe fix
Files became shortcuts
Shortcut malware or hidden attributes
Scan, quarantine, reveal extensions, restore attributes, verify files, then reformat if needed.
Ask the owner or administrator to verify the file and permissions. Do not bypass warnings or access controls.
Organizations
USB Security Policies for Teams and Organizations
A workable policy defines which devices are allowed, who may use them, where they may connect, how data must be encrypted, and what happens after loss or suspected compromise. Technical controls should support the policy rather than relying on employee memory alone.
Minimum policy controls
Allow only organization-issued devices with unique inventory IDs.
Block unknown USB storage or place it in read-only mode.
Require encryption for confidential or regulated information.
Use endpoint logging and alert on new device classes.
Provide an isolated scanning and transfer station.
Define loss, incident, return, and destruction procedures.
USB safe usage checklist
0 of 8 completed
End of life
USB Drive Safe Disposal and Data Wiping
Before reuse or disposal, identify the data sensitivity and the storage technology. For ordinary low-risk reuse, erase the drive, recreate the partition, and verify that no expected files remain. For confidential information, follow your organization’s sanitization standard and record the result.
Flash memory controllers use wear leveling, so repeated overwrite passes do not provide the same assurance as they once did on magnetic media. Cryptographic erase may be appropriate when strong encryption was used from the beginning and keys can be reliably destroyed. For highly sensitive data or a failing device, physical destruction by an approved service may be the defensible choice.
Formatting is not a universal sanitization method
A quick format mainly rebuilds file-system structures. Even a full format addresses the storage area, not malicious firmware. Match the disposal method to the data’s sensitivity, the device’s condition, and your compliance requirements.
Decision guide
Which USB Protection Method Is Right for You?
Home user
Recommended: current antivirus plus BitLocker To Go, encrypted APFS, or simple USB protection.
Alternative: avoid removable media and use end-to-end encrypted sharing.
Traveler
Recommended: encrypted drive, minimal data, trusted computers only, and a remote backup.
Alternative: hardware-encrypted USB for higher-risk travel.
Small team
Recommended: issued drives, encryption, inventory, scan-before-use rules, and incident reporting.
Alternative: managed cloud transfer with removable storage blocked.
Regulated organization
Recommended: centrally managed device control and validated cryptography aligned to policy.
Alternative: prohibit USB storage except approved exceptions.
Air-gapped environment
Recommended: dedicated one-direction transfer workflow and isolated scanning station.
Alternative: purpose-built data diode or controlled media gateway.
Unknown drive
Recommended: do not connect it. Return it to security, lost property, or appropriate authorities.
Alternative: none on a normal computer.
Other tools from the same developer
Related Security Tools You Might Find Useful
USB Block
Endpoint control for blocking unauthorized USB devices and reducing data leakage on managed computers.
These tools are developed by NewSoftwares.net, the same team behind USB Secure.
Frequently asked questions
USB Malware and Security Questions
It is the process of identifying malicious files or abnormal device behavior, removing or isolating threats, and reducing future exposure through trusted-device rules, software updates, scanning, encryption, write controls, and secure disposal.
Yes. Malware may exist outside the protected area, may activate after the drive is unlocked, or may be present on the computer used to unlock it. Password protection is a confidentiality control, not a substitute for scanning.
For high-risk use, look for a reputable hardware-encrypted drive with tamper resistance, signed firmware, clear recovery design, and a current validation that matches your compliance requirement. No device removes the need for trusted handling.
Use a trusted computer whenever possible. On a shared computer, assume administrators or malware could access files after unlocking. Keep only minimal data on the drive, scan before use, avoid saving credentials, and change sensitive passwords afterward if compromise is suspected.
BadUSB can make a device impersonate a keyboard, network adapter, or other peripheral. Use only trusted devices, enforce USB class controls, monitor new peripherals, and retire devices with unexplained behavior.
No. Hand it to the organization’s security team, lost property, or appropriate authorities. Curiosity is a common social-engineering vector.
Ordinary USB drives usually do not maintain trustworthy access logs. File timestamps can change for benign reasons and can be altered. For accountability, use managed encrypted devices, endpoint logging, or a document system with audit records.
Organizations can log device identifiers, connection times, user sessions, file events, or policy violations on managed endpoints. Consumer USB drives generally do not provide location tracking by themselves.
Hardware-encrypted drives perform cryptographic operations within the device and may unlock by keypad or onboard controls. Software encryption uses the operating system or an application. Hardware can simplify cross-platform use but costs more and still requires vendor trust.
Back up what must be retained, identify the storage type, and follow an approved sanitization method. For sensitive flash media, cryptographic erase or certified physical destruction may provide more defensible assurance than repeated overwriting.
BitLocker To Go integrates with supported Windows editions and provides full-volume encryption. USB Secure offers a simpler dedicated protection workflow. Choose based on Windows edition, destination computers, recovery needs, and administrative policy.
Use a purpose-built FIDO2 security key for phishing-resistant authentication. Some systems can store a startup or recovery key on removable media, but that is different from a FIDO authenticator and should follow the platform’s official setup process.
Google Drive access is controlled through the Google account and sharing permissions rather than a separate password for each folder. For an additional layer, encrypt files locally before upload or use an approved cloud-folder protection tool. Do not share encryption passwords through the same channel as the files.
OneDrive does not add an arbitrary password directly to a normal folder. Depending on your account and use case, use sharing controls, Personal Vault, or encrypt files before synchronization. Workplace policies may restrict third-party encryption.
As the owner, unlock the drive, copy and verify your files, then use the product’s official uninstall or decryption workflow. If the drive cannot be unlocked, use legitimate recovery keys or vendor support. Reformatting destroys data and should be a last resort after backup.
A full format generally removes malware stored in the file system. Reinfection can occur from the computer or restored files, and firmware-level threats are outside the normal storage partition.
More on this topic
In-Depth Answers
How to protect a USB drive from being copied
Encryption prevents unauthorized reading while the drive is locked. Copy-control software can restrict selected content after access, but no client-side control is absolute once an authorized user can view data. Use least privilege, watermarking, audit logs, and contractual controls for valuable material.
How to use a USB drive securely on public computers
The safest answer is not to unlock sensitive files on a public computer. A compromised host can capture passwords or copy decrypted data. Use a trusted device, remote access to a protected environment, or a disposable transfer file with no reusable credentials.
How do I know if my USB drive has been tampered with?
Inspect seals, labels, enclosure fit, weight, and device identity. Record serial numbers for issued drives. Unexpected device classes, changed capacity, modified firmware behavior, or unexplained physical marks justify replacement and investigation.
Best encrypted USB drive for business
Match the purchase to your policy: hardware encryption, centralized management, recovery administration, signed firmware, validation requirements, warranty, supply-chain traceability, and support lifecycle. Test exact models before fleet deployment.
Remove write protection on USB drive
Check for a physical switch and confirm that workplace policy is not enforcing read-only access. If the drive reports errors or repeatedly returns to read-only mode, prioritize data recovery and replacement rather than forcing writes to failing flash memory.
Remove partition from USB drive
Back up all required files, identify the correct physical disk by size and label, then use Windows Disk Management or macOS Disk Utility to delete and recreate partitions. This is destructive and should only be done by the owner or an authorized administrator.
Scan for malware, control device trust, then encrypt the data
There is no single USB setting that solves every risk. File scanning addresses common malware, trusted-device policies address unknown peripherals, and encryption protects data after loss. BadUSB remains a separate firmware and device-identity problem.
For most Windows users who want a straightforward portable locking workflow, USB Secure is a reasonable option after the drive and computer are known to be clean. BitLocker To Go is stronger for native Windows full-volume encryption, while hardware-encrypted drives and managed device control fit higher-risk organizations.
