I realise that having multiple AVs is not recommended, but I have a specific question.

My boss supplied me with a laptop which has like 5 different AVs (some of them are more like portable "launch and scan" type AVs where they do not run all the time). The idea is that this laptop will only be used to scan USB sticks - with all of the AVs one at a time.

Now, I tried that - scanned a USB stick with each AV at a time, and I did not see any conflicts between different AVs (no viruses identified either). The laptop had good speed and no issues.

Given this result (no noticable conflict between AVs) - is it OK to be scanning USB like that?

Me personally, I don't understand what this solves - if I think that a USB is infected, I should just format it; but if it's not infected, there is no reason to be even scanning it...

  • 4
    Is it OK? I mean... it's not going to order a tactical nuke at your location, and it won't kill your cat. Is it effective? Only for low-hanging fruit and simple or old malware. You need to make sure the AV databases are up to date though, which is a common issue for "portable" scanners. So what exactly is the question? – forest Jul 3 '19 at 9:24
  • @forest, obviously I update all AVs before scanning. But questions is essentially should I scan with 1 AV or with 5 AVs? Considering I did not see evidence of these AVs conflicting, I am not sure 1 would be better than all 5. – user1880405 Jul 3 '19 at 9:32
  • Should you? Well, I think it's a waste of time, but it's not going to break anything. – forest Jul 3 '19 at 9:37
  • 1
    An AV might be able to find 5% of sophisticated malware. Five AVs might be able to find 5.1%. One AV might be able to find 80% of old or common malware. Five AVs might be able to find 82%. This is a small benefit for so much extra work (in licenses, CPU time, storage, maintenance, etc.). – forest Jul 3 '19 at 9:42
  • 1
    @Patriot "DoD standards" are actually utterly useless for flash devices like USB sticks. – forest Jul 4 '19 at 7:26

Firstly, many anti-malware tools do conflict with each-other, so there's a reason that's not recommended. Any one modern and up-to-date antimalware software will do just fine.

Secondly, when you say this:

I don't understand what does this solve - if I think that USB is infected I should just format it, and if it's not infected there is no reason to be even scanning it...

It doesn't matter what you think. The drive is either infected or it isn't. And it's always better to be safe rather than sorry.

Also, if there's a lot of important data on a drive, you can't just reformat it without making a backup of said data. This may take a lot of time depending on how much data you're handling. And in doing so, you will probably also end up making a copy of the malware, which is definitely a Bad Thing.

Scanning USB drives is always a good idea, even when they're coming from someone you trust.

  • 1
    Always? Even if the person giving it to you has a privesc for your AV software? :P – forest Jul 3 '19 at 9:29
  • Thanks for your answer. So you would still recommend periodically scanning the USB drives, however only using a single AV tool? Does that mean that even though I did not notice any evidence of conflict, me scanning USB with 5 different AVs likely yield worse results than scanning with a single AV? – user1880405 Jul 3 '19 at 9:30
  • @user1880405 Yes, I recommend scanning all USB drives when they're plugged in. Lots of anti-malware will do this automatically. No, scanning with multiple AVs won't yield worse results - it's just pretty pointless and a waste of time. – rahuldottech Jul 3 '19 at 9:31
  • @forest I realize you're joking, but seriously, considering how improbable it is that an attacker has an unpatched privesc for your AV, yes, I stand by what I said. You should always scan USB drives that have been used in computers other than your own, and by persons other than yourself. – rahuldottech Jul 3 '19 at 9:33
  • 1
    @user1880405 I don't disagree, per se. But I still believe that any one AV is enough for >99% of consumers. Go ahead and scan with multiple AVs if you have the time and resources. But if you believe that you're a high-value target, then you need to have more security measures than just "multiple AVs" in place (such a sandboxed, disposable testing machine for external drives, a proper security policy, etc) – rahuldottech Jul 3 '19 at 9:41

Multiple AV scanners on a dedicated scanning machine is standard practice at many (perhaps all) high security locations and required use for bringing in all outside software.

Yes it's OK to be scanning a USB like that.

One can argue the value in selected circumstances but it's not harmful technically.

Bureaucratically it can lead to having to explain malware alerts that are not malware but may be declared "Bad". Many forensic or technical tools such as hex editors occasionally fall in this category. Offline virus signature update files will send scanners into fits because they are full of virus signatures, which in turn leads to having to explain that to non-technical people.

Not all scanners detect the same things so running many of them, sequentially to prevent interference, is useful although it can be time consuming.

Being required to run multiple Windows AV scanners against terrabyte Linux images can make you crazy, but it takes longer to fight than to just do it.

  • I agree with this answer because I have ignored the usual advice and used two, three, four, five AVs at a time. Once you see that some AVs miss stuff, you will not go back to using just one. – Patriot Jul 5 '19 at 10:37

Antivirus normally installs himself in the computer as a rootkit. As any good rootkit they do not like competition. (unless they are portable av)

For the scanning I would suggest you to disable auto play on the device, then use the following command "dir/w/o/a/p" (no quotes) to see what is inside.

If you do not see any malicious file that can be used in the autoplay or any file that seems suspicious executable, it is good...

now you just need to worry with the files...

To check the files with the all possible antivirus just grab the files and use virus total page he will provide you feedback from lots of AV immediately.

  • 1
    Uploading your sensitive work files to VirusTotal is a good way to get fired. – forest Jul 3 '19 at 9:44
  • you know the AV are doing the same in your computer and upload files that they do not recognize or find them suspicious to their hub for latter analysis... Did you read how the Karspersky got the NSA files? – Hugo Jul 3 '19 at 9:46
  • Depends on the AV. Also, if you have a 16 GiB flash drive and it's full, good luck uploading that all to VirusTotal without getting your IP severely ratelimited. – forest Jul 3 '19 at 9:48
  • You just need to upload all the suspicious files with some logic, the dir was to search for the suspicious. In reallity it really does not matter if you have an AV or not windows tends to do it with the Microsoft Defender Advanced Threat Protection and it is in their license agreement. They do not get all files but if their tool notices a suspicious execution path from a file it will get delivered to the Microsoft for analysis. If you have big $$ you can access their portal and see, it is really cool for forensics and to understand what might have happened. – Hugo Jul 3 '19 at 10:06
  • @Hugo it seems you are speculating all AV company want your file. If what you claim is true, Malware writer may have already uploaded terabytes of junk files and bankrupt AV company on storage cost. – mootmoot Jul 3 '19 at 10:22

This is a cheap but not efficient solution, i.e. if the USB number increase, imagine the load to trigger run of each AV.

Most AV company actually has a dedicated file scanner for business for such needs. You should look into such option.

However, the business product is usually licensed differently.

Not the answer you're looking for? Browse other questions tagged or ask your own question.