2

Two days ago, someone gave me their pen drive to copy some songs from. As soon as I inserted the drive into my laptop's USB interface, Windows Defender immediately warned me that the drive was infected, so I immediately removed it without opening any of the files it contained.

I have since run the Windows Defender Antivirus Quick Scan and Full-scans several times and all looks good in that it reports the threats to have been removed.

Question

However, I am still concerned about one thing: is my USB interface now infected? That is, if I insert another pen drive into it that doesn't have any virus, will that get infected too?

I ask this because the Get-MpThreat and Get-MpThreatDetection powershell commandlets from the Defender module list a link to the drive letter in their Resources property. Please see the results below.

PS C:\> Get-MPThreat                                                                                                   

CategoryID       : 5
DidThreatExecute : False
IsActive         : False
Resources        : {file:_E:\Removable Drive (8GB).lnk->[CMDEmbedded], file:_E:\Removable Drive (8GB).lnk->[CMDEmbedded],
                   containerfile:_E:\Removable Drive (8GB).lnk}
RollupStatus     : 1
SeverityID       : 5
ThreatName       : Worm:Win32/Gamarue!lnk
TypeID           : 0


CategoryID       : 34
DidThreatExecute : False
IsActive         : False
Resources        : {file:_E:\ \aacaccaeeaaceacaceaeccceaceecacaea.aacaccaeeaaceacaceaeccceaceecacaea}
RollupStatus     : 1
SeverityID       : 5
ThreatName       : VirTool:Win32/CeeInject.XX!bit
TypeID           : 0


PS C:\> Get-MpThreatDetection                                                                                          

ActionSuccess                  : True
AdditionalActionsBitMask       : 0
CleaningActionID               : 3
CurrentThreatExecutionStatusID : 1
DetectionSourceTypeID          : 3
InitialDetectionTime           : 07-12-2019 16:19:03
LastThreatStatusChangeTime     : 07-12-2019 16:19:08
ProcessName                    : C:\Windows\explorer.exe
RemediationTime                : 07-12-2019 16:19:08
Resources                      : {file:_E:\Removable Drive (8GB).lnk->[CMDEmbedded]}
ThreatStatusErrorCode          : 0
ThreatStatusID                 : 4


ActionSuccess                  : True
AdditionalActionsBitMask       : 0
CleaningActionID               : 2
CurrentThreatExecutionStatusID : 1
DetectionSourceTypeID          : 2
InitialDetectionTime           : 07-12-2019 16:18:36
LastThreatStatusChangeTime     : 07-12-2019 16:19:06
ProcessName                    : C:\Windows\explorer.exe
RemediationTime                : 07-12-2019 16:19:06
Resources                      : {containerfile:_E:\Removable Drive (8GB).lnk, file:_E:\Removable Drive (8GB).lnk->[CMDEmbedded]}
ThreatStatusErrorCode          : 0
ThreatStatusID                 : 3


ActionSuccess                  : True
AdditionalActionsBitMask       : 0
CleaningActionID               : 9
CurrentThreatExecutionStatusID : 0
DetectionSourceTypeID          : 1
InitialDetectionTime           : 07-12-2019 16:19:27
LastThreatStatusChangeTime     : 09-12-2019 14:48:32
ProcessName                    : Unknown
RemediationTime                : 09-12-2019 14:48:32
Resources                      : {file:_E:\ \aacaccaeeaaceacaceaeccceaceecacaea.aacaccaeeaaceacaceaeccceaceecacaea}
ThreatStatusErrorCode          : 0
ThreatStatusID                 : 106

I am running Windows 10, version 1903, build 18362.476.

Improve this question
2
  • @Refineo Thank you. I am not very clever about these things, so I couldn't understand one thing still. Would it be okay for me to use other pen drives that I know are not infected? Or will they also catch the virus if I put them in the USB interface of my laptop?
    – Water Cooler v2
    Dec 9, 2019 at 14:05
  • @Refineo Thank you. That was what I needed to know. Could you please put that down as an answer?
    – Water Cooler v2
    Dec 10, 2019 at 10:52

1 Answer 1

Reset to default
2

With Windows Defender, if real-time protection is enabled, files are scanned before they are accessed and executed. The scanning scope includes all files, including those on mounted removable devices such as USB drives subject to your local configuration. The files are only scanned, they are not executed. As long as they are not executed, they won't infect your Windows machine (your USB interface).

For other pen drive to "catch the virus" you would need to copy the infected file(s) or you would need to have an active malware/virus already in your Windows machine doing so. As long as your Windows machine is not infected and as long as you do not copy the infected files into the other pen drive yourself, your other pen drives won't catch the virus. The usb interface itself cannot be infected other way then by infecting your Windows machine OS or your PC installed software including your Windows usb inferface driver. Anyway this would require executing the infected file first.

Improve this answer
1
  • 2
    unless the virus targets a vulnerability that allows it to circumvent the check or even exploit the check itself. Unlikely to catch such a virus randomly in the wild but not totally impossible.
    – Frank Hopkins
    Dec 10, 2019 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .