Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
There's a possibility that my old USB stick (which I haven't used in over a year) got a virus-infected audio file (AAC) among other trusted files. Can I safely open the trusted files bypassing the suspicious one? I've already disabled an AutoRun feature. Also I'm going to scan a USB drive using Windows Defender. What else can I do?
And yes, I'm curious to find out does any type of malicious software have an expiration date?
There are many different issues rolled into one, so I'll try to pick apart the various things.
Does a virus (malware) ever expire?
Yes, but they are very rare and are highly target-specific when running after a specific date means that the malware might be discovered or have specific effects that the malware writers don't want. Typically, this is malware aimed at government targets by other governments where the fact that there is malware should be kept secret.
Knowing that doesn't help you in your situation because you can't tell if the malware you have falls into that category. It likely doesn't though, unless you command a nuclear bunker.
On the other hand, over time, as protections improve and the type of malware you might have gets generally known by anti-virus vendors, malware gets less relevant. But do not blindly trust that "old" means "inert". Tons of very old viruses do all kinds of damage today.
which I haven't used in over a year
Yeah, a year is nothing. If we were talking 10 years, we might start to look at obsolescence. Don't consider what malware you might have as "old".
Fun fact: some malware can "phone home" and get updates. So even if the malware is "old", it can get updated to a new version once it is run.
Can I safely open the trusted files bypassing the suspicious one?
Of course. Malware is code. It needs to run to work. As long as the malware is contained to that file and you do nothing to run it (which can include your file system's "preview", if there is a vulnerability in the previewer (a rare issue)), then it's like stepping around a landmine. They don't move around to seek you out.
If the infection is in the firmware itself, then simply loading the USB stick could be enough to run the code. But then we're talking about a different situation than an infected sound file.
What else can I do?
In addition to Defender, you can send files to VirusTotal.
There are products (and hardware) that can sanitise USB sticks and the files on them using Content Disarm and Reconstruction (CDR), but we're only on the cusp of these products and they are not currently at the "free home version" yet. They are, however, used at locations like nuclear bunkers.
