I want to check an external hard drive for possible badusb virus

Question

Hello,

I have a windows 11 laptop (not my others windows 10 laptops).

I want to use it to scan two external hard drives.

I don't even know if they have badusb or not, I am just worried because I couldn't run windows defender offline on one of my my windows 10 laptops before.

The external hard drive should both be made after 2024 by western digital and seagate.

I am wondering whether I can get badusb virus just by plugging the hard drive into my computer with autorun off?

Will windows security and mcafee virus scan on the drive find the virus if there is any?

Also, is there any way to find out if the new windows 11 computer have badusb virus if there is any?

Is there any easy way to check or protect myself?

Thanks

Answer 1

Hello,

Since Windows 7, auto-run from USB hard drives is disabled by default. If you also keep AutoPlay turned off, simply plugging in a drive will not execute files on it. BadUSB is a different class of risk. It is a malicious device that pretends to be something like a keyboard or network adapter. External hard drives from major vendors normally present only as storage. The risk is low, but it is smart to check.

Here is the a way to proceed.

First make sure Windows is fully updated, then open Windows Security and update protection signatures under Virus and threat protection > Protection updates. In Windows Security select Virus and threat protection > Scan options > Custom scan. Plug in just one external hard drive, then choose the drive letter and start the scan. Repeat for the second drive. This scan will detect any malware stored on the file system, which is by far the most likely issue.

If you also have McAfee installed, Windows Defender real-time protection will be passive. You can still run an on-demand Defender scan by turning on Periodic scanning under Windows Security. Or you can use McAfee to scan the drives. Either product can find file-based malware on the drive. No traditional antivirus can detect BadUSB firmware on the USB-to-SATA bridge, because that lives in the device firmware rather than in files.

You do not need Defender Offline just to check external drives. Defender Offline is mainly for removing persistent threats on the Windows system volume.

If you want extra assurance, you can still run it from Windows 11 through Windows Security > Virus and threat protection > Scan options > Microsoft Defender Offline scan. That scan checks your PC for system-level malware, not the drive firmware.

There is a quick way to spot BadUSB-style behavior from a drive.> Open Device Manager before you plug in the drive. Expand Keyboards and Human Interface Devices. Now plug in the external hard drive and press Action > Scan for hardware changes if needed.> A normal external drive should appear only under Disk drives, Storage controllers, and possibly Portable Devices or Volumes. If a brand new entry appears under Keyboards as HID Keyboard Device, or under Human Interface Devices as a new USB Input Device at the exact moment you plug in the drive, unplug it. That indicates the device is posing as an input device, which a storage drive should not do.

For ongoing protection, keep Windows and Windows Security up to date, keep AutoPlay off, and scan removable drives with Windows Security before opening files.

Let me know if this helps!

Answer 2

Thank you so much for your answer, I think I almost understand it now.

While I am unable to scan the firmware, badusb is posing a Human Interface Devices (as USB Input Device). Therefore if it is not present then in device manager and also a custom scan and mcafee scan show the drive as clean... then the external hard drive is clean of badusb?

I can set auto run as off and windows security to update to the latest before checking.

Thanks