What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, a USB drive can infect a Windows PC. The safest routine is to use only a drive with a known origin, update Windows and Microsoft Defender before connecting it, keep real-time protection enabled, avoid AutoPlay actions, scan the mounted drive before opening files, and eject it through Windows when finished. A USB stick found in public should be turned in rather than tested on a computer containing personal or business data.
Why a USB drive can be dangerous
Removable media gives malicious software a physical route into a computer. Malware and worms can be carried on USB flash drives and may try to spread through Windows features that process removable media automatically. A drive does not have to look unusual: an executable, script, Office document, PDF or shortcut can be disguised with a familiar filename or icon.
The risk is highest when the drive’s origin is unknown, when it has been used on public computers, or when Windows or antimalware protection is out of date. Microsoft describes Autorun as a propagation mechanism that threats can use to spread through removable drives. Avoiding automatic actions and scanning before browsing substantially reduces the chance that simply connecting the device turns into an infection.
Recommended Free Tools
Drives you should not test
- A USB stick found in a car park, meeting room, lobby or other public place.
- A drive whose owner, contents or chain of custody cannot be verified.
- A drive handed to you with pressure to open a particular file or enable a document feature.
- A drive recently used on a café, library or other shared computer when your antimalware protection is not active.
Microsoft Support advises turning a found drive in to a nearby receptionist or lost-and-found. If an unknown removable device is connected anyway, its guidance is to run a security scan immediately.
#1 Best Overall
Prepare Windows before connecting the drive
Preparation matters because a scan is only as useful as the protection and signatures performing it. Complete these checks before inserting the USB device.
Install current updates
Install pending Windows updates and current Microsoft Defender security-intelligence updates. Security intelligence contains the detections Defender uses to recognize known malicious files and behaviors; an old update can leave a newly encountered threat unidentified.
Confirm real-time protection
Open Windows Security > Virus & threat protection. Confirm that protection is active and that Real-time protection is on. Do not connect a suspicious drive while protection is intentionally disabled for troubleshooting or another task.
Use a standard account when possible
A non-administrator account limits the privileges available to software running as the logged-in user. It cannot make a malicious file harmless, but it can reduce the impact of malware that starts under that account. Enter administrator credentials only for a task you understand and expect.
Rank #2
A safe connection and scanning procedure
Use this sequence for a drive that you trust enough to connect. The order is deliberate: connect without launching content, scan first, then decide what can be opened.
- Assess the source. Confirm who supplied the drive and why. If its provenance is unclear, do not plug it into a computer with valuable data. Return it to lost-and-found or the owner instead.
- Finish the Windows checks. Install updates, confirm current Defender security intelligence, and verify that real-time protection is enabled.
- Insert the drive and wait. Let Windows recognize the device. Do not accept an unexpected AutoPlay prompt, open a suggested folder, or launch a program presented automatically.
- Scan the mounted drive. Open Windows Security > Virus & threat protection > Scan options > Custom scan. Select the USB drive or its top-level folder and start the scan. A Custom scan is designed to scan selected files and folders, making it suitable for a portable drive before you browse through it.
- Review the result. If Defender reports a threat, leave the affected item quarantined or remove it through Windows Security. Do not override the warning simply because the filename appears familiar.
- Scan individual items when needed. In File Explorer, right-click a file or folder and choose Scan with Microsoft Defender. On Windows 11, choose Show more options first if the scan command is not visible in the initial context menu.
- Open only what you have a reason to use. Prefer ordinary data files from a verified source. Treat executables, scripts, Office files and PDFs on an unfamiliar drive as untrusted until their origin and purpose are confirmed.
- Eject before unplugging. Close every file using the drive, select the taskbar Safely Remove Hardware and Eject Media icon, choose Eject <device>, and wait for Safe To Remove Hardware. Only then disconnect the USB device.
Choose the right level of trust
Scanning is not a substitute for deciding whether a device should be connected. Use the drive’s origin, the data on your PC and the action you plan to take together.
| Drive situation | Recommended decision | Reason |
|---|---|---|
| Drive you purchased or have used yourself | Connect with Defender real-time protection active, then run a Custom scan before opening new files. | You know the normal owner and purpose, but files can still be infected if the drive was used elsewhere. |
| Drive supplied by a known colleague or organization | Verify the expected files and scan the drive before opening them. | A trusted person can unknowingly pass along an infected file. |
| Drive used on a café, library or other public computer | Connect only after confirming antimalware is active; scan immediately. | Public computers increase the number of environments that may have written malware to the device. |
| Found drive or unknown owner | Do not connect it to a computer containing valuable data; turn it in instead. | There is no reliable way to establish its contents or intent merely by looking at the casing. |
| Drive that displays an unexpected prompt or asks for elevated access | Cancel the prompt and stop opening files until the device and request are verified. | Unexpected execution requests are a warning sign, not a required step for viewing ordinary data. |
AutoPlay and Autorun: what to do
AutoPlay is the user-facing behavior that offers an action when removable media is connected. Autorun is a Windows mechanism that malware has used to propagate through removable drives. The safest response to an unexpected prompt is to cancel it rather than choosing an action.
Free tools Windows power users keep installed
One-click scans. No signup required.
Disabling Autorun reduces one route of spread, but it does not make a USB drive safe. A user can still double-click a malicious executable, open a booby-trapped document or run a script. Keep automatic actions disabled where your Windows configuration permits, and continue to scan the drive before browsing deeply.
Scanning choices and when to use each one
| Scan | How to start it | Best use | Trade-off |
|---|---|---|---|
| Custom scan | Windows Security > Virus & threat protection > Scan options > Custom scan, then select the mounted USB drive or its top-level folder. | First check before opening files on a removable drive. | Targets the location you select rather than every location on the PC. |
| Individual-item scan | In File Explorer, right-click a file or folder and choose Scan with Microsoft Defender; on Windows 11 use Show more options if required. | Checking a particular download, document or folder before using it. | You must select every item you want checked; it is not a whole-device scan by itself. |
| Full scan | Choose the Full scan option in Windows Security. | When you want Defender to examine the broader Windows system in addition to the USB contents. | It can take considerably longer than a location-specific scan. |
| Microsoft Defender Offline scan | Start it from Windows Security when persistence or active compromise is suspected. | Suspicious system behavior, repeated detections or malware that may interfere with normal Windows scanning. | The PC restarts and scans in the Windows Recovery Environment; save work first. |
A Custom scan is the practical first step for a newly mounted USB drive. A Full scan becomes relevant when the concern extends beyond the removable media. Use Offline scan when the PC itself may be compromised or a persistent threat is suspected.
Handle files as untrusted until they are justified
Executables and scripts
Do not run an .exe, installer, batch file, PowerShell script or other executable merely because its name resembles a program you recognize. Verify the sender and expected filename through a separate trusted channel, then scan the item. If there is no legitimate reason for the file to execute, leave it unopened.
Office documents
An unexpected Word, Excel or similar Office document may request macros or other active content. Do not click Enable Content just to view a document. A document that requires an unexpected permission change is a reason to stop and verify its source.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesPDFs and other documents
PDFs are data files, but a malicious PDF can still exploit software vulnerabilities or direct you to unsafe content. Keep Windows and document-reading software updated, scan the file, and do not follow unexpected links or prompts presented by it.
Rank #4
Shortcuts and misleading names
Malware can use familiar names, icons or shortcuts to make an executable look like a folder or document. Turn on enough File Explorer detail to identify the real file type, and do not rely on the visible name alone.
What to do when Defender finds something
- Stop opening files from the drive. Close any File Explorer window showing its contents and do not continue testing other items.
- Use Windows Security’s recommended action. Quarantine or remove the detection rather than allowing it to run.
- Record what was detected. Note the detection name, affected path and time so you can explain the event to an administrator or support team.
- Disconnect safely if possible. If no process is actively using the drive, eject it through Windows. If Windows cannot eject it, close applications that may have open handles and try again; do not pull it out while files are being written.
- Check the PC if exposure occurred. If you opened or ran a suspicious item, or if the computer behaves unusually, run a broader scan and consider Microsoft Defender Offline.
Do not restore a quarantined file simply because you need its contents. Obtain a clean copy from the original source or have an administrator assess it.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to run Microsoft Defender Offline
Use an Offline scan when malware may be persistent, when detections return after removal, or when Windows behaves suspiciously after a USB file was opened. Windows restarts and scans in the Windows Recovery Environment before normal Windows loads, which can prevent active malware from hiding or blocking the scan.
Save work and close applications before starting. Expect the computer to restart; do not begin the scan when an interruption could damage an unsaved project. After Windows returns, review the result in Windows Security and avoid reconnecting the suspect drive until the system is considered clean.
Safely eject the USB drive
Removing a drive while Windows is still writing data can corrupt files even when no malware is involved. Use this exact routine:
- Save work and close documents, media players, backup tools and File Explorer windows that use the USB drive.
- Select the taskbar Safely Remove Hardware and Eject Media icon.
- Choose Eject <device>.
- Wait for the Safe To Remove Hardware notification.
- Unplug the drive only after that confirmation.
If Windows says the device is busy, stop applications that may still be reading or writing it and retry the eject command. Repeatedly pulling the device out can damage the file system and leave you with missing or corrupted data.
Stronger controls for business and managed PCs
Home users generally rely on Defender, account permissions and safe handling. Organizations can add policy controls through Microsoft Defender for Endpoint device control, subject to the Windows edition, Defender licensing and the configuration chosen by the IT team.
- Allow or block specific USB devices: permit approved hardware while denying unknown devices.
- Deny write access: let employees read approved media without allowing files to be copied onto it.
- Require BitLocker-encrypted removable media: protect data if an approved drive is lost.
- Block untrusted or unsigned processes launched from USB: reduce the chance that a portable executable can run.
These policies require organizational planning and testing. They are not automatically present on every Windows installation, and a consumer PC may not have the required Defender licensing.
Optional precautions for sensitive files
If you routinely move confidential information, consider removable media with hardware encryption or a physical write-protection control. These features address different problems: encryption protects stored data if the drive is lost, while write protection can prevent unwanted changes to the device. Neither feature replaces Windows updates, Defender real-time protection or scanning, and neither makes an unknown drive safe to connect.
A practical decision checklist
- Do I know who owns this drive and why I received it?
- Is Windows updated, and is Microsoft Defender security intelligence current?
- Is Virus & threat protection active with Real-time protection enabled?
- Am I using a standard account rather than an administrator account?
- Did I avoid accepting unexpected AutoPlay actions?
- Did I run a Custom scan on the mounted drive before opening files?
- Did I avoid executables, scripts and unexpected Office content?
- If a warning appeared, did I quarantine or remove the detection instead of overriding it?
- Did I eject the device and wait for Safe To Remove Hardware before unplugging it?
If any answer is no, pause before opening more content. The safest USB workflow is a series of small decisions that prevent an untrusted file from executing and prevent a simple removal mistake from corrupting legitimate data.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
