Free tools Windows power users keep installed
One-click scans. No signup required.
Yes, a USB drive can infect a Windows PC, but you can reduce the risk substantially by controlling the drive’s source, keeping Windows Security current, scanning the mounted drive before opening files, refusing unexpected AutoPlay actions, using a non-administrator account, and ejecting the drive properly. Never plug in a found or unexplained USB stick. If you must connect a drive of uncertain history, make sure Microsoft Defender real-time protection is active, scan it immediately, and treat every executable, script, Office document, and PDF on it as untrusted until you have checked it.
Can a USB drive infect a Windows PC?
It can. Malware and worms can use removable storage as a transport between computers. A malicious file may be disguised with a familiar name, an Office document may ask you to enable content, or a script or executable may run under your Windows account when you open it. Microsoft documents removable-drive propagation through the Windows Autorun function.
As an Amazon Associate I earn from qualifying purchases.
Infection is not inevitable: simply owning a flash drive does not make it dangerous. Risk depends on where the drive came from, what was written to it, whether Windows and Defender security intelligence are current, whether real-time protection is enabled, what privileges your account has, and whether you open or execute anything on the drive. The Microsoft guidance used for this procedure does not provide a current prevalence percentage for USB malware, so there is no defensible “one in X drives” figure to quote.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe safest rule is simple: use a drive you own or obtained from a source you trust. A drive found in a car park, classroom, lobby, or office should go to reception or lost-and-found rather than into your computer. Microsoft Support’s advice is, “If you find a USB drive just laying around, apparently lost, see if there is a nearby receptionist, or lost-and-found, that you can turn it in to.”
#1 Best Overall
What to do before connecting any removable drive
Judge the drive’s provenance
Ask who supplied the drive, where it has been used, and whether its contents are expected. A new drive from a reputable retailer or a drive that has stayed under your control is easier to trust than one passed through several people. If the drive was used on a café, hotel, library, school, or other public computer, assume that its contents need checking before you open them.
- Do not connect a drive found in public or whose owner cannot be established.
- Do not rely on a familiar label such as “Photos,” “Payroll,” or a colleague’s name as proof that the files are safe.
- If the drive contains sensitive work, consider a hardware-encrypted or write-protected removable drive. No particular brand or model is required for the procedure below.
Update Windows and Defender
Install pending Windows updates and current Microsoft Defender security-intelligence updates before you connect the drive. In Windows Security, open Virus & threat protection and verify that protection is active. Under Virus & threat protection settings, confirm that Real-time protection is on. Real-time protection gives Windows a chance to inspect files as they are accessed; it is not a substitute for a deliberate scan of an unfamiliar drive.
Use the least privilege available
A standard, non-administrator account limits what malware can change if something does run under your account. It does not make a malicious file harmless, and it does not replace scanning. On a shared or business computer, follow the organization’s removable-media policy rather than changing security settings yourself.
Safe step-by-step procedure for a USB drive
- Prepare the PC. Finish or save important work, install current Windows and Defender updates, and check that Windows Security reports active protection and enabled real-time protection.
- Connect without launching content. Insert the USB drive and wait for Windows to recognize it. Do not double-click the drive in File Explorer yet. If an AutoPlay notification appears, dismiss it rather than accepting an unexpected action such as opening a folder, importing photos, or running a program.
- Open Windows Security directly. Select Windows Security from the Start menu, then choose Virus & threat protection.
- Start a Custom scan. Select Scan options, choose Custom scan, select the mounted USB drive or its top-level folder, and start the scan. Microsoft describes Custom scan as the option for selected files and folders; its Defender guidance identifies a USB drive as an appropriate portable-device target.
- Wait for the result before browsing deeply. Do not open documents, launch installers, or copy a large batch of files while the scan is still running. If Windows Security reports a detection, follow its quarantine or removal action before doing anything else with the drive.
- Scan individual items when needed. In File Explorer, right-click a particular file or folder and choose Scan with Microsoft Defender. On Windows 11, the command may be under Show more options in the first context menu.
- Open only what you can identify. After a clean result, start with ordinary data files you expected to receive. Keep executables, scripts, macros, and documents that request extra permissions separate from your normal workflow until you have verified their source.
- Eject before removal. Close every file on the drive, select the taskbar Safely Remove Hardware and Eject Media icon, choose Eject <device>, and wait for the Safe To Remove Hardware message. Unplug only after that confirmation.
Choosing the right Defender scan
Scan depth should match the question you are trying to answer. A selected-drive scan is the normal first move for a removable disk; broader or offline scans are escalation steps when the computer itself may be involved.
Rank #2
| Scan approach | Best use | How to start it | What to expect |
|---|---|---|---|
| Custom scan | Check the mounted USB drive before opening its contents | Windows Security > Virus & threat protection > Scan options > Custom scan, then select the USB drive or its top-level folder | Targets the files and folders you select; this is the focused removable-drive check |
| Full scan | Concern extends beyond the USB drive to files and programs on the Windows PC | Windows Security > Virus & threat protection > Scan options > Full scan | Uses a broader scan scope than a selected USB folder and can take substantially longer |
| Microsoft Defender Offline | Possible persistent malware, repeated detections, or suspicious Windows behavior after the drive was used | Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan | The PC restarts and scans in the Windows Recovery Environment before normal Windows loads; save work first |
A clean Custom scan means Defender found no threat in the selected scope with its current signatures and settings. It is not proof that every file is suitable for your purpose, nor does it establish that a file came from the person who claims to have sent it. If your PC begins behaving suspiciously after the connection, use the broader or offline option rather than repeatedly rescanning one document.
How to handle files that look suspicious
Executables and scripts
Treat files such as .exe, .msi, .bat, .cmd, .js, .vbs, and PowerShell scripts as programs, not ordinary documents. Do not run one merely because its filename resembles a utility you recognize. Check with the person or organization that supplied the drive using a separate, trusted channel, and obtain the file from an official source when possible.
Office documents and PDFs
An unexpected Word, Excel, or similar Office file may ask you to enable macros or “content.” Do not click Enable Content just to view a document. A PDF can also contain malicious content or attempt to exploit a vulnerable reader. If you were not expecting the file, leave it unopened until its origin and purpose are confirmed. Scanning the file first is useful, but a clean scan does not turn an unsolicited document into a trusted one.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteDetections and quarantine
A detection is a stop signal. In Windows Security, review the alert and use the available quarantine or removal action. Do not restore a quarantined item simply because its name looks familiar. If the drive belongs to an employer, preserve the alert details and follow the organization’s incident-reporting process rather than deleting evidence or continuing to browse.
AutoPlay and Autorun: what to disable and what to avoid
AutoPlay is the Windows prompt that offers an action when removable media is connected. Autorun is the Windows mechanism that malware has historically tried to abuse to spread through removable drives. Microsoft describes a threat that “tries to use the Windows Autorun function to spread via removable drives, like USB flash drives.” Avoiding automatic actions and disabling Autorun where your Windows configuration permits it removes one propagation route.
For everyday use, the practical behavior is:
- Dismiss unexpected AutoPlay prompts instead of choosing an action automatically.
- Do not let a USB drive open an installer, script, media player, or import tool before you have scanned it.
- Keep AutoPlay turned off in Windows Settings if you do not need automatic actions. The exact label and location can vary by Windows release; search Settings for AutoPlay and set removable-drive actions to take no automatic action.
- On managed computers, ask your administrator whether an Autorun policy is disabled. Do not bypass a company policy by changing registry or Group Policy settings yourself.
Turning off AutoPlay reduces prompts and accidental launches, but it does not make a malicious file safe if you later open it manually. Scanning, cautious file handling, and current protection still matter.
Unknown, borrowed, and public-computer USB drives
A found drive
Do not plug it in “just to see what is on it.” Connecting it to a computer containing personal, financial, or business data creates an avoidable risk. Turn it in to a nearby receptionist or lost-and-found instead.
Recommended Free Tools
A borrowed drive from a known person
Known ownership lowers uncertainty but does not prove that the drive is clean. Ask what files you should expect, connect it only to a prepared PC, scan the drive before opening anything, and return it through the same controlled process. If the owner used it on public computers, treat it as higher risk.
Rank #4
A drive used on a public computer
Make sure antimalware is active before connecting it. Scan immediately, avoid opening unfamiliar files, and do not copy the entire drive to your internal disk before the scan completes. If you only need a few known files, scan those individually again after the drive-level check.
What to do if you suspect exposure
Act promptly if the drive launched something unexpectedly, Windows Security reported malware, files were renamed or encrypted, or the PC began behaving strangely.
- Disconnect the PC from networks if your organization’s incident procedure calls for isolation, and stop opening files from the USB drive.
- In Windows Security, quarantine or remove the reported item. Do not approve an exclusion or restore a detection to keep working faster.
- Save work and run Microsoft Defender Offline. The computer restarts and scans before normal Windows loads, which is useful when malware may be persistent.
- After the offline scan, review Protection history in Windows Security and follow any recommended remediation.
- If the computer is managed, contact IT or your security team. Tell them when the drive was connected, what files were opened, and what alerts appeared.
- Change passwords from a known-clean device if you entered credentials after a suspicious launch or if your security team instructs you to do so.
Do not rely on a single clean scan to dismiss a serious event. The purpose of the Offline scan is to examine the system outside the normal Windows session when ordinary scanning may not be enough.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Safe removal prevents file corruption
Malware prevention and data integrity are separate concerns. Even a completely clean drive can lose data if it is unplugged while Windows is writing cached data. Close open files and copy operations, then use the taskbar Safely Remove Hardware and Eject Media icon. Select Eject <device> and wait for Safe To Remove Hardware before unplugging.
Microsoft Support states, “To avoid losing data, always safely remove hardware devices like USB flash drives or external hard drives before disconnecting them.” If Windows says the device is still in use, close File Explorer windows and applications that may be reading the drive, wait for transfers to finish, and try the eject command again. Do not pull the drive simply because the copy dialog appears finished.
Stronger controls for business and shared PCs
Home users can rely mainly on cautious handling, Defender, account privileges, and safe eject. Organizations handling customer records, source code, financial data, or regulated information may need policy enforcement that an individual user cannot provide.
| Control | What it can enforce | Important qualification |
|---|---|---|
| Device allow/block rules | Permit approved USB devices and block specific or unknown devices | Requires organizational configuration |
| Write-access control | Deny writing to removable media to reduce data exfiltration and tampering | May prevent legitimate file transfers; policy must define exceptions |
| Encryption requirement | Require BitLocker-encrypted removable media for protected data | Depends on Windows edition, organizational setup, and Defender licensing |
| Process restrictions | Block untrusted or unsigned processes launched from USB storage | Requires Defender for Endpoint device-control configuration and can affect specialist tools |
Microsoft Defender for Endpoint device control supports these kinds of removable-media policies. Availability and behavior depend on the organization’s configuration, Windows edition, and Defender licensing. Users should not attempt to work around a block by moving files to an unapproved drive.
Decision guide: which approach fits your situation?
| Situation | Recommended action | Do not do |
|---|---|---|
| Drive you own and routinely use | Keep Windows Security current, scan when files came from another computer, and eject safely | Assume ownership makes every downloaded file safe |
| Drive from a colleague or family member | Confirm expected contents, scan the mounted drive, then open only identified files | Run an installer or enable Office content immediately |
| Drive used on a café, library, or other public PC | Verify real-time protection, connect cautiously, and run a Custom scan before browsing deeply | Copy the entire drive before scanning |
| Found or unexplained drive | Do not connect it; turn it in to reception or lost-and-found | Inspect it on a personal or work PC |
| Detection or suspicious PC behavior after connection | Stop using the drive, quarantine detections, and run Microsoft Defender Offline; involve IT when applicable | Restore detections or continue opening files to identify the cause |
A compact checklist
- Know who supplied the drive and why you need it.
- Never connect a found drive.
- Install current Windows and Defender security-intelligence updates.
- Confirm Windows Security real-time protection is on.
- Use a standard account instead of an administrator account when practical.
- Dismiss unexpected AutoPlay actions and keep Autorun disabled where your configuration allows.
- Run Windows Security’s Custom scan against the mounted USB drive before opening files.
- Right-click individual files or folders and choose Scan with Microsoft Defender; use Show more options on Windows 11 if necessary.
- Never run an unfamiliar executable or script, and never enable unexpected Office content merely to view a document.
- Escalate to a Full or Microsoft Defender Offline scan when the PC itself may be affected.
- Close files and use Safely Remove Hardware and Eject Media before unplugging.
Following these steps does not create an absolute guarantee—no security tool can—but it removes the easiest USB infection paths while preserving a practical workflow for legitimate file transfers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
