Softonic ran a piece this week reminding readers what security researchers have said for a decade: the USB drive someone hands you at a conference, finds in a parking lot, or ships to your office with promotional stickers is one of the cheapest ways into a corporate network. BadUSB firmware attacks impersonate keyboards. AutoRun leftovers still work on unpatched Windows. Ransomware droppers wait for the drive to open in a file manager. Scanning before mounting is the shortest fix.
We tested 8 desktop apps that either scan a removable drive on connect, sandbox its contents, or block unknown devices from mounting at all. The list covers the mainstream antivirus suites (Bitdefender, Malwarebytes, Kaspersky, ESET), the open-source scanner every Linux admin uses (ClamAV), a Linux-native device policy tool (USBGuard), a dynamic analysis sandbox (Cuckoo), and a fast on-demand file uploader (VirusTotal). Every option runs on Windows, macOS, or Linux; several run on all three.
What to look for in a USB drive threat scanner
- Automatic scan on connect, not just manual right-click scan. Half of USB attacks fire in seconds when the drive mounts.
- Behaviour-based detection, not signatures alone. Ransomware droppers on new USBs often have zero-day payloads.
- Device policy: block unknown devices from mounting at all until you approve them, especially on servers and lab machines.
- Firmware and HID protection against BadUSB-style attacks (a “USB stick” that identifies as a keyboard and types commands).
- No cloud-only lookup requirement if the drive belongs to a client that forbids exfiltrating file hashes.
Quick comparison
| App | Best for | OS | Auto-scan on connect | Cost |
|---|---|---|---|---|
| Bitdefender | Best overall detection | Windows, macOS | Yes | Around $30 to $60/yr |
| Malwarebytes | Second-opinion scanner | Windows, macOS | Yes (paid) | Around $40/yr |
| Kaspersky | Deep sandbox and heuristics | Windows, macOS, Linux (Endpoint) | Yes | Around $50/yr |
| ESET NOD32 | Low overhead, strong heuristics | Windows, macOS, Linux | Yes | Around $40/yr |
| ClamAV | Free scanner for scripts and servers | Windows, macOS, Linux | On-demand | Free (open source) |
| USBGuard | Device policy on Linux | Linux | Blocks unknown | Free (open source) |
| Cuckoo Sandbox | Dynamic analysis of a suspect executable | Linux (host) | Manual | Free (open source) |
| VirusTotal Uploader | Fast 70-engine cloud verdict | Windows, macOS, Linux | Manual | Free (public API) |
1. Bitdefender — best overall detection
Bitdefender Total Security consistently tops AV-TEST and AV-Comparatives detection benchmarks and defaults to scanning removable drives on connect. The behavioural engine catches ransomware droppers that haven’t been seen before, and the Safe Files module blocks unauthorised processes from touching protected folders even if a payload runs.
Where it falls short: The suite bundles features (VPN, password manager, parental controls) that not everyone wants. Some users find the notification cadence heavy on default settings.
Pricing:
- Bitdefender Antivirus Plus: Around $30/yr (Windows)
- Bitdefender Total Security: Around $50/yr (multi-platform, first-year discount common)
Platforms: Windows, macOS (Total Security also on Android and iOS)
Download: bitdefender.com/consumer
Bottom line: Best if you want the strongest general-purpose scanner and don’t mind a full suite.
2. Malwarebytes — best second-opinion scanner
Malwarebytes built its reputation cleaning up infections that other AVs missed. The free tier runs on-demand scans of any folder or drive; the paid Premium tier adds real-time protection with auto-scan on USB insertion, exploit protection, and behavioural detection. It coexists with another antivirus, so it’s the tool most IT teams keep as the “when in doubt, scan with this too” option.
Where it falls short: Free tier is manual only. Some benchmarks rate its zero-day detection just below Bitdefender and Kaspersky.
Pricing:
- Free: On-demand scan
- Malwarebytes Premium: Around $40/yr
Platforms: Windows, macOS
Download: malwarebytes.com
Bottom line: Best as the second scanner on any machine that handles unknown USBs regularly.
3. Kaspersky — best sandbox and heuristics
Kaspersky ships one of the more aggressive heuristic engines and includes an application control that can quarantine an executable on a USB drive before it runs. The Endpoint Security build runs on Linux, which is unusual for a consumer-facing suite and useful for a small server that occasionally sees a technician’s USB.
Where it falls short: Geopolitical scrutiny is real, and some governments and organisations have banned Kaspersky on their networks. Verify your risk model before deploying on sensitive work machines.
Pricing:
- Kaspersky Standard: Around $30/yr
- Kaspersky Plus: Around $50/yr
- Kaspersky Endpoint Security (Linux/business): Contact sales
Platforms: Windows, macOS, Linux (Endpoint)
Download: kaspersky.com
Bottom line: Best on machines where deep heuristics matter and Kaspersky isn’t on a policy blocklist.
4. ESET NOD32 — best low-overhead
ESET NOD32 Antivirus stays lighter on CPU and memory than most suites, which matters on older laptops and headless Linux boxes. Heuristics catch macro-based droppers on USB-borne office documents, and removable-media scanning is enabled by default.
Where it falls short: Some advanced features (device control, network attack protection) live in the pricier Smart Security tier. UI feels dated to some users.
Pricing:
- ESET NOD32 Antivirus: Around $40/yr
- ESET Smart Security Premium: Around $60/yr
Platforms: Windows, macOS, Linux
Download: eset.com
Bottom line: Best on older or resource-constrained hardware that still handles USBs.
5. ClamAV — best free scanner for scripts
ClamAV is the open-source scanner that Linux mail servers have used for decades. On a workstation, it’s the tool you shell out to when you want a scriptable “scan this folder” that returns a clean exit code. Signatures update via freshclam; a scan of a mounted USB completes in seconds to minutes depending on size.
Where it falls short: No real-time protection out of the box. Signature-based detection misses novel threats that behavioural engines catch. The GUI (ClamTk) is functional but basic.
Pricing:
- Free (open source, GPLv2)
Platforms: Windows, macOS, Linux
Download: clamav.net/downloads
Bottom line: Best for scripted scans, home lab servers, and anywhere a lightweight free engine is enough.
6. USBGuard — best device policy on Linux
USBGuard takes a different approach: block every USB device from mounting until it matches a rule, then log everything. Pair it with udev rules and you can configure a workstation to accept the built-in keyboard and mouse but reject any new keyboard, storage device, or HID that plugs in later. That’s the direct answer to BadUSB firmware attacks.
Where it falls short: Linux only. Requires upfront rule-writing for the devices you actually want to allow. Not user-friendly for households; better on a hardened workstation or server.
Pricing:
- Free (open source, GPLv2)
Platforms: Linux
Download: usbguard.github.io
Bottom line: Best on a Linux workstation where the threat model includes an attacker with physical access.
7. Cuckoo Sandbox — best dynamic analysis
Cuckoo Sandbox runs a suspect executable inside a controlled VM, records API calls, file writes, and network activity, and produces a report. It’s the tool of choice when you have one file from an unknown USB and you want to know what it actually does before running it on a real machine.
Where it falls short: Setup takes hours; the maintained fork (CAPEv2) is easier to deploy but still expects a Linux host, a hypervisor, and Windows VM images. Not something a non-technical user runs.
Pricing:
- Free (open source, GPLv3)
Platforms: Linux (host); analyses Windows, macOS, and Linux samples
Download: cuckoosandbox.org or the maintained CAPEv2
Bottom line: Best when a specific file needs a verdict and you have the time to sandbox it properly.
8. VirusTotal Uploader — best fast cloud verdict
VirusTotal Uploader posts a file (or a hash) to 70+ engines at once and returns a consolidated verdict. It’s the sanity check when a USB drops a single suspicious executable and you want a second, third, and thirtieth opinion in under a minute. The Windows Explorer integration adds a right-click “scan with VirusTotal” that streamlines the workflow.
Where it falls short: Uploaded files become searchable by anyone with a VirusTotal Enterprise account. Never upload confidential documents. The free public API rate-limits at four requests per minute.
Pricing:
- Free (public API)
- VirusTotal Enterprise: Contact sales
Platforms: Windows, macOS, Linux (CLI and browser upload work everywhere)
Download: virustotal.com
Bottom line: Best for a fast verdict on a specific file, never for anything sensitive.
How to pick the right one
If you want one tool that catches most USB threats on default settings: Bitdefender Total Security.
If you already have an AV and want a second opinion when a USB seems off: Malwarebytes Premium.
If low overhead is your first requirement: ESET NOD32.
If you’re on Linux and want the sharpest control: USBGuard to block unknown devices, ClamAV to scan what you allow.
If a single executable on a drive needs deeper analysis: Cuckoo Sandbox (or CAPEv2) for dynamic behaviour, VirusTotal Uploader for a fast consensus.
If the machine sits behind a policy that bans Kaspersky: skip it. Otherwise, its heuristics are among the strongest and its Linux endpoint is a rarity.
FAQ
Is it enough to just scan a USB when I plug it in?
Signature-based scans catch known payloads. Behaviour-based scanning and device policy (USBGuard on Linux, similar controls in enterprise Windows) are what catch novel or firmware-based attacks. Use both when the drive is untrusted.
What is a BadUSB attack?
A BadUSB device reprograms a USB controller’s firmware to pretend to be something the user didn’t expect, usually a keyboard that types shell commands the instant it’s plugged in. Antivirus scanning a drive’s contents doesn’t help; the payload runs before any file is read. Device policy tools like USBGuard block the class of device (unknown HID) from being accepted at all.
Can I trust a USB drive from a colleague?
Same rules apply: their machine might have picked up something they don’t know about. A quick scan on connect adds seconds and catches most cross-contamination.
What is the best free option?
For Windows, Malwarebytes Free (on-demand) plus Windows Defender’s real-time protection covers the basics. For Linux, ClamAV with a clamdscan on mount hook covers scripted scanning; add USBGuard if the machine sits somewhere physically accessible.
Should I disable AutoRun and AutoPlay?
Yes. Both features exist for a reason but are the most common enabler of USB-borne malware. Windows Group Policy or the registry can turn them off; on a home machine, disable AutoPlay from Settings and never leave AutoRun enabled.
Are USB-C drives any safer than USB-A?
The physical connector is irrelevant. What matters is the drive’s firmware, controller, and contents. Treat both the same way.
