The Anti-virus Times

Thursday, February 8, 2018

Back in the Stone Age, “information” was transmitted exclusively on hard media. And anyone attempting to steal “information” could easily be slayed with that very same “media”.

Over time, media has gotten much smaller and lighter: to transfer data between computers, people came to use floppy disks, flash drives, and special and ordinary hard drives (as well as the now-forgotten ZIP drives and Bernoulli disks and similar data carriers no longer capable of delivering a “death blow”). But, having lost the capacity to harm attackers, these media became their “helpers”. Thanks to the fact that PCs and mobile devices can be infected via removable media, Trojans can emerge in the most unexpected places.

Until recently, anti-virus users insisted that anti-virus developers supplement their solutions with a feature enabling anti-viruses to scan removable media at the moment they connect to a PC. And some companies did implement that feature in their products. But a flash drive (let alone an external hard drive) is not a 1.44 MB floppy disk. Scanning a hard drive of 1 GB or more can take a while. Blocking access to a computer while scanning is in progress (which could be for hours) is unacceptable. A malicious file will be detected by the file monitor (Dr.Web SpIDer Guard if Dr.Web is in use) as soon as any process attempts to access it for the very first time.

But the scanning duration is not the biggest problem. Many users disregard the standard disconnection procedure for removable devices (under Windows, this feature is called "safely remove hardware”) and just pull out their flash drives and hard disks. If, at that moment, a media device is being accessed by the anti-virus, the data stored on it can be damaged.

It can even get more complicated if the removable device doesn't feature an LED indicator showing when the device is being accessed. So, because users simply can't see that a process is using the disk, they unplug it as soon as they finish working with it.

With the proliferation of network drives and the emergence of cloud storage services, fewer users are requesting automatic scanning for removable media (although there is still some demand for it). But, as you know, history has a way of repeating itself, and removable media has returned. And a spectacular return it is!

We’re wondering: what happens if this data storage medium is unplugged while it’s being scanned by an anti-virus?

And how do you disconnect flash drives from your computer?

• I'm always pulling out USB sticks without doing anything else, and everything is always OK.
• I always use the Safely Remove hardware feature to unplug my devices.
• I didn't use the feature before, but I now realise that was a mistake.