SEARCH

How-To Geek

Scan Your Thumb Drive for Viruses from the AutoPlay Dialog

It’s always a good idea to scan someone’s flash drive for viruses when you use it on your PC. Today we look at how to use Microsoft Security Essentials to scan thumb drives via the AutoPlay dialog.

Editor Note: This technique was created by our friend Ramesh Srinivasan from the winhelponline tech blog.

If you haven’t done so already, download and install Microsoft Security Essentials (link below), which has earned the How-To Geek official endorsement.

1mseatuoplay

Next download the mseautoplay.zip (link below). Unzip the file to view its contents.

sshot-2010-05-24-[01-17-22]

Then move the msescan.vbs script file into the Windows directory.

2mseautoplay

Next double-click on the mseautoplay.reg file…

3mseautoplay

Click Yes to the warning dialog window asking if you’re sure you want to add to the registry.

4mseautoplay

After it’s added you’ll get a confirmation message…click OK.

5mseautoplay

Now when you pop in a thumb drive, when AutoPlay comes up you will have the options to scan it with MSE first.

14autoplay

MSE starts the scan of the thumb drive…

sshot-2010-05-24-[19-41-28] 

You can use this to scan any removable media. Here is an example of the ability to scan a DVD with MSE before opening any files.

7mseautoplay

You can also go into Control Panel and set it as a default option of AutoPlay. Open Control Panel, View by Large icons, and click on AutoPlay.

10autoplay

Notice that now when you go to change the default options for different types of media, Scanning with MSE is now included in the dropdown lists.

11autoplay

Remove Settings

If you want to remove the MSE AutoPlay Handler, Ramesh was kind enough to create an undo registry file. Double-click on undo.reg from the original MSE AutoPlay folder and click yes to the message to remove the setting.

12undo 

Then you will need to go into the Windows directory and manually delete the msescan.vbs script file.

13undodelte

This is an awesome trick which will allow you to scan your thumb drives and other removable media from the AutoPlay dialog. We tested it out on XP, Vista, and Windows 7 and it works perfectly on each one.

Download mseautoplay.zip

Download Microsoft Security Essentials

Read Our Review of MSE

Lowell Heddings, better known online as the How-To Geek, spends all his free time bringing you fresh geekery on a daily basis. You can follow him on if you'd like.

  • Published 05/25/10

Comments (28)

  1. ibmkahm

    under win xp: isnt it already to late when you plug in an usb drive and autoplay starts, because a worm/virus can spread through autoplay ??!!!

  2. Scott Beamer

    But I already use another AntiVirus program (McAfee). How can I do it with that?

  3. Alec S.

    @ibmkahm, no, it is not too late in the circumstances given above. There is widespread confusion about the difference between AutoPlay and AutoRun. AutoPlay is Windows’ low-level detection of a new device and has nothing to do with the actual content on the device. When Windows detects a new device is attached, it pops up the dialog to ask you what you want to do with it. AutoRun is the when a file in the root directory of a storage device is called AUTORUN.INF and tells Windows what to do (usually run an executable) when the CD is inserted (or a device is attached). There is bound to be some confusion and conflict between the two, but it is widely accepted that it is okay to let AutoPlay occur (ie, give you the choice of what to do), but disable AutoRun (don’t let the disc/device decide).

    @Scott Beamer, you’ll have to make your own registry entry for that. Do you know the executable and command line parameters that your version of McAfee uses? You could also try searching the interface for an option on handling devices.

  4. Guilherme C.

    I just heard that Windows 7 can’t get infected by UBS drivers because the improved the AutoPlay for it, is it true ? Source: http://blogs.msdn.com/b/e7/archive/2009/04/27/improvements-to-autoplay.aspx

    Wating for a reply. =D

  5. S.Jaafar Al-Mosawi

    1. I use Panda USB Vaccine 1.0.1.4 to vaccinate the USB thumbs.
    2. Avira AntiVir Personal 10 has the option -switched on by default- to block autostart function on all portable disks with the option to exclude CDs and DVDs. I like this option although it conflicts with “Panda USB Vaccine 1.0.1.4″ vaccination. So AntiVire is sufficient to make you safe from autorun viruses.

  6. ibmkahm

    @Alec S.,thanks for the answer, know i understand the difference between AutoPlay and AutoRun , but the article just describes how to add an additional entry in the AutoPlay dialog -> to scan the device with MSE,
    so but under win xp AutoRun still starts bevore MSE can scan the device, doesnt it ? (and the virus can spread through AutoRun bevore MSE removes it from the device)

    or does AutoRun get disabled with the script above ?

  7. Niks

    Wow… Exactly the thing which I was looking for. Thanks a ton :)

  8. jimmy

    This looks awesome! It is filed under Windows 7 and I was wondering if it will also work on Win XP. I see some similar registry keys in XP, but not identical, so before I whack my registry, I thought I would ask? Thanks in advance!

  9. altbus1

    @Alec s.

    So for example I use Avast. I must make myself an entry for Avast, right?
    If so can you tell me how to do it? Or can I use MSE only for the scan of USB drives?
    Otherwise I’ve disabled autorun and if I right click on the drive I’ve also got an option to cheque the drive with Avast. so that will do the trick also I think.

  10. steve

    Works OK on WinXP

  11. Chris

    Why on earth do howtogeek recommend using MSE when the AV comparatives website show other Antivirus apps as better such as Avira.

  12. jimmy

    Thanks Steve – I will give it a go!!!

  13. Barbarosa

    I have both AutoRun and AutoPlay disabled (Vista). For sure, nothing starts without my explicit OK first. So, I always have to open the drive and click on whatever it is I want to do. This small activity is the price I’m willing to pay for the added security.

    That being said, when I open My Computer and right click on a drive, I see an entry to scan the drive with MSE. The entry has been place here automatically by MSE.

    In the long run, this setup is more convenient for me than downloading files and taking the time to make new registry entries. Maybe this alternative is suitable for someone else, too.

  14. Bixente

    Hello, I have done all the steps and unfortunately does not work this great trick.

    On screen I get “Sorry! Microsoft Security essntials Could not Be Launched scan”

    Working with Windows 7 Home Premium 64 bits.

    Regards

  15. Bixente

    Hello

    I followed all the steps and in the end not get it to work this excellent trick.

    I get the following screen, “sorry Microsft scan security essentials Could not Be Launched”

    Please could I have a solution to my problem?

    Thank you.

  16. Barbarosa

    Bixente, do you have MSE installed on your computer? If not, go to:
    http://www.microsoft.com/security_essentials/
    Their Download button will download the correct version for your OS.

    If I were having your problem and already had MSE installed, I would uninstall it and then reinstall it from that MS page.

  17. Bixente

    Hi Barbarosa, thanks for your response. I confirm that if I have installed MSE.

    I’ve uninstalled and reinstalled MSE for my version of Windows (Win7 Home 64-bit)

    I’ve completed all the steps, I installed the msescan.vbs file in the Windows directory and I AutoPlay window appears with the option Scan for viruses & malware MSE, but when I select this option makes no scanner and I get a message says “Sorry! Microsoft Security essntials Be Launched Could not scan.”

    Unfortunately I do not get to run this amazing trick, do you have any other suggestions I can try?

  18. Ramesh

    @Bixente: Do you use a non-English version of Windows 7 per chance? If so, one needs to edit the vbs. For example, for German version change line #16 from

    If vrb = “Scan with Microsoft Security Essentials…” Then

    To

    If vrb = “Scannen mit Microsoft Security Essentials…” Then

    Open My Computer, right-click on a drive-letter to see the exact verb/text.

  19. Barbarosa

    Bixente, sorry, my idea well has run dry. Like I indicated in my first post, I haven’t even tried to use this trick because I like my way better, i.e., keeping AutoPlay totally disabled. So, I can’t (and won’t) even test how well this trick would work for me.

    But I *can* scan the drive with MSE. I open My Computer, right click on any drive, and click on the menu item, “Scan with Microsoft Security Essentials”. And it scans the drive. If you can do that, then your MSE is working well, and the problem is somewhere else.

    My system is Vista Home Premium 64bit.

    Good luck to you!

  20. Bixente

    Barbarosa, in the end I’ve broken the changes and disabled AutoPlay, so if I can do the scanning with MSE.

    I’ll have to get used to this new system, but really effective, both in the protection and the implementation of MSE.

    Thanks for your help and happy weekend.

  21. Alfred E. Neumann

    Ouch, how clumsy!

    1. There’s no need for the indirect call of the VBS.

    Replace “InvokeProgID”=… and “InvokeVerb”=… by
    “ProgID”=”Shell.HWEventHandlerShellExecute”
    “InitCmdLine”=expand:”%SystemRoot%\\System32\\WScript.exe %SystemRoot%\\MSE_Scan.vbs \”%L\”"

    2. In the VBS the .ParseName() as well as the count/index variables are superfluous:

    Option Explicit

    If (WScript.Arguments.Count 1) Then WScript.Quit

    With WScript.CreateObject(“Shell.Application”).NameSpace(WScript.Arguments.Item(0)).Self
    Dim objVerb
    For Each objVerb In .Verbs
    If (InStr(objVerb.Name, ” Microsoft Security Essentials…”) 0) _
    Then
    objVerb.DoIt
    WScript.Quit
    End If
    Next
    End With

    WScript.CreateObject(“WScript.Shell”).PopUp “Microsoft Security Essentials cannot be launched!”, 0, WScript.ScriptName, 16

  22. Tardio

    Not working with the 2.0 beta apparently ;)

  23. Irfan

    It works beautifully !
    Thanks for posting it.

  24. Laser

    Seems the upgrade borked the path to the icon on the autoplay pop up. I have win7 64 to fix it I just edited the registry to point to the new folder

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ScanUsingMSE]

    DefaultIcon
    %ProgramFiles%\Microsoft Security Client\msseces.exe,0

    or you cat and paste this into notepad and name it fixpath.reg save it and then right click and choose merge.

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ScanUsingMSE]
    “Action”=”Scan For Viruses & Malware”
    “InvokeProgID”=”MSE_AutoPlay_Scan”
    “InvokeVerb”=”launchscanner”
    “Provider”=”Microsoft Security Essentials”
    “DefaultIcon”=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,\
    00,6c,00,65,00,73,00,25,00,5c,00,4d,00,69,00,63,00,72,00,6f,00,73,00,6f,00,\
    66,00,74,00,20,00,53,00,65,00,63,00,75,00,72,00,69,00,74,00,79,00,20,00,43,\
    00,6c,00,69,00,65,00,6e,00,74,00,5c,00,6d,00,73,00,73,00,65,00,63,00,65,00,\
    73,00,2e,00,65,00,78,00,65,00,2c,00,30,00,00,00

  25. George Niebling

    When I tried to move the script file to Windows I got

    0×80004005: unspecified error

    I’m running Win7Ultimate

  26. Edwaine

    ok i found the icons!
    its located at: “%ProgramFiles%\Microsoft Security Client\EppManifest.dll”
    i wonder how i can grab that icon.

  27. JZ3

    Worked Excellent – Exactly what I needed

  28. somesh

    @EDWAINE

    goto regedit

    1.Find the key
    2. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ScanUsingMSE
    3. right click on “defaulticon”
    4.click “modify”
    5. put “%ProgramFiles%\Microsoft Security Client\EppManifest.dll” in the box that appears

    close
    u r done!!!
    try it man, i figured it out myself!!! it works

Get Free Articles in Your Inbox!

Join 134,000 newsletter readers

Email:

Go check your email!