I have an external USB backup drive that I suspect being infected with a rootkit and fear it might spread to the host Linux system when just connected. Some experts say that some malware has infected systems from USB media even when unmounted. How can I scan and clean it safely? Thank you

  • 1
    Indeed. This is possible if the "malware" is located within the boot block/partition. Ideally, you'll want a resident (TSR - in memory) AV product. But I'd be hard pressed to recommend one. That's something only you can determine from research based on your own security standards. :)
    – somebody
    Jun 15, 2019 at 7:51
  • Why would the OS execute the boot block on a hot-plugged USB disk that hasn't been mounted? But a USB device that has been modified at hardware/firmware level for evil purposes might also emulate a USB keyboard and start blindly sending common shortcut keys for opening a terminal window, then commands after them. Anyway, if you suspect high-grade malware, don't scan infected disks with your primary computer; go to a flea market, get a cheap old computer you can easily afford to reinstall or even completely lose, and use that for scanning the disk.
    – telcoM
    Jun 15, 2019 at 8:01
  • The problem is that the USB stick is unusable if the stick cannot be plugged in. So what's the alternative? Throw it away? If the OP intends to ever use it again. The OP will want to guard against being "bitten" by anything that may be present on it. Hence my reply. Further reading of your reply strongly indicates yo don't understand how infinitely small the infections can be, or what they are capable of accomplishing. The affect can, when intended, take years to manifest, and are capable of a wide array destructive accomplishments.
    – somebody
    Jun 15, 2019 at 8:48
  • Thanks @telcoM really for the insights. I have read about a rootkit - #badBios one - that infected an unmounted media. That's why I'm so afraid of dealing with my external HDD. I tried to get that resource for you but couldn't find it now. Jun 18, 2019 at 18:00
  • somebody: I know the danger.. and I'm trying to find a solution. Jun 18, 2019 at 18:02

1 Answer 1


Disable all udev rules that will automatically execute something when you plug in any USB device. ("Desktop" environments in particular like to have automounters etc., but disable the rest for good measure).

Alternatively: Make a bootable USB stick with a read-only compressed file system with whatever you need to scan and clean the drive, disconnect your main harddisk from your computer, boot from the USB stick. As the system on the USB stick is compressed, it's impossible to remount it read-write, even if the rootkit should be devious enough to try.

But the probability of your USB drive being infected with a rootkit is really really low.

  • Thank you so much @dirkt for your input.. I'm searching and learning how to do it right now. However.. if you can guide me more please: We have here three different things: - External USB HDD has been connected, mounted, before.. on a possibly BIOS-Resident-rootkit-infected system: Will that make it infected? If not infected: Why? If infected: - Same External USB HDD now connected unmounted, on a clean system: Will it infect the new system's Media or BIOS? Much Thanks! Jun 18, 2019 at 18:12
  • That entirely depends on the BIOS-resident rootkit - if the system has been infect (i.e., BIOS flash ROM), and it sits deep enough and bypasses the OS, it can do whatever it wants, and nothing you do in the OS will prevent it from doing so. OTOH, if it's only the harddisk that contains the BIOS-rootkit, nothing will happen as long you don't execute any files from that harddisk. So connecting and mounting it is completely safe (assuming you don't have any automation that wants to execute files on it, like Windows does).
    – dirkt
    Jun 19, 2019 at 8:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .