Employee plugged in a USB stick they brought in, and I immediately started getting all sorts of warnings. Should I run a virus scan?

usb viruses are common, epecially on shared computers... run an antivirus scan then check the files via linux live usb. btw and ask the source — why did the subcontractor send a contaminated usb...

Looks like an Autorun.inf virus + Worm combo. Open CMD (Safe Mode), run these commands: tasklist | findstr /V (find executables), HKCU\Software\Microsoft\Windows\Run (check registry startup keys), check if any device started independently of the USB. If there's malware persistence, you need to clean the startup items. Mounting the USB via Live Linux USB (Ubuntu) to check files would be safer.

the subcontractors computer must be in terrible shape, there are a lot of viruses on the USB then but dont panic, the antivirus is good quality (an antivirus product is good) run a scan immediately. shutting down the computer doesnt mean the problem is over, the virus can remain in the registry. honestly do a full scan itll take 2-3 hours comfortably. but never plug this USB into another computer...

Mechanism of USB Media transfer viruses: 1) autorun.inf starts an exe file, 2) Persistence is set in the Registry (Run RunOnce), 3) File association is changed, 4) DNS redirection is performed. Phishing/spyware can also be added. Prevention: 1) Disable Autorun via GPO in gpo.msc (HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer\DisableAutoRun), 2) Set USB restriction (read-only), 3) Set up a USB white-list, 4) Prefer file transfer via email.

virus!!! this is really bad. tbh turn off the PC immediately, physiccally disable the USB port. run a strong antivirus, one product is good but not enough, install another one too then and look... if there's network code inside, the whole company network is at risk...

Let me summarize the topic, since several different answers were given. When making a decision, first look at what data you have on hand.

Most time waste accumulates in tasks waiting for approval.

Let me summarize the topic, since several different answers were given. An automated scan report is not the same as a penetration test.

Trying to do this alone is the most expensive way. If I were you, I'd go this route.

I have a question. Forgotten test environments are more often the entry point than live systems.

Yes that's exactly how it is with virus spread via usb. The harder it is to reverse a decision the slower you should make it.

The biggest time-waster for us was not knowing who had the final say. Good luck with that.

The most overlooked point about virus spread via usb is this: An automated scan report is not the same as a penetration test.

When we decide without measuring, we always end up in the same place. If you have questions, write them; I'll answer as best I can.

There's a common mistake people make when doing this. When you try to change everything at once, nothing settles.

That's all, sorry if I went on too long.

You're right, I've been down that road too. Trying to do this alone is the most expensive way.

If it's your first time, start small; scaling comes later.

My question might sound amateurish, sorry about that. Mistakes made on the virus spread via usb side are usually reversible but expensive.

This is my opinion, I'm not claiming it's absolute truth.

Let me speak from the other side; I'm on the supplier side... Your time to detect an issue directly determines its cost.

Good luck with that.

I'll try it. Just because everyone does it doesn't mean it's right.

If you have questions, write them; I'll answer as best I can.

Thanks a lot Ill try it today. Payment information changes are never verified through the channel they came from.

Good luck with that.

You're right. An untested backup is not a backup.

An automated scan report is not the same as a penetration test.