Did a short test with MSE and the Eicar file (in this case the usual .com; not in text, not within an archive(s) (ZIP) etc.). If nothing else we know one thing; MSE should and does detect the Eicar file, thus it can give some guidance how MSE works with USB disks.
(The test PC has autorun etc. disabled; but I doubt very much that that has any influence on what is going on in this test, since it's only a single COM file.)
I plugged in a USB memory that only contained one file, the eicar.com, and I got no response from MSE. The same was the case when I opened Explorer, a right-click on the USB drive and look at Properties did nothing. The same for when I double-clicked on the drive and had a look at the root with the eicar.com file.
But:
When I hovered with the mouse pointer above the file (i.e. more directly "on access") MSE kicked in.
Or, if I was quick enough, when I right-clicked on the file and selected Properties MSE sprang to life.
2011-01-12B.png
It said that it had temporarily inactivated the object, and asked what to do (I've disabled the default actions), more info. and the usual.
What I meant with my post above, was that some Anti-Virus software are a bit more "aggressive"; they do some sort of quick scans as soon as you connect external devices (and those scans are often optional, via settings, see, one example, below). Then it's a different matter if those "quick scans" are as good and thorough as an on demand scan, I don't know, there are lots AVs.
When I mentioned AVG as one potential solution, as it has the possibility to do offline updates (via a folder, USB etc.), and also has a separate option for "Removable device scan"
1 I also wanted to mention to Stuart what my experience had been in a similar case; i.e. that somehow, given the post above, it didn't catch the virus during "attach scan".
There is, as I see it at moment, nothing wrong at all with MSE real time protection. It complains if you try to save a file with a virus (or, for example the test file) during download; it works as expected when you try to access the test file, and that is the important things when discussing real-time protection, you can't do anything with the file. It usually doesn't matter if it didn't warn when you connected the drive.
Then we have the cases with autoruns; I can't test it at moment; but I'm pretty sure that MSE will catch them (if it recognises them), but then as mentioned above, it could be a very good idea to disable autoruns.
1. From the AVG Anti-Virus Free Edition 2011 manual; I think the setting has been there from ver. 8.5, it's not there in my old 8.0 manual:
The Removable device scan is launched automatically once you attach any removable device to your computer. By default, this scanning is switched off. However, it is crucial to scan removable devices for potential threats since these are a major source of infection. To have this scanning ready and launched automatically when needed, mark the Enable Removable device scan option.
You do not have the required permissions to view the files attached to this post.
Byelingual When you speak two languages but start losing vocabulary in both of them.
virus scanner (this is not my computer, just in my house), that is suitable for this purpose.
Yes, at the time I hadn't installed the autoplay/autorun updates that gives the possibility to tweak the autorun modes. On the other hand, holding the Shift key has been my MO for more than 15 years.