USB Malware Scanner

A Python-based security tool that automatically scans USB drives for malicious content when connected to your computer.

---

Project Structure

usb-malware-scanner/
│
├── .github/
│   └── workflows/
│       └── scan.yml            # GitHub Actions CI workflow
│
├── usb_scanner.py              # Main scanner script
├── requirements.txt            # Python dependencies
├── .gitignore                  # Python + secrets ignore rules
├── LICENSE                     # MIT License — Amro Hussein
├── CONTRIBUTING.md             # Contribution guidelines
├── CHANGELOG.md                # Version history
└── README.md                   # Project documentation

---

Features

• 🔍 Autorun Detection — Flags autorun.inf files used in classic USB attacks
• ⚠️ Suspicious File Types — Detects .exe, .bat, .vbs, .ps1, .dll, .lnk and more
• 👁️ Hidden Files — Finds files with hidden attributes or dot-prefixed names
• 📦 Oversized Files — Flags files exceeding a configurable size limit
• 🧬 Malware Hash Check — SHA-256 hash matching against known malware signatures
• 🚫 Quarantine — Automatically moves threats to an isolated folder
• 📋 Logging — Full scan log saved to usb_scan.log
• 📄 JSON Report — Detailed scan report generated after every run

---

Requirements

• Python 3.10+
• No external dependencies for core scanning
• See requirements.txt for optional enhancements

---

Installation

git clone https://github.com/amro-hussein/usb-malware-scanner.git
cd usb-malware-scanner
pip install -r requirements.txt

---

Usage

# Auto-detect USB drive
python usb_scanner.py

# Specify USB path manually
python usb_scanner.py D:\              # Windows
python usb_scanner.py /media/user/USB  # Linux
python usb_scanner.py /Volumes/USB     # macOS

# Scan only — no quarantine
python usb_scanner.py D:\ --no-quarantine

# Custom max file size (MB)
python usb_scanner.py D:\ --max-size 50

---

Output

After each scan you'll find:

• Terminal — color-coded threat report
• usb_scan.log — full timestamped log
• usb_scan_report_<timestamp>.json — machine-readable report
• usb_quarantine/ — quarantined threat files

---

Adding Custom Malware Hashes

Open usb_scanner.py and add SHA-256 hashes to KNOWN_MALWARE_HASHES:

KNOWN_MALWARE_HASHES = {
    "your_sha256_hash_here": "Malware Name",
}

You can source hashes from MalwareBazaar or VirusTotal.

---

License

MIT License — © 2026 Amro Hussein