Scanning external hard drive(s)

[HarbourDog]

Hi

Was looking at Malwarebytes for Mac for some home Macs, after experiencing McAfee's appalling customer service (having issues with McAfee detecting infection on an external drive, but not cleaning/quarantining) yet it seems that Malwarebytes cannot scan an external HD. Why not, what's the reasoning for that? I read an earlier forum where it was referred to as a 'feel good function'...seems like a basic, sensible function to me.

Secondly, can anyone recommend a product that does scan and clean an attached external HD?

Thanks. 

Edited February 24, 2018 by HarbourDog
Clarification

[pondus]

2 hours ago, HarbourDog said:

(having issues with McAfee detecting infection on an external drive, but not cleaning/quarantining)

There may be a good reason, somone may know why if you give more info on what McAfee say

 

 

Quote

yet it seems that Malwarebytes cannot scan an external HD

If you right click on the drive, is there no malwarebytes scan option?

 

[alvarnell]

9 hours ago, pondus said:

If you right click on the drive, is there no malwarebytes scan option?

I believe that may be a Malwarebytes for Windows option that has not yet been provided with Malwarebytes for Mac.

The majority of malware found using Malwarebytes for Mac must be installed where it ends up, so scanning an external drive probably would not find anything unless it was already installed in exactly the right place.

I've heard there may be plans for a future capability in this regard, but they don't comment on timing or availability of possible future features.

[treed]

Just to add a couple comments to this...

First, malware almost never gets onto a Mac from an external hard drive. That's simply not an issue in this day and age where everything malicious on Macs is designed to be downloaded and explicitly opened by the user. Especially since malware that might be on an external drive cannot get installed on a Mac, via any currently known method, by simply connecting the drive to the computer.

Second, one of the most common places that antivirus programs find malware, and that people want to scan for malware, is in backups. This is an absolutely horrible idea. It's never a good idea to start messing with your backups, and if you were to remove something from a Time Machine backup using third-party software - or even manually removed something using the Finder or the Terminal - that will wreck your backups. You might not even know it's wrecked until you need to restore something from it and can't. Time Machine backups are very sensitive.

So, although we'll probably support this at some point in the future, it's not a high priority and it'll probably only work within certain parameters to avoid damaging sensitive data.

[Gomer_Pylez]

On 2/26/2018 at 9:48 AM, treed said:

Just to add a couple comments to this...

First, malware almost never gets onto a Mac from an external hard drive. That's simply not an issue in this day and age where everything malicious on Macs is designed to be downloaded and explicitly opened by the user. Especially since malware that might be on an external drive cannot get installed on a Mac, via any currently known method, by simply connecting the drive to the computer.

Second, one of the most common places that antivirus programs find malware, and that people want to scan for malware, is in backups. This is an absolutely horrible idea. It's never a good idea to start messing with your backups, and if you were to remove something from a Time Machine backup using third-party software - or even manually removed something using the Finder or the Terminal - that will wreck your backups. You might not even know it's wrecked until you need to restore something from it and can't. Time Machine backups are very sensitive.

So, although we'll probably support this at some point in the future, it's not a high priority and it'll probably only work within certain parameters to avoid damaging sensitive data.

I understand your concern about backups.  Here's a scenario that I'm facing.  Assisting someone with a Mac that won't boot.  I've put it in target disk mode, and attached to my machine.  It appears as an external.  Taking a quick peek, I can already see MacKeeper, 'chumsearch.sh', MegaBackup, etc.  It's probably loaded with malware.  It'd be nice to be able to scan this drive and remove that malware while in target disk mode. 

[alvarnell]

As long as you run Malwarebytes as first order of business after, I assume, a Recovery OS install, there is very high probability that no additional damage will occur from what you are seeing. The items you listed are all either PUPs or low impact adware which should be easy enough to remove.

[treed]

On 4/18/2018 at 5:38 PM, Gomer_Pylez said:

I understand your concern about backups.  Here's a scenario that I'm facing.  Assisting someone with a Mac that won't boot.  I've put it in target disk mode, and attached to my machine.  It appears as an external.  Taking a quick peek, I can already see MacKeeper, 'chumsearch.sh', MegaBackup, etc.  It's probably loaded with malware.  It'd be nice to be able to scan this drive and remove that malware while in target disk mode. 

What you could do with that machine is boot it in safe mode, which will disable all that crap and prevent it from loading. Once it's running in safe mode, install Malwarebytes. Malwarebytes for Mac won't normally work in safe mode, but if you install while in safe mode, it'll work for that safe mode session.

Then scan the machine and remove anything detected.

[LLombardia]

I'm also looking for this capability; however, in my case it is because I'm an Engineer supporting the Graphics group of a television network, and an end-user I am supporting needs to be able to scan and clean external drives that are shared cross-platform. While Malware meant for Windows pose no threat to the Mac user, presuming the drive is safe to use and passing it along to a Windows user who also presumes it is safe is a recipe for trouble. Likewise, even though Mac Malware has to successfully install on the boot drive to be harmful, it would be useful to know if there are installers for threats, so that they can be dealt with before sharing these external drives with other end-users.

[alvarnell]

@LLombardia You really need a traditional malware scanner to accomplish what you need. Such scans will take an order of magnitude more time to accomplish because they must scan every single file and compare it against each of a million or more malware definitions in its database. I can't speak for Malwarebytes, but I don't see them moving in that direction. There are plenty of other cross-platform scanners out there to serve such purposes.

[Massimiliano]

Any advice on what to use, possibly free of charge, for occasional scans of external disks and / or internal disks (with full access to the disk, without any risks, if using Catalina) would be welcome. Thank you @alvarnell and if possible also by @treed.