I have a newbie Question about SD Cards

[camelia 6]

Hello,

When I scan an SD Card (Context Menu) only scans for folders and files is there an option in EIS "Settings" to scan its MBR, partition table or boot sectors?

When I scan selecting "In-depth scan" As Administrator I got a report like:

Scanned disks, folders and files: Operating memory;A:\Boot sectors/UEFI;C:\Boot sectors/UEFI;A:\;C:\

But NOT right clicking on the SD card only

Thanks

Came

Edited August 24, 2018 by camelia

[itman 1,538]

2 hours ago, camelia said:

is there an option in EIS "Settings" to scan its MBR, partition table or boot sectors?

To begin with, MBR and partition table are part of the boot sector.

Unless the drive is bootable which by default SD cards are not, I don't believe Eset will scan its boot sectors.

[stackz 94]

You could go into advanced settings and change the threatsense parameters for a context menu scan.

 

[Marcos 4,694]

It's in the real-time protection setup:

[itman 1,538]

Personally, I would just create a new scan profile. Name it "SD Card Scan." The select boot sectors in the scan options along with whatever other options you desire. Then save it.

This way, you're not "fooling around" changing existing Eset options for the default scanning methods.

[camelia 6]

Hello,

I'm confused, do I have to change both settings @stackz and @Marcos suggestion?

1 hour ago, itman said:

Personally, I would just create a new scan profile. Name it "SD Card Scan." The select boot sectors in the scan options along with whatever other options you desire. Then save it.

This way, you're not "fooling around" changing existing Eset options for the default scanning methods.

Yes it is a good idea, but I still don't know, how profiles works, I will start a new topic asking about profiles

Thanks

Came

[camelia 6]

Help!

Do I have to change change both settings @stackz and @Marcos suggestion in my EIS configuration?

Thanks

Camelia

Edited August 27, 2018 by camelia

[itman 1,538]

Time to get to the bottom of this!

It so happens that I have a SD card drive installed in my PC. So here's what I have discovered. To begin with, I have my autoplay setting for removable drives set to open with Win Explorer. So the following testing reflects the Eset behavior as such.

When the SD card is inserted into the card drive, Eset will display a popup as shown in the below screen shot. If you select the scan option from the popup, the drive boot sector will not be scanned. I believe Eset assumes that is unnecessary since the drive's directories are already opened by Win Explorer. What I did not test is if Eset would scan the boot sectors if your autoplay setting was set at the Win 10 default of "ask."

 

If you want to scan the boot sectors of the SD card, what you have do is the following. Note at this point, it probably is unnecessary to do so since if boot malware is present, you have already been nailed. That is unless Eset has already scanned the boot sectors of the SD card prior to allowing Win Explorer to access the drive? @Marcos, comments needed here:

1. Close the Eset popup.

2. Open the Eset GUI and navigate to "Computer Scan" section. Select "Advanced scans."

3. Select "Removable media scan" and the removable drive to be scan.

When the scan completes, the report will show that boot sectors have been scanned as shown in the below screen shot.

 

Personally, I don't believe boot malware is a threat unless the PC was actually booted from the removable drive media?

Edited August 27, 2018 by itman

[camelia 6]

Thank you very much! @itman that is what I was looking for!! ?

On 8/27/2018 at 5:47 PM, itman said:

Personally, I don't believe boot malware is a threat unless the PC was actually booted from the removable drive media?

I don't know either but who wants to have a boot malware in their removable media?

Camelia