Maybe the Windows partition is getting automounted. If so, there's nothing to fear. And if you installed Ventoy yourself, there's even less to fear.
However, if you suspect something untoward is going on, run a virus scan. Use Defender on Windows, and ClamAV on Linux.
ClamAV is unintuitive, so I wrote a helper script called Mussel. Read it, copy-paste it, put it in your PATH.
Mussel script
#!/bin/bash
getpath1() {
echo $PATH'/*' | sed 's/:/\/\* /g'
# print the path, with a /* on the end;
# then substitute every : with a /*[space]
}
getpath2() {
echo $PATH | sed 's/:/ /g'
# print the path only;
# then substitute every : with a [space]
}
scanselect() {
echo "How do you want to scan?
Select from 'path-scan', 'home-scan', 'full-scan', 'total-scan', or 'custom-scan'"
}
path-scan() {
sudo clamscan --bell -r --move=/.quarantine `getpath2`
}
home-scan() {
sudo clamscan --bell -r --move=/.quarantine /home/`whoami`
}
full-scan() {
sudo clamscan --bell -r --move=/.quarantine --exclude-dir='/dev' --exclude-dir='/sys' --exclude-dir='/proc' --exclude-dir='/.quarantine' --exclude-dir='/.snapshots' /
}
total-scan() {
sudo clamscan --bell -r --move=/.quarantine /
}
custom-scan() {
TARGET='unknown'
printf "Select target files or directories to scan: "
read TARGET
if [ -d $TARGET ]; then
sudo clamscan --bell -r --move=/.quarantine $TARGET
else
sudo clamscan --bell --move=/.quarantine $TARGET
fi
}
qview() {
echo 'These are the files in quarantine:'
#sudo ls -hal /.quarantine
#echo `sudo ls /.quarantine | wc -w`" entries in quarantine."
sudo tree /.quarantine
}
qempty() {
ANSWER='unknown'
qview
echo "Do you want to delete them all? (y/N)"
read ANSWER
if [ $ANSWER = 'y' ]; then
sudo rm -rf /.quarantine
echo 'All quarantine files deleted.
Returning to mussel interface.'
sudo mkdir /.quarantine
else
echo "Returning to mussel interface."
fi
}
show-help() {
echo "List of commands:
scan: Does not scan anything, just prints a list of commands for scanning.
path-scan: Scans all files in the path. ($PATH)
home-scan: Scans all files in your home directory. (/home/`whoami`)
full-scan: Scans all files on the system (/), except for virtual filesystems and quarantine
total-scan: Scans /all/ files on the system (/), nothing is excluded
custom-scan: Scan a specific file or directory
update: Update the threat database
quarantine-view: List files in quarantine
qview: Same as quarantine-view
quarantine-empty: Delete all files in quarantine
qempty: Same as quarantine-empty
help: Print this list
?: Same as help
exit: Exit Mussel, return to the shell"
}
if ! [ -e /.quarantine ]; then
sudo mkdir /.quarantine
echo "Quarantine directory did not exist, just created it now"
fi
COMMAND="unknown"
echo "This is Mussel, an interactive command-line frontend to ClamAV.
Type 'help' or '?' for a list of commands."
while (true); do
printf '] '
read COMMAND
if [ $COMMAND = 'scan' ] ; then
scanselect
elif [ $COMMAND = 'full-scan' ]; then
full-scan
elif [ $COMMAND = 'path-scan' ]; then
path-scan
elif [ $COMMAND = 'home-scan' ]; then
home-scan
elif [ $COMMAND = 'custom-scan' ]; then
custom-scan
elif [ $COMMAND = 'total-scan' ]; then
total-scan
elif [ $COMMAND = 'quarantine-view' ] || [ $COMMAND = 'qview' ]; then
qview
elif [ $COMMAND = 'quarantine-empty' ] || [ $COMMAND = 'qempty' ]; then
qempty
elif [ $COMMAND = 'update' ]; then
sudo freshclam
elif [ $COMMAND = 'help' ] || [ $COMMAND = '?' ]; then
show-help
elif [ $COMMAND = 'exit' ]; then
break
else
echo 'This command does not exist'
fi
done