Stop AutoRun (Part 1)

The most common vector for virus infection thru USB flash drives exploits the AutoRun feature of Windows. Find out how to turn off this feature and hopefully provide you another level of protection.

AutoRun, Be-gone!

Windows came with the feature called AutoRun, or AutoPlay, that allows the computer to launch a program once you insert a CD or USB flash drive into your system. This is handy feature is what makes your CD launch the installer or your DVDs to launch the correct player. But this feature poses significant risks. For more information, see the article, USB Virus Get Sneaky.

Once you insert your CD or USB flash drive, Windows searches for the autorun.inf file in the root directory. If found, Windows executes the contents of the file. With Windows XP and Vista, the default action to take when the autorun.inf file is not found is to prompt the user on what to do based on the contents of the new media. Otherwise, the indicated program in the autorun file is executed. Convenient it may be, unfortunately, a virus may use this as a technique to infect your system. All it takes is a USB flash drive with an autorun and an executable program its root folder.

Folder and Directory means essentially the same - a way to organize files. Root directory means the top-most level of a drive, usually denoted by a backslash (\). Root directories usually contain boot information and other files that are usually marked important or highly accessed.

In Windows XP, you can change the defaults for AutoPlay by right-clicking the drive in Windows Explorer, and selecting Properties. Under the AutoPlay tab, you can control what Windows does for each type of media. Changing the settings here have no effect in preventing autorun.inf from being executed.

Although the Registry keys, NoDriveAutoRun and NoDriveTypeAutoRun, can turn off the feature, this can be overridden. A registry entry, MountPoints2 (see Removing Common USB Viruses), contained cached information to launch the program. This cache is obtained when the user first inserted the media, including, but not limited to hard drives, USB flash drives and optical media.

For steps on how to stop AutoRun, click here.

Stop AutoRun (Part 2)

The most common vector for virus infection thru USB flash drives exploits the AutoRun feature of Windows. Find out how to turn off this feature and hopefully provide you another level of protection. Read the Introduction here.

AutoRun, Be-gone! (Continued)

Solution? Globally block the autorun.infs from executing. Keep in mind, though, that this will block all friendly and hostile autorun.infs - nothing will happen when you insert a USB flash drive or CD and DVDs - but that's what we want. We don't want a rogue virus to execute when we insert a removable media. Of course, your installation CDs might not launch the setup program automatically. You have to manually open the program in Windows Explorer - a minor drawback.

To block autorun.infs from executing, follow these steps

1. Start Notepad or another text editor (don't use Microsoft Word or Wordpad)


2. Copy the following text from this page and paste it into your text editor (everything between the square brackets should be all on one line)
   
   REGEDIT4[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]@="@SYS:DoesNotExist"
   
   


3. Save the file with a name like NoAutoRun.reg, taking care to include the .reg extension


4. Right-click your .reg file and choose Merge. Confirm any warning prompts to add the information to the Registry.

What we did is to nullify the file that Windows searches when you insert a removable drive. Windows was instructed to find the autorun information inside the name autorun.inf. Here, we changed that to nothing, so Windows will attempt to search for the file with no filename (which is impossible since no file has no filename).

The benefit is a big one: a rogue program that you never intended to launch won't silently take over your system if you happen to insert a Trojan-carrying disc into a drive.