I’ve never had any antivirus installed in my computer because I am confident that it won’t be infected by viruses as I am always very careful on the files downloaded from Internet. After so many years of using the computer, so far only 3 times my computer has been infected by virus and believe it or not, all 3 times are infected from USB flash drive. The virus that I encountered infects all executable files in my flash drive, then creates a hidden autorun.inf file at the roof of the pendrive.

In my opinion, the autorun.inf file that is placed at the root of drive is pretty useless and Microsoft shouldn’t have introduce this feature. It is intended as a convenience where an installer can automatically start when the disc is inserted. However, autorun can pose a security threat, when the user does not expect or intend to run the software, such as in the case of some viruses, which takes advantage of this feature to propagate. A feature in Windows has became a flaw…

Turning AutoPlay off is not a solution because when you open the drive from My Computer, Windows will still execute the instructions found in autorun.inf. Here is the solution to this problem to this Windows flaw.

There is a difference between AutoPlay and AutoRun. AutoPlay is when you insert a USB flash drive, you get a dialog box that ask you what do you want Windows to do.

Disable autorun.inf

As for AutoRun, it will run an executable file instructed by autorun.inf file. There’s no chance for you to Cancel autorun at all. Microsoft way of disabling autorun is editing the NoDriveTypeAutoRun value from registry. However, this is hard to do in practice. First, it’s a per-user key, which in a corporate environment is harder to manipulate reliably than a per-PC key. Secondly, there are several bugs known for it. And thirdly, a little-known registry key called MountPoints2 contains cached information about every memory stick or other removable device which your PC has ever seen, and that overrides the NoDriveTypeAutoRun value if you insert a volume which the PC already knows about.

Here is the registry key that you should use to globally block autorun.inf. Open notepad or any text editor, copy the text below and save it as NoAutoRun.reg. Make sure the extension is .reg and not .txt. Run it and click Yes if you’re asked “Are you sure you want to add the information in C:\NoAutoRun.reg to the registry?”

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

This hack tells Windows to treat AUTORUN.INF as if it were a configuration file from a pre-Windows 95 application. The next time you insert a flash drive, CD, DVD, or other removable disc into your system, Windows will not execute the information in any autorun.inf file that may be present. This is a great method to prevent Windows from being infected by virus through autorun.inf method without installing any security software. The only downside of this is that if you insert a CD or DVD with software on it, you have to explore it by hand to find the setup program which I think isn’t a big deal compared to being infected by virus and having to spend hours to scan and clean it.

Technorati Tags: , , , ,