Topic: Windows AutoRun gets a makeover to combat malware

[georgecloner]

In direct response to Conficker and an increased wave of malware attacks targeting the dangerous Windows AutoRun mechanism, Microsoft today announced significant changes to the way the operating system operates when USB drives are used.

The changes, detailed on Redmond’s Security Research & Defense blog, have been built into Windows 7 will be back-ported to Windows Vista and Windows XP in the near future.

Here’s a breakdown of the changes in Windows 7:

    * AutoPlay will no longer support the AutoRun functionality for non removable optical media. In other words, AutoPlay will still work for CD/DVDs but it will no longer work for USB drives. For example, if an infected USB drive is inserted on a machine then the AutoRun task will not be displayed. This will block the increasing social engineer threat highlighted in the SIR. The dialogs below highlight the difference that users will see after this change. Before the change, the malware is leveraging AutoRun to confuse the user. After the change, AutoRun will no longer work, so the AutoPlay options are safe.

    * A dialog change was done to clarify that the program being executed is running from external media.

There are images on the SR&D blog explaining the changes:

http://blogs.technet.com/srd/archive/2009/04/28/autorun-changes-in-windows-7.aspx

{ZDNet}

[georgecloner]

will be back-ported to Windows Vista and Windows XP in the near future.

We hope we can get the update sooner! 

This will be an additional support breakthrough from MS, eliminating (atleast) virus infection via Window's autorun feature from external devices like the USB.

It is never too late! Thanks MS! 

[Samker]

I agree, this will improve PC Security.

Karma Up for MS... 

[haz]

OR you can totally turn-off the Auto-play feature in XP until a patch arrives, in the "run" type :
c:\windows\system32\gpedit.msc
In the left pane in the new window go to :
Computer Configuration - Administrative Templates - System   
Now in the right pane you will get a list of items, find the one called "Turn off Autoplay" , double click and set it to "Enable"
the difference here is that you will be able to shutdown the CD\DVD autoplay alone if you want but you have to select "All drives" for it to work on USBs too.
Thanks for the news

[Samker]

Haz, thanks for detailed explanation...

Karma Up for you also 

[jake2pointzero]

haz,

using the gpedit.msc is not enough, you need to run first the two security patch of Microsoft to take effect. These are the following:

1) kb950582    2)  kb967715

and also create a .reg file to add some registry entry. below is the sample:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"HonorAutorunSetting"=dword:00000001
"NoDriveAutoRun"=dword:03ffffff
"NoDriveTypeAutoRun"=dword:000000ff

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"HonorAutorunSetting"=dword:00000001
"NoDriveAutoRun"=dword:03ffffff
"NoDriveTypeAutoRun"=dword:000000ff

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun"=dword:00000001

I hope this will help.

jake

[sparksss]

good news.
thanksss