Broadband Tech > Security > Security > Disabling 'Autorun' on USB and beyond. Need help.

reply to OZO

Re: NoDriveTypeAutoRun and NoDriveAutoRun

[autorun]
open=kwjkpww.exe
shell\open\Command=kwjkpww.exe
shell\explore\Command=kwjkpww.exe
 

Unfortunately you did not mention what was the data set for the value "NoDriveTypeAutoRun" in your last test. And this is important to interpret the test results.

I've repeated the test similar to yours (actually the same I've done before my post here) and here are my results:

--- With "NoDriveTypeAutoRun"=dword:ff
1) notepad.exe is not launched automatically when I insert CD/DVD with autorun.inf (see its content below)
2) notepad.exe is launched when I made click on My Computer | E: which is completely unexpected
3) notepad.exe may be started by clicking on replaced "Open" menu item (user doesn't want that)
4) notepad.exe may be started by clicking on replaced "Explore" menu item (user doesn't want that)

Cases #2 - 4 must be fixed by the developer of the OS !

--- With "NoDriveTypeAutoRun"=dword:91 (default for WXP2)
1) notepad.exe is launched automatically when I insert CD/DVD with autorun.inf (see its content below) - as expected.
The rest of results are the same as above.

Here is content of autorun.inf file:

[autorun]
open="notepad.exe autorun.txt"
shell\open\Command="notepad.exe open.txt"
shell\explore\Command="notepad.exe explore.txt"
icon=notepad.exe
label=Test - Notepad
 

AutoRun

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]

Thanks

reply to OZO

There is no disagreement!

The behavior I've described is by design, so that the context menu can be customized by including Shell commands in the Autorun.inf file. I would not want that useful feature to be "discarded" as well. But, as you can see, I did emphasize the words "replaced" and did it for a purpose.

If a malware is able to replace two well known menu items that I've mentioned - user is in potential trouble. By clicking on those items user expects that drive will be opened/explored by WE. But, instead of that, what he may get is an unexpected execution of a program from removable media. Just simple like that. And that's dangerous.

That's why I said that the functionality must be fixed. There should be a protection from 'replacement' those well known menu items by autorun.inf file.
--
Keep it simple, it'll become complex by itself...

You're right - White List protection surely may help. As well as advice do not click on drive in My Computer, open to the drive in Windows Explorer instead. But not everyone runs a special program that supports a White List and not everyone remembers the rule - do not open a drive from My Computer, which may be a common practice (though personally I never do it, I respect others opinions who do it and why not). I'd call all of these - additional layers of protection.

My point here is if the basic layer is broken - it should be fixed first. And solution should be simple like marking one check box in Folder Options dialog box (see my picture below):

Folder Options - Autorun

reply to mysec
Sorry, can I back up a step? Tweak UI's NoDriveAutoRun seems to be as helpful as the "DoesNotExist" .reg file -- yet is does not require a reboot. Is that correct? Thanks.

Yes - as noted here on WinXP SP1.