What features does Autorun provide?

Hello,

What features (beside automatic execution of autorun.inf) will I give up
when I disable autorun (WinXP)? It seems to be widely recommended that this
feature be disabled for security purposes. There also seems to be a lot of
conflicting information about exactly what autorun does and why it should be
disabled.

For instance, some sources say that autorun and autoplay are equivalent
while others say disabling the former will not affect the latter. Only one of
those two statements can be true. I understand (and agree) that disabling the
automatic execution of autorun.inf is desired. What about the popup menu that
lets me choose to view files with Windows Explorer? Will that be disabled as
well? I do not wish to lose that menu.

Any clarification would be most appreciated.

Cheers,
Fraser

 

Fraser wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hello,
>
> What features (beside automatic execution of autorun.inf) will I give up
> when I disable autorun (WinXP)? It seems to be widely recommended that this
> feature be disabled for security purposes. There also seems to be a lot of
> conflicting information about exactly what autorun does and why it should be
> disabled.
>
> For instance, some sources say that autorun and autoplay are equivalent
> while others say disabling the former will not affect the latter. Only one of
> those two statements can be true. I understand (and agree) that disabling the
> automatic execution of autorun.inf is desired. What about the popup menu that
> lets me choose to view files with Windows Explorer? Will that be disabled as
> well? I do not wish to lose that menu.
>
> Any clarification would be most appreciated.
>
> Cheers,
> Fraser<!--colorc--><!--/colorc-->

Autorun and auto-play are interchangeable terms. Those that use the
autorun term do so because the autorun.inf file is what Windows reads
when new removable media is detected (inserted).

What you lose by disabling auto-play is the automatic startup of
whatever program is specified within the autorun.inf file. You will
have to run the setup.exe, install.exe, or whatever program is used as
the auto-startup program as specified in the autorun.inf file. Most
times you just open Windows Explorer and you can see which file would be
the one that software expects to start automatically upon media
insertion. If you can't determine which file to run, right-click on the
autorun.inf file and see what it says should run.

What you gain is better security. You obviously don't let just anyone
shove a file onto your host when you web surf and then run it without
ever prompting you. Yet you will allow that from an CD/DVD or USB thumb
drive you insert? With auto-play, there is no intervening prompt to
pend the auto-startup program to ask you if you really want to run it.

While you can use various utilities or do registry editing to disable
auto-play, the TweakUI powertoy from Microsoft makes it easy. Just go
to the My Computer -> AutoPlay -> Types node in the tree list and
disable auto-play for both CD/DVD and removable devices.

The popup selection dialog you mention is when multiple handlers are
specified for the media type. You could have a CD/DVD burner program,
ISO utility, DVD movie player, and other programs associated with the
media type. It doesn't know which one you want to use so it asks you.
Yes, that will not appear if you disable auto-play because the removable
media is NOT getting interrogated (and why autorun.inf doesn't get
used).

 

AutoRun and AutoPlay, while related, are NOT the same function.
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> What features (beside automatic execution of autorun.inf) will I give up
> when I disable autorun (WinXP)?<!--colorc--><!--/colorc-->

For one, you will give up the convenience of a hijackware-infested USB key
(re)infecting your computer as soon as you plug it in (or a
hijackware-infested
attachment or compromised link infecting your computer as soon as you open
it).

Conficker Worm: Help Protect Windows from Conficker:


Steve Riley on Security : Autorun: good for you?:


Steve Riley on Security : More on Autorun:


Microsoft Malware Protection Center : Windows Addresses the Changing AutoRun
Threat Environment:


Microsoft Security Advisory (967940): Update for Windows Autorun:


How to disable the Autorun functionality in Windows (2K; XP; 2003):

--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002


Fraser wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> What features (beside automatic execution of autorun.inf) will I give up
> when I disable autorun (WinXP)? It seems to be widely recommended that
> this
> feature be disabled for security purposes. There also seems to be a lot of
> conflicting information about exactly what autorun does and why it should
> be
> disabled.
>
> For instance, some sources say that autorun and autoplay are equivalent
> while others say disabling the former will not affect the latter. Only one
> of those two statements can be true. I understand (and agree) that
> disabling the automatic execution of autorun.inf is desired. What about
> the
> popup menu that lets me choose to view files with Windows Explorer? Will
> that be disabled as well? I do not wish to lose that menu.
>
> Any clarification would be most appreciated.
>
> Cheers,
> Fraser<!--colorc--><!--/colorc-->

 

PA Bear [MS MVP] wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Microsoft Malware Protection Center : Windows Addresses the Changing AutoRun
> Threat Environment:
> <!--colorc--><!--/colorc-->

Geez, after how many years of knowing to disable autorun does it take
for Microsoft to finally catch up? Like they couldn't have proliferated
a high-visibility update to offer to users to disable it in prior
versions of Windows?

 

VanguardLH wrote:<!--coloro:blue--><span style="color:blue <!--/coloro--><!--coloro:green--><span style="color:green <!--/coloro-->
>> Microsoft Malware Protection Center : Windows Addresses the Changing
>> AutoRun Threat Environment:
>> <!--colorc--><!--/colorc-->
>
> Geez, after how many years of knowing to disable autorun does it take
> for Microsoft to finally catch up? Like they couldn't have proliferated
> a high-visibility update to offer to users to disable it in prior
> versions of Windows?<!--colorc--><!--/colorc-->

AutoRuns were disabled in Vista via a security update about a year ago.
Still, there's a considerable amount of resistance amongst the Great
Unwashed who do not want to be inconvenienced by having to Run something
manually.

 

Hello Robear,

Thank you for the helpful advice. I tried following the instructions in
KB967715 (which Belarc Advisor tells me is installed). The instructions for
my OS (XP-Pro) tell me to use the Group Policy Editor but I am unable to
locate the System (folder?) in Administrative Templates. That folder(?) has
only a Windows Components folder.

I found the NoDriveTypeAutoRun entry in the registry but I wasn't sure what
value to set it to. It is currently set to 91 (Hex) (145 decimal). I still
want to be able to use a flashdrive as well as play CDs and DVDs. I don't
mind (in fact I prefer) clicking on an option to tell it to run but I am not
certain if I will lose that functionality by changing that registry entry.

Thanks again for your help.

Fraser


"PA Bear [MS MVP]" wrote:
<!--coloro:blue--><span style="color:blue <!--/coloro-->
> AutoRun and AutoPlay, while related, are NOT the same function.
> <!--coloro:green--><span style="color:green <!--/coloro-->
> > What features (beside automatic execution of autorun.inf) will I give up
> > when I disable autorun (WinXP)?<!--colorc--><!--/colorc-->
>
> For one, you will give up the convenience of a hijackware-infested USB key
> (re)infecting your computer as soon as you plug it in (or a
> hijackware-infested
> attachment or compromised link infecting your computer as soon as you open
> it).
>
> Conficker Worm: Help Protect Windows from Conficker:
>
>
> Steve Riley on Security : Autorun: good for you?:
>
>
> Steve Riley on Security : More on Autorun:
>
>
> Microsoft Malware Protection Center : Windows Addresses the Changing AutoRun
> Threat Environment:
>
>
> Microsoft Security Advisory (967940): Update for Windows Autorun:
>
>
> How to disable the Autorun functionality in Windows (2K; XP; 2003):
>
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Client - since 2002
>
>
> Fraser wrote:<!--coloro:green--><span style="color:green <!--/coloro-->
> > What features (beside automatic execution of autorun.inf) will I give up
> > when I disable autorun (WinXP)? It seems to be widely recommended that
> > this
> > feature be disabled for security purposes. There also seems to be a lot of
> > conflicting information about exactly what autorun does and why it should
> > be
> > disabled.
> >
> > For instance, some sources say that autorun and autoplay are equivalent
> > while others say disabling the former will not affect the latter. Only one
> > of those two statements can be true. I understand (and agree) that
> > disabling the automatic execution of autorun.inf is desired. What about
> > the
> > popup menu that lets me choose to view files with Windows Explorer? Will
> > that be disabled as well? I do not wish to lose that menu.
> >
> > Any clarification would be most appreciated.
> >
> > Cheers,
> > Fraser<!--colorc--><!--/colorc-->
>
> <!--colorc--><!--/colorc-->

 

1. Start | Run | (type or copy/paste) GPEDIT.MSC | [OK]

2. Double-click on 'Computer Configuration' | Double-click on
'Administrative Templates' | Click 'System' | In the 'Settings' pane,
right-click 'Turn off Autoplay', and then click 'Properties' | Click
'Enabled' | Select 'All drives' in the 'Turn off Autoplay' box to disable
Autorun on all drives | OK your way out & reboot.

If no joy, follow the 6-step instructions immediately under the 'How to
disable all Autorun features in Windows XP Home Edition and other operating
systems' section of
--
~PA Bear


Fraser wrote:<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hello Robear,
>
> Thank you for the helpful advice. I tried following the instructions in
> KB967715 (which Belarc Advisor tells me is installed). The instructions
> for
> my OS (XP-Pro) tell me to use the Group Policy Editor but I am unable to
> locate the System (folder?) in Administrative Templates. That folder(?)
> has
> only a Windows Components folder.
>
> I found the NoDriveTypeAutoRun entry in the registry but I wasn't sure
> what
> value to set it to. It is currently set to 91 (Hex) (145 decimal). I still
> want to be able to use a flashdrive as well as play CDs and DVDs. I don't
> mind (in fact I prefer) clicking on an option to tell it to run but I am
> not
> certain if I will lose that functionality by changing that registry entry.
>
> Thanks again for your help.
>
> Fraser
>
>
> "PA Bear [MS MVP]" wrote:
><!--coloro:green--><span style="color:green <!--/coloro-->
>> AutoRun and AutoPlay, while related, are NOT the same function.
>><!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> What features (beside automatic execution of autorun.inf) will I give up
>>> when I disable autorun (WinXP)?<!--colorc--><!--/colorc-->
>>
>> For one, you will give up the convenience of a hijackware-infested USB
>> key
>> (re)infecting your computer as soon as you plug it in (or a
>> hijackware-infested
>> attachment or compromised link infecting your computer as soon as you
>> open
>> it).
>>
>> Conficker Worm: Help Protect Windows from Conficker:
>>
>>
>> Steve Riley on Security : Autorun: good for you?:
>>
>>
>> Steve Riley on Security : More on Autorun:
>>
>>
>> Microsoft Malware Protection Center : Windows Addresses the Changing
>> AutoRun Threat Environment:
>>
>>
>> Microsoft Security Advisory (967940): Update for Windows Autorun:
>>
>>
>> How to disable the Autorun functionality in Windows (2K; XP; 2003):
>>
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Client - since 2002
>>
>>
>> Fraser wrote:<!--coloro:darkred--><span style="color:darkred <!--/coloro-->
>>> What features (beside automatic execution of autorun.inf) will I give up
>>> when I disable autorun (WinXP)? It seems to be widely recommended that
>>> this
>>> feature be disabled for security purposes. There also seems to be a lot
>>> of
>>> conflicting information about exactly what autorun does and why it
>>> should
>>> be
>>> disabled.
>>>
>>> For instance, some sources say that autorun and autoplay are equivalent
>>> while others say disabling the former will not affect the latter. Only
>>> one
>>> of those two statements can be true. I understand (and agree) that
>>> disabling the automatic execution of autorun.inf is desired. What about
>>> the
>>> popup menu that lets me choose to view files with Windows Explorer? Will
>>> that be disabled as well? I do not wish to lose that menu.
>>>
>>> Any clarification would be most appreciated.
>>>
>>> Cheers,
>>> Fraser <!--colorc--><!--/colorc--><!--colorc--><!--/colorc--><!--colorc--><!--/colorc-->