Ridding of aw(ful|esome) volish feature...
Here is some tricks, that will prevent autorun.inf from doing (nasty|useful) things. You can use all of them to feel safer (I am not joking :) :
1. Per drive type registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun
To set permissions individualy for each one type of drive, just evaluate NoDriveAutoRun by adding numbers in table to 80 hex value (128 decimal). But I think, it is safer to forbid AutoCrap on all drives by setting NoDriveTypeAutoRun to
0xFF.
| Variable | Number | Hexadecimal
| Drive type(s) |
|---|
| DRIVE_UNKNOWN | 1 | 0x1 |
| DRIVE_NO_ROOT_DIR | 2 | 0x2 |
| DRIVE_REMOVABLE | 4 | 0x4 | Disk can be removed from drive, such as floppy disk, removable cartridge |
| DRIVE_FIXED | 8 | 0x8 | Disk cannot be removed from drive, such as hard disk |
| DRIVE_REMOTE | 16 | 0x10 | network drive |
| DRIVE_CDROM | 32 | 0x20 | CD-ROM drive |
| DRIVE_RAMDISK | 64 | 0x40 | RAM disk |
But *surprise* some viruses can re-enable autorun again (just for example: Win32.Worm.Autoit.E).
2. Per drive letter registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveAutoRun
Each bit of the value corresponds to drive letter (so 0xFFFFFFFF forbides autorun on all drives):
_____yzx wvutsrq ponmlkji hjfedcba
00000000 00000000 00000000 00000000
3. Restricting AutoRun by Group Policies:
Run gpedit.msc. Expand following nodes:
Computer Configuration\Administrative Templates\System\Turn autoplay off
Set "Turn autoplay off" to "Enabled" (by default it is "Not configured").
4. Restricting AutoRun by Software Restriction Policies:
Run gpedit.msc. Expand following nodes:
Computer Configuration\Windows Settings\Security Settings\Software Restriction Policies
Right-click on "Restriction Policies" and select "Create new Policies" Now you can add autorun.inf (to disable it execution everywhere) in ruleset "Path" or you can add E:\autorun.inf (for example), to disable it on that drive.
