Is autorun really that evil, and if so, how do I turn autorun off?

Home » Viruses and Malware » Malware Prevention
Home » Windows » Windows Configuration

Summary: Autorun is an increasingly used attack vector for malware. Common techniques to turn it off are incomplete. I'll show you how to turn it off, and recommend you do so.

There's been a rash of infections in recent months that can be traced back to infected USB or other removable devices being used to transmit malware from one machine to another. The culprit is autorun. Even if you think you have it turned off, I'm betting you don't have it turned off - not completely anyway.

Autorun (or autoplay, as it's sometimes known as or confused with), is a very convenient feature of Windows that, as its name implies, allows things to happen "automatically" when you insert a removable device such as a CD-ROM, USB Memory stick or attach a device like a digital camera.

And yes, absolutely, it's evil, and should be turned off completely as soon as you possibly can do so.

The reason is very, very simple: autorun can be seriously abused by viruses and other forms of malware.

•

Michael Horowitz, who blogs at ComputerWorld recently posted a series of articles on how the technology behind autorun can be used to run malicious software on your machine, or perhaps even worse, even fool you into running malicious software on your machine. In short, there's no way to truly trust that autorun won't do something you don't want it to do.

Michael's series of articles go into a lot more depth than I will here, and if you're at all interested into the details of what turns out to be quite the mess, I strongly encourage you to read the series. If you don't believe that there's an issue here, or if you believe you're safe ... I encourage you to read the articles. You may think differently when you're done.

The solution is to turn autorun off. Completely. And that's what I'll focus on here.

The Problem

I do want to at least touch on the many ways that autorun can impact you. I'm using the term autorun, but both the terms autorun and autoplay actually refer to a several different features that can be used for either good - or evil.

• Automatic Playing: as the name implies, autorun can be used to automatically launch software, either already on your machine or on the removable media. This is good when it's the CD player software installed on your machine automatically playing the CD you just inserted, and it's bad when it's a virus that installs itself automatically.

• Presenting Choices: instead of automatically doing something I'm sure you've all seen the list of "what would you like to do" options when you insert a camera or USB device into your PC. Autorun allows that device to control at least some of what those options are. This is good when the options make sense, and bad when the options added are crafted in such a way as to fool you into running malware that's on the device.

• Describing The Drive: after you've inserted a removable device it often shows up in Windows Explorer with a descriptive name, with or without the drive letter, like "Fancy Software Installation Media (J:)". That can come from autorun information contained on the device. This is good if it's accurate, and bad if it's misleading and might cause you to think that the media is something other than it is.

• Defining Double Click or "Open" actions: after inserting the device, even if you then see nothing automatically come up because you've disabled it in other ways, the autorun information on the device can define what happens if you double-click or "open" the drive. By now you can guess: that's great if what it does is something useful and appropriate, but it's bad if its instructions are to install malware on your machine.

As you can see any of the above are dangerous, and all of the above used in combination make autorun a ticking time bomb.

The Solution

The good news is that autorun has a single, and obvious, fuse: a file called "autorun.inf" that resides in the root of the removable device. All we need do to defuse this time bomb is to somehow cause that file to be ignored.

Here's the black magic:

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist" 

(Those are three lines of text. Everything between "[HKEY_LOCAL_MACHINE ..." and "... Autorun.inf]" is on one line.)

And yes, this is some incredibly black magic that actually makes use of a Windows 95 compatibility trick to fool Windows (XP and Vista both) into completely ignoring the autorun.inf file on any inserted device. Period.

Problem solved.

Copy those three lines exactly to a text file, and save it as "autorunoff.reg" (make certain that the ".reg" part is exactly correct). Double click on the resulting file and the setting will be imported into your registry. You should get a couple of warnings from regedit as you do so. (And yes, for completeness sake, you should probably backup the registry beforehand, even though this is a very simple addition of a single registry item.)

Alternately, you can download it here: autorunoff.reg. Download (typically right-click and "Save-As") the .reg file and run it, assuming your security software does not interfere.

The Cost

Unfortunately, the solution does come with a bit of a cost.

Let's face it, when not used for evil autorun is kinda handy. That convenience goes away.

In the name of safety...

• ... programs will not get run automatically when you insert removable media. You'll need to manually open files or run programs appropriate to whatever it is you're doing.

• ... if choices of what to do are presented, they'll be generic to your system and the software already installed. They will not include any choices that would otherwise be custom to the device being inserted.

• ... the device will be described by only its disk label, if it has one, or its drive letter.

• ... double clicking the device will simply open up Windows Explorer on the device contents.

In my opinion, it's a very, very small price to pay. This way you know that you'll not get a virus from any removable devices you - or anyone else - happen to insert into your machine.

Related:

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:

Why Subscribe?

• Test your defenses against malicious USB flash drives The first of Michael Horowitz's articles, showing you how to test for the various autorun vulnerabilities.

• I found a USB thumbdrive, plugged it in and now my system won't work. What happened? USB Thumbdrives or flash drives are a non-obvious but easy way to spread malware. You should be quite careful when dealing with an unknown device.

• How do I *really* disable auto-play in Windows XP? Auto-play can be a convenient feature but if it's not what you want it can be difficult to turn off and keep off. The TweakUI utility can fix that. (Important: Does not address all the vulnerabilities mentioned above.)

• What's a Volume Name? A volume name is a descriptive name that you assign to disk. Some utilities require that you enter it before they'll do something risky or destructive.

Article C3649 - February 13, 2009