Question about autorun/autoplay

Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

BleepingComputer.com > Security > AntiVirus, Firewall and Privacy Products and Protection Methods

Question about autorun/autoplay

Options

Scott00 View Member Profile	Nov 9 2009, 08:57 PM Post #1
New Member Group: Members Posts: 1 Joined: 9-November 09 Member No.: 400,692	Hello, I have noticed that after Combofix has been run, it disables the autorun/autoplay feature within Windows. After reading a number of posts on this forum, I have seen a few mods simply say "yup, it's been disabled...get used to it". Granted, they say it with more detail, but that is pretty much what they are saying. I would like to know the steps to re-enable the autorun/autoplay functionality. I understand that there is a risk associated with having autorun/autoplay enabled...but I can say without question that the spyware infection that I suffered from did in no way come from a CD/DVD or USB key. I do not use CDs/DVDs or USB keys from any outside source and am 100% confident that "if" I am infected with spyware/malware...it will not be from any sort of autorun/autoplay infected media. Knowing this...I would like instructions on how to enable the functionality that Combofix has removed. Thank you and I look forward to receiving the required steps associated with turning it back on. Scott

garmanma View Member Profile	Nov 9 2009, 09:44 PM Post #2
Computer Masochist Group: Staff Emeritus Posts: 27,809 Joined: 27-January 07 From: Cleveland, Ohio Member No.: 108,618	I assume you read this: http://www.bleepingcomputer.com/forums/topic268809.html How To Enable/Disable Autorun (Windows XP) Open Windows Explorer by pressing the Windows + "e" key Right-click the desired CD-ROM and select Properties from the menu. Select the AutoPlay tab. Select each item from the pulldown list and for the Action to perform, select "Take no action" to disable autorun, or pick the apporpriate action to take if enabling autorun. Select OK. -------------------- Mark why won't my laptop work? Having grandkids is God's way of giving you a 2nd chance because you were too busy working your butt off the 1st time around Do not send me PMs with problems that should be posted in the forums. Keep it in the forums, so everyone benefits Become a BleepingComputer fan: Facebook and Twitter

quietman7 View Member Profile	Nov 10 2009, 03:23 PM Post #3
Bleepin' Janitor Group: Global Moderator Posts: 19,404 Joined: 9-July 05 From: Virginia, USA Member No.: 26,513	Even if you were not infected via autorun this time, please be aware that: Keeping Autorun enabled on USB (pen, thumb, jump) and other removable drives has become a significant security risk due to the increasing number of malware variants that can infect them and transfer the infection to your computer. To learn more about this risk, please read: What security risks are associated with USB drives? USB-Based Malware Attacks Danger USB! Worm targets removable memory sticks. When is AUTORUN.INF really an AUTORUN.INF?. These types of infections usually involve malware that modifies and loads an autorun.inf (text-based configuration) file into the root folder of all drives (internal, external, removable) along with a malicious executable. When removable media such as a CD/DVD is inserted (mounted), autorun looks for autorun.inf and automatically executes the malicious file to run silently on your computer. For flash drives and other USB storage, autorun.ini uses the Windows Explorer's right-click context menu so that the standard "Open" or "Explore" command starts the file. Malware modifies the context menu (adds a new default command) and redirects to executing the malicious file if the "Open" command is used or double-clicking on the drive icon. When a flash drive becomes infected, the Trojan will infect a system when the removable media is inserted if autorun has not been disabled. ComboFix automatically disables autoruns the first time it is used. Since malware writers have begun to exploit the autorun/autoplay feature, the author of ComboFix, in an effort to help protect your computer from becoming infected via that avenue, configured ComboFix to disable it. Many security applications disable this feature as well and even Microsoft recommends doing the same. QUOTE ...Disabling Autorun functionality can help protect customers from attack vectors that involve the execution of arbitrary code by Autorun when inserting a CD-ROM device, USB device, network shares, or other media containing a file system with an Autorun.inf file... Microsoft Security Advisory (967940): Update for Windows Autorun Disabling autorun/autoplay does not prevent you from accessing your media sources. They are still available by opening My Computer and accessing the source drive (CD, DVD, USB or external hard drive). Pictures on a camera can still be accessed through My Pictures and selecting "Get Pictures" from a scanner or camera. Media can be accessed via the program you normally use it with such as music CDs via Media Player, blank CDs via burning software, image handling software provided with the camera. We strongly recommend you leave the autorun feature disabled and get into the habit of accessing your media devices manually. If you are insistent on enabling Autorun be aware that future versions of ComboFix will not run properly, IF NEEDED, after a fix has been applied. If you're sure you will never become infected again and never be asked to use ComboFix by someone who is assisting you with malware removal, then enabling it is your choice to make. -------------------- "THE BAD GUYS DON'T NEED A SEARCH WARRANT. ARE YOU PROTECTED?" Microsoft MVP - Windows Security 2007-2010 Member of UNITE, Unified Network of Instructors and Trusted Eliminators

« Next Oldest · AntiVirus, Firewall and Privacy Products and Protection Methods · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Lo-Fi Version

Time is now: 21st March 2010 - 07:14 AM

Advertise \| About Us \| Terms of Use \| Privacy Policy \| Contact Us \| Site Map \| Chat \| Tutorials \| Uninstall List
Discussion Forums \| The Computer Glossary \| Resources \| RSS Feeds \| Startups \| The File Database \| Virus Removal Guides