Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Registry Question: Prevent AutoRun.inf on select devices


  • Please log in to reply
2 replies to this topic

#1 Mel_3

Mel_3

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:32 AM

Posted 14 July 2012 - 03:53 PM

I've looked at a couple of utilities that disable autorun.inf on usb devices...
But on one of the utilities the ntsf file system tool has been in beta and at version 1.0 for a very long time...

I want to find another way to do this and did more research and found 3 registry settings can be modified...

But one of them has conflicting explanations on two different tutorials... or I'm reading both of them wrong...

Here is the registry key in question:

HKEY_CURRENT_USER > Software > Microsoft > Windows > CurrentVersion > Policies > Explorer > "NoDriveTypeAutoRun"

Tutorial 1: http://autorun.moonvalley.com/enable.htm

Under Additional Technical Info (at the bottom of the page) explains:

The first byte defines which drive types to EXCLUDE from Autorun behavior.
The hex value of the byte is the sum of all of the drive type values to exclude + 128.

DRIVE_UNKNOWN 1
DRIVE_NO_ROOT_DIR 2
DRIVE_REMOVABLE 4 (floppy disks and removable cartridges)
DRIVE_FIXED 8 (hard disks)
DRIVE_REMOTE 16 (network drives)
DRIVE_CDROM 32 (CD-ROMs)
DRIVE_RAMDISK 64

so Hex 95 would exclude (disable?) autorun on the devices on bits 1, 4, and 16
(Drive_Unknown, Drive_Removable, and Drive_Remote)

(The calculation for this value is 1 + 4 + 16 + 128 = 149. 149 Decimal is 95 Hex)

BUT...

Tutorial 2: http://www.sevenforums.com/tutorials/161443-autorun-inf-files-completely-block.html
ask you to change three registry settings: (or run the following as a .reg file to modify the settings)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoAutorun"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoAutorun"=-

And the second one sets the byte in question to 00000001
Which seems to me to enable autorun on all devices except Drive Unknown.

My specific question is: Will setting a bit to "1" prevent the device from running autorun.inf...
Or... must you set the bit to "0" to prevent the device from running autorun.ing?

Thanks for any help.

I'm really trying to understand what is going on here.

BC AdBot (Login to Remove)

 


#2 Mel_3

Mel_3
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:06:32 AM

Posted 14 July 2012 - 06:31 PM

For others interested in this topic I found this on Microsoft Windows Support at...

http://support.microsoft.com/kb/967715

Almost half-way down the article under...

How to selectively disable specific Autorun features

they explain the device bit assignments and it appears that setting the bit=1 for a device turns off autorun for that device...

And setting the registry key = 0xFF hex turns off autorun for all devices it seems...

But interested parties should read the article and maybe consider using gpedit.msc as instructed in the article... if you have it on your system... else you can directly change the register as they explain in the article... if you know what you are doing...

#3 AustrAlien

AustrAlien

    Inquisitor


  • BC Advisor
  • 6,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Cowra NSW Australia
  • Local time:09:32 PM

Posted 15 July 2012 - 01:46 AM

I'm really trying to understand what is going on here.

It's a worthy challenge.

I just spotted this topic ... and knew instantly that it had my name on it ... but you beat me to it!

Thanks for posting your question and your solution as well!
AustrAlien
Google is my friend. Make Google your friend too.

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users