Jump to content

AutoRun: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
Carveone (talk | contribs)
169 edits
Update article, split off autorun.inf, address howto concerns. See Talk page.
Line 1: Line 1:
{{howto}}
'''AutoRun''' and the companion feature [[AutoPlay]] are components of the [[Microsoft Windows]] [[operating system]] that dictate what actions the system takes when a drive is [[Mount (computing)|mounted]].
'''AutoRun''' and the companion feature [[AutoPlay]] are components of the [[Microsoft Windows]] [[operating system]] that dictate what actions the system takes when a drive is [[Mount (computing)|mounted]].


Line 5: Line 4:


Until the introduction of [[Windows XP]], the terms AutoRun and AutoPlay were used interchangeably, developers often using the former term and end users the latter. This tendency is reflected in Windows Policy settings named AutoPlay that change Windows Registry entries named AutoRun, and in the autorun.inf file which causes "AutoPlay" to be added to drives’ [[context menu]]s. The terminology was of little importance until the arrival of Windows XP and its addition of a new feature to assist users in selecting appropriate actions when new media and devices were detected. This new feature was called ''AutoPlay'' and a differentiation between the two terms was created.<ref name=autoplaydiff>[http://windowshelp.microsoft.com/Windows/en-us/help/a19ac945-1007-4638-9615-e2c3bfd92b751033.mspx What's the difference between AutoPlay and AutoRun?], Microsoft, ''Windows Vista Help''</ref>
Until the introduction of [[Windows XP]], the terms AutoRun and AutoPlay were used interchangeably, developers often using the former term and end users the latter. This tendency is reflected in Windows Policy settings named AutoPlay that change Windows Registry entries named AutoRun, and in the autorun.inf file which causes "AutoPlay" to be added to drives’ [[context menu]]s. The terminology was of little importance until the arrival of Windows XP and its addition of a new feature to assist users in selecting appropriate actions when new media and devices were detected. This new feature was called ''AutoPlay'' and a differentiation between the two terms was created.<ref name=autoplaydiff>[http://windowshelp.microsoft.com/Windows/en-us/help/a19ac945-1007-4638-9615-e2c3bfd92b751033.mspx What's the difference between AutoPlay and AutoRun?], Microsoft, ''Windows Vista Help''</ref>


== AutoRun ==
== AutoRun ==


AutoRun, a feature of Windows Explorer (actually of the shell32 [[Dynamic Link Library|dll]]) introduced in Windows 95, enables media and devices to launch programs by use of commands listed in a file called <tt>autorun.inf</tt>, stored in the [[root directory]] of the medium.
AutoRun, a feature of Windows Explorer (actually of the shell32 [[Dynamic Link Library|dll]]) introduced in Windows 95, enables media and devices to launch programs by use of commands listed in a file called <tt>[[autorun.inf]]</tt>, stored in the [[root directory]] of the medium.


Primarily used on installation CD-ROMs, the applications called are usually application installers. The autorun.inf file can also specify an icon which will represent the device visually in Explorer along with other advanced features.<ref name=autoplaydiff/>
Primarily used on installation CD-ROMs, the applications called are usually application installers. The autorun.inf file can also specify an icon which will represent the device visually in Explorer along with other advanced features.<ref name=autoplaydiff/>


The terms AutoRun and AutoPlay tend to be interchangeably used when referring to the initiating action, the action that detects and starts reading from discovered [[volume (computing)|volume]]s. The [[AutoPlay#From detection to application|flowchart illustration]] in the AutoPlay article shows how AutoRun is positioned as a layer between AutoPlay and the Shell Hardware Detection service and may help in understanding the terminology. However, to avoid confusion, this article uses the term AutoRun when referring to the initiating action.
The terms AutoRun and AutoPlay tend to be interchangeably used when referring to the initiating action, the action that detects and starts reading from discovered [[volume (computing)|volume]]s. The [[AutoPlay#From detection to application|flowchart illustration]] in the AutoPlay article shows how AutoRun is positioned as a layer between AutoPlay and the Shell Hardware Detection service and may help in understanding the terminology. However, to avoid confusion, this article uses the term AutoRun when referring to the initiating action.



== AutoPlay ==
== AutoPlay ==
Line 22: Line 24:


Each hardware device can have a default action occurring on discovery of a particular media type, or the AutoPlay dialog can prompt the user what action to take.
Each hardware device can have a default action occurring on discovery of a particular media type, or the AutoPlay dialog can prompt the user what action to take.



== AutoRun activation ==
== AutoRun activation ==


The AutoRun sequence consists of the initial discovery of a new device or new piece of media. Following this, notification of interested parties occurs, of which the Windows Explorer shell is of primary interest.
The AutoRun sequence starts with the initial discovery of a new device or new piece of media. Following this, notification of interested parties occurs, of which the Windows Explorer shell is of primary interest. After checking certain [[Windows Registry|Registry]] settings to see if AutoRun can proceed, parsing of an optional autorun.inf may occur and any necessary actions are taken.


The initial sequence is handled much the same in every version of Windows from Windows 95. However, the way the autorun.inf file is read and acted upon and the level of integration of AutoRun with AutoPlay has changed significantly from the time AutoPlay was introduced in Windows XP until the present handling in [[Windows 7]].
After checking the [[Windows Registry|Registry]] settings to see if AutoRun can proceed, parsing of an optional [[#The autorun.inf file|autorun.inf]] occurs and any necessary actions are taken.

The initial sequence is handled much the same in every version of Windows from Windows 95. However, the way the autorun.inf file is read and acted upon and the level of integration of AutoRun with AutoPlay has changed significantly from the time AutoPlay was introduced in Windows XP until the present handling in [[Windows Vista]].


=== Initiation and notification ===
=== Initiation and notification ===
When a device with AutoRun-compatible drivers receives new media, a "Media Change Notification" event occurs. [[Windows]] then notifies interested applications that a device change has occurred. The notification method used can change depending on the device type.


When a device with AutoRun-compatible drivers receives new media, a "Media Change Notification" event occurs. The Windows [[operating system|OS]] then notifies interested applications that a device change has occurred. The notification method used can change depending on the device type.
If the device changed is a volume (like a CD) or a port (like a serial port) Windows broadcasts a <tt>WM_DEVICECHANGE</tt> notification to all top level windows.<ref>[http://support.microsoft.com/kb/q163503/ How to receive notification of CD-ROM insertion or removal], Microsoft, ''Knowledge Base''</ref><ref>[http://msdn.microsoft.com/en-us/library/aa363215(VS.85).aspx Detecting media insertion or removal], Microsoft, ''[[Microsoft Developer Network|MSDN]] Library''</ref> Windows terms this a "basic" notification. A top level window is one which is a descendant of the desktop.

If the device changed is a volume (like a CD) or a port (like a serial port) Windows broadcasts a <tt>WM_DEVICECHANGE</tt> notification to all top level windows.<ref>[http://support.microsoft.com/kb/q163503/ How to receive notification of CD-ROM insertion or removal], Microsoft, ''Knowledge Base''</ref><ref>[http://msdn.microsoft.com/en-us/library/aa363215(VS.85).aspx Detecting media insertion or removal], Microsoft, ''[[Microsoft Developer Network|MSDN]] Library''</ref> Windows calls this a "basic" notification. A top level window is one which is a descendant of the desktop.


However, if the device changed is not one of these types an application can use the <tt>RegisterDeviceNotification</tt><ref>[http://msdn.microsoft.com/en-us/library/aa363431(VS.85).aspx RegisterDeviceNotification function], Microsoft, ''MSDN Library''</ref> function to register to receive device notifications.
However, if the device changed is not one of these types an application can use the <tt>RegisterDeviceNotification</tt><ref>[http://msdn.microsoft.com/en-us/library/aa363431(VS.85).aspx RegisterDeviceNotification function], Microsoft, ''MSDN Library''</ref> function to register to receive device notifications.
Line 42: Line 44:
</blockquote>
</blockquote>


Non-volume devices are those devices that do not appear as drive letters in "My Computer". These are not handled by any part of AutoRun - any actions taken for these devices are taken either by device specific software or by AutoPlay. See [[AutoPlay#Devices that are not drives]].
When Explorer receives notification of a volume change, it performs a number of actions:<ref name=appcreate>[http://msdn.microsoft.com/en-us/library/cc144206(VS.85).aspx Creating an AutoRun-Enabled Application], Microsoft, ''MSDN Library''</ref><ref name=enadis>[http://msdn.microsoft.com/en-us/library/cc144204(VS.85).aspx Enabling and Disabling AutoRun], Microsoft, ''MSDN Library''</ref>

When Explorer receives notification of a ''volume'' change, it performs a number of actions:<ref name=appcreate>[http://msdn.microsoft.com/en-us/library/cc144206(VS.85).aspx Creating an AutoRun-Enabled Application], Microsoft, ''MSDN Library''</ref><ref name=enadis>[http://msdn.microsoft.com/en-us/library/cc144204(VS.85).aspx Enabling and Disabling AutoRun], Microsoft, ''MSDN Library''</ref>


<ol>
<ol>
<li> checks to see if AutoRun has been disabled through the Registry. If AutoRun is disabled for that drive or drive type, Explorer does not proceed further. However, there have been [[#The AutoRun disable bug|bugs]] in this area. </li>
<li> Checks to see if AutoRun has been disabled through the Registry. If AutoRun is disabled for that drive or drive type, Explorer does not proceed further. There have been [[#The AutoRun disable bug|bugs]] in this area. </li>


<li> checks that the root directory of the inserted media contains a file called autorun.inf and if so, reads and parses it. However, see [[#Inf handling|below]] for an exception. </li>
<li> Checks that the root directory of the inserted media contains an autorun.inf file, which might be read. See [[#Changing behaviour|below]]. </li>


<li> sends a <tt>QueryCancelAutoPlay</tt> message to the foreground window. An application which has registered its interest in receiving this message using <tt>RegisterWindowMessage</tt> can respond to this message to suppress AutoRun. The foreground application can also be notified by using the <tt>IQueryCancelAutoPlay</tt> [[Component Object Model|COM]] interface<ref>[http://msdn.microsoft.com/en-us/library/bb761373(VS.85).aspx IQueryCancelAutoPlay Interface], Microsoft, ''MSDN Library''</ref> available in Windows XP and later. </li>
<li> Sends a <tt>QueryCancelAutoPlay</tt> message to the foreground window. An application which has registered its interest in receiving this message using <tt>RegisterWindowMessage</tt> can respond to this message to halt AutoRun (and thus AutoPlay) at this point. Any application, foreground or not, can also be notified by using the <tt>IQueryCancelAutoPlay</tt> [[Component Object Model|COM]] interface<ref>[http://msdn.microsoft.com/en-us/library/bb761373(VS.85).aspx IQueryCancelAutoPlay Interface], Microsoft, ''MSDN Library''</ref> available in Windows XP and later. </li>


<li> Alters [[double-click]] and contextual menu behaviours. When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens is fully programmable by settings in the autorun.inf file. </li>
<li> Alters [[double-click]] and contextual menu behaviours. When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens is fully programmable by settings in the autorun.inf file. </li>
Line 55: Line 59:
<li> Adds an autorun.inf controllable icon and descriptive text to the drive icon. </li>
<li> Adds an autorun.inf controllable icon and descriptive text to the drive icon. </li>


<li> Checks to see if the {{keypress|[[Shift key|Shift]]}} key is held down. If it is then Windows Vista will invoke AutoPlay regardless of settings.<ref name=vista_ap_faq>[http://windowshelp.microsoft.com/Windows/en-us/help/7e1fe788-0747-4e00-895b-c3461b1ddd971033.mspx AutoPlay: frequently asked questions], Microsoft, ''Windows Vista Help''</ref> Previous versions of Windows will not continue with the process.<ref name=enadis/> </li>
<li> Checks to see if the {{keypress|[[Shift key|Shift]]}} key is held down. If it is then Windows Vista (and later Windows versions) will invoke the AutoPlay dialog regardless of settings to the contrary.<ref name=vista_ap_faq>[http://windowshelp.microsoft.com/Windows/en-us/help/7e1fe788-0747-4e00-895b-c3461b1ddd971033.mspx AutoPlay: frequently asked questions], Microsoft, ''Windows Vista Help''</ref> Previous versions of Windows will not continue with the process.<ref name=enadis/> </li>


<li> Finally, if shift is not held down, either:
<li> Finally, if this point has been reached, either:
* takes no further action.
* executes an application on instructions from the <code>open</code> or <code>shellexecute</code> keys optionally present in an autorun.inf's [[#%5bautorun%5d|&#91;autorun&#93;]] section.
* executes the "AutoRun task", the application optionally specified in the <code>open</code> or <code>shellexecute</code> keys in an autorun.inf's [[autorun.inf#%5bautorun%5d|&#91;autorun&#93;]] section.
* invokes AutoPlay.
* invokes AutoPlay.
Which choice is made depends on the version of Windows in use, instructions from the autorun.inf if available and the type of the media discovered. See the next section on inf handling for details. </li>
Which choice is made depends on the version of Windows in use, instructions from the autorun.inf if available and the type of the media discovered. </li>
</ol>
</ol>


=== Inf handling ===
=== Changing behaviour ===

{{seealso|autorun.inf#Inf handling}}

==== Before AutoPlay ====
==== Before AutoPlay ====


On Windows versions prior to Windows XP, an autorun.inf on any drive type will be parsed and instructions from <code>open</code> or <code>shellexecute</code> followed immediately and silently.<ref name=inftest>[http://support.microsoft.com/kb/136214 How to Test autorun.inf Files], Microsoft, ''Knowledge Base''</ref> This includes DRIVE_REMOVABLE, DRIVE_FIXED and DRIVE_REMOTE [[#Drive types|drive types]].
On Windows versions prior to Windows XP, an autorun.inf file on any drive type will be read and its instructions followed. The AutoRun task, if specified, is executed immediately without user interaction.<ref name=inftest>[http://support.microsoft.com/kb/136214 How to Test autorun.inf Files], Microsoft, ''Knowledge Base''</ref> This includes DRIVE_REMOVABLE, DRIVE_FIXED and DRIVE_REMOTE [[#Drive types|drive types]].


AutoRun will work with network drives (the DRIVE_REMOTE drive type) that are mapped to a drive letter. AutoRun will also work with floppy drives that are provided with autorun-compatible drivers.<ref name=enadis/>
AutoRun will work with network drives (the DRIVE_REMOTE drive type) that are mapped to a drive letter. AutoRun will also work with floppy drives that are provided with autorun-compatible drivers.<ref name=enadis/>


The default Registry settings on Windows versions previous to Windows XP (See [[#NoDriveTypeAutoRun|NoDriveTypeAutoRun]]), disable Remote and Removable drives from AutoRun initiation, leaving Fixed and CDROM drive types active by default.
The default Registry settings on Windows versions prior to Windows XP (See [[#NoDriveTypeAutoRun|NoDriveTypeAutoRun]]), disable Remote and Removable drives from AutoRun initiation, leaving Fixed and CDROM drive types active by default.


==== Introducing AutoPlay ====
==== Introducing AutoPlay ====


With the introduction of AutoPlay in Windows XP, the final stage action (stage 7 above) for some drive types changed from executing an application to invoking AutoPlay. In Windows Vista, the AutoPlay system is integrated into every aspect of media handling and there is no automatic execution of any autorun.inf <code>open</code> or <code>shellexecute</code> instructions.
With the introduction of AutoPlay in Windows XP, the final stage action (stage 7 above) for some drive types changed from executing an application to invoking AutoPlay. From Windows Vista, the AutoPlay system is integrated into every aspect of media handling and there is no automatic execution of the AutoRun task.


The default Registry settings added Removable drives to those that initiated AutoRun. From XP onwards, only Unknown and Network drive types are not active for AutoRun.
The default Registry settings add Removable drives to those that initiated AutoRun. In Windows XP and higher, ''except'' Windows Server 2003, only the Unknown and Remote drive types are not active for AutoRun.


The handling of the autorun.inf file changes very significantly between each Windows version. The details can be found in the [[autorun.inf#Inf handling|autorun.inf]] article. The current handling in Windows 7 is that ''only'' drives of type DRIVE_CDROM read and use the autorun.inf file.
Under Windows XP, autorun.inf support was removed for DRIVE_REMOVABLE drive types.<ref name=appcreate/> Any discovered removable media would be handled by invoking AutoPlay. Note that drives of type DRIVE_FIXED would parse and execute autorun.inf as before.<ref name=infentries>[http://msdn.microsoft.com/en-us/library/cc144200(VS.85).aspx Autorun.inf Entries], Microsoft, ''MSDN Library''</ref>

Windows XP Service Pack 2 reintroduced autorun.inf support for Removable drives<ref name=infentries/> but handled the <code>open</code> and <code>shellexecute</code> features as a display item within the AutoPlay dialog (See the <code>action</code> key in the [[#%5bautorun%5d|&#91;autorun&#93;]] section).

This handling also now applied to Fixed drive types, an important change in functionality from previous Windows versions.

For drives of type DRIVE_CDROM, Windows XP uses an autorun.inf if one is available, otherwise AutoPlay is invoked. In Windows Vista, a CD-ROM with an autorun.inf simply adds another option to the AutoPlay dialog list.


=== The AutoPlay safety net ===
=== The AutoPlay safety net ===


It would appear that AutoPlay, by transferring control of what were previously automatic and invisible actions to AutoPlay, acts to increase user control and safety. This applies especially under Windows Vista, where all media and devices fall under AutoPlay control.
It would appear that AutoPlay, by transferring control of what were previously automatic and invisible actions to AutoPlay, acts to increase user control and safety. This applies especially from Windows Vista, where all media and devices fall under AutoPlay control.


However it is important to note that:
However it is important to note that:


* a user can instruct AutoPlay to make the autorun.inf choice for them, indeed any choices for them, and bypass any AutoPlay dialog prompting.
* A user can instruct AutoPlay to make automatic choices on their behalf, including the execution of any AutoRun task.


* When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens next is fully programmable by the autorun.inf file and is essentially outside AutoPlay's purview. This is true under any Windows operating system.
* When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens next is fully programmable by the autorun.inf file and is essentially outside AutoPlay's purview. This is true under any Windows operating system.


* disabling AutoRun under Vista may force a user to double click the drive icon to get a contents list thus actually increasing the chance of malware infiltration.
* Disabling AutoRun may force a user to double click the drive icon to get a contents list thus actually increasing the chance of malware infiltration.



== Registry and Group Policy ==
== Registry and Group Policy ==
Line 108: Line 111:
The drive types are distinguished by Type Name as follows:<ref>[http://msdn.microsoft.com/en-us/library/aa364939.aspx GetDriveType Function], Microsoft, ''MSDN Library''</ref>
The drive types are distinguished by Type Name as follows:<ref>[http://msdn.microsoft.com/en-us/library/aa364939.aspx GetDriveType Function], Microsoft, ''MSDN Library''</ref>


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
! Type name !! Description
! Type name !! Description
Line 144: Line 147:


It may be necessary to either logout or restart the computer in order for any Registry changes to take effect.
It may be necessary to either logout or restart the computer in order for any Registry changes to take effect.

=== Evaluation order ===

The <tt>NoDriveAutoRun</tt> and <tt>NoDriveTypeAutoRun</tt> Registry entries can exist in two places, the per-user setting (under HKEY_CURRENT_USER) and the per-machine setting (under HKEY_LOCAL_MACHINE). If an entry appears under HKEY_LOCAL_MACHINE, then any corresponding entry under HKEY_CURRENT_USER is completely ignored. The data values are not merged in any way.

When deciding whether to activate AutoRun, both <tt>NoDriveAutoRun</tt> and <tt>NoDriveTypeAutoRun</tt> Registry entries are consulted. If either value indicates a drive should be disabled then AutoRun is disabled for that drive.

Thus in the following example:

{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
! colspan="2" | HKEY_LOCAL_MACHINE !! colspan="2" | HKEY_CURRENT_USER
|-
! NoDriveAutoRun !! NoDriveTypeAutoRun !! NoDriveAutoRun !! NoDriveTypeAutoRun
|-
| 0x08 || (Not Present) || 0x03FFFFFFF || 0x95
|}

the data value taken for <tt>NoDriveAutoRun</tt> is 0x08, disabling drive D and the data value taken for <tt>NoDriveTypeAutoRun</tt> is 0x95, disabling removable and network drives. The per-user <tt>NoDriveAutoRun</tt> entry is never used.


=== NoDriveTypeAutoRun ===
=== NoDriveTypeAutoRun ===


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
Line 159: Line 181:
|}
|}


This Registry entry disables or enables the AutoRun feature on all drives of the type specified.<ref name=reg_nodtar>[http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/91525.mspx Windows 2000 Registry: NoDriveTypeAutoRun], Microsoft, ''[[Microsoft TechNet|TechNet]]''</ref> It reflects the setting of the relevant Autoplay Group Policy. Valid data ranges from 0x00 to 0xFF in [[hexadecimal]] notation. If the entry is not present, the default data value is either 0x95 or 0x91 depending on the version of Windows used.
This Registry entry disables or enables the AutoRun feature on all drives of the type specified.<ref name=reg_nodtar>[http://technet.microsoft.com/en-us/library/cc959381.aspx Windows 2000 Registry: NoDriveTypeAutoRun], Microsoft, ''[[Microsoft TechNet|TechNet]]''</ref> It reflects the setting of the relevant Autoplay Group Policy. Valid data ranges from 0x00 to 0xFF in [[hexadecimal]] notation. If the entry is not present, the default data value is either 0x95 or 0x91 depending on the version of Windows used. An entry present in HKLM overrides any entry present in HKCU.


The entry data is a bitmapped value, where a bit set to 1 disables AutoRun on a particular type of drive. The bit settings for each type of drive are shown below:
The entry data is a bitmapped value, where a bit set to 1 disables AutoRun on a particular type of drive. The bit settings for each type of drive are shown below:


[[Image:NoDriveTypeAutoRun bit settings.gif|none|drive type bitwise settings]]
:[[Image:NoDriveTypeAutoRun bit settings.gif|none|drive type bitwise settings]]


Note that bit number 1 is unused and that the "Unknown" type is represented twice. Setting all bits to 1 would give a hexadecimal value of 0xFF, decimal 255, and would disable AutoRun on all types of drives.
Note that bit number 1 is unused and that the "Unknown" type is represented twice. Setting all bits to 1 would give a hexadecimal value of 0xFF, decimal 255, and would disable AutoRun on all types of drives.


The default setting for this entry depends on the version of Windows being used:<ref name=inftest/><ref name=kb895108>[http://support.microsoft.com/kb/895108 The NoDriveTypeAutoRun subkey value is reset...], Microsoft, ''Knowledge Base''</ref>
The default setting for this entry depends on the version of Windows being used:<ref name=inftest/><ref name=kb967715>[http://support.microsoft.com/kb/967715 How to disable the Autorun functionality in Windows], Microsoft, ''Knowledge Base''</ref>


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
! Operating system !! Default setting
|-
| Windows 7 || <center> 0x91 </center>
|-
|-
| Windows Server 2008 || <center> 0x91 </center>
! Operating system !! Default setting
|-
|-
| Microsoft Windows Vista || <center> 0x91 </center>
| Windows Vista || <center> 0x91 </center>
|-
|-
| Microsoft Windows Server 2003 || <center> 0x95 </center>
| Windows Server 2003 || <center> 0x95 </center>
|-
|-
| Microsoft Windows XP || <center> 0x91 </center>
| Windows XP || <center> 0x91 </center>
|-
|-
| Microsoft Windows 2000 || <center> 0x95 </center>
| Windows 2000 || <center> 0x95 </center>
|-
|-
| Microsoft Windows 95/98 || <center> 0x95 </center>
| Windows 95/98 || <center> 0x95 </center>
|}
|}

Windows versions before XP and Server 2003 use the value 0x95. This disables AutoRun on Unknown, Network and Removable drives.

Versions after Windows XP, except Windows Server 2003, use the value 0x91, which disables AutoRun on Unknown and Network drives. Removable drives are now enabled, reflecting the added AutoPlay feature in Windows XP.

AutoRun is, by default, enabled for CD and DVD, Fixed and RAM drives on all versions of Windows from Windows 95.

The Microsoft tool TweakUI for XP completely ignores these default values, thus, once used to change AutoRun settings, it enables AutoRun on Unknown and Network drives.


=== NoDriveAutoRun ===
=== NoDriveAutoRun ===


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
Line 206: Line 224:
|}
|}


This Registry entry disables or enables the AutoRun feature on individual drives.<ref name=reg_nodar>[http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/93506.mspx Windows 2000 Registry: NoDriveAutoRun], Microsoft, ''TechNet''</ref> It is not associated with a Group Policy and does not exist by default. The data value is taken to be 0 if the entry is not present.
This Registry entry disables or enables the AutoRun feature on individual drives.<ref name=reg_nodar>[http://technet.microsoft.com/en-us/library/cc959387.aspx Windows 2000 Registry: NoDriveAutoRun], Microsoft, ''TechNet''</ref> It is not associated with a Group Policy and does not exist by default. The data value is taken to be 0 if the entry is not present. An entry present in HKLM overrides any entry present in HKCU.


The data is a 32 bit (DWORD) bitmapped value, of which the lower 26 bits are used to represent each of the 26 drive letters from A to Z. Thus the valid data range is from 0x0 to 0x03FFFFFF. The least significant bit (the right most bit) represents drive A, and the 26th bit from the right represents drive Z.
The data is a 32 bit (DWORD) bitmapped value, of which the lower 26 bits are used to represent each of the 26 drive letters from A to Z. Thus the valid data range is from 0x0 to 0x03FFFFFFF. The least significant bit (the right most bit) represents drive A, and the 26th bit from the right represents drive Z.


A bit set to 1 disables AutoRun on a particular drive. For example, if the data value is set to 0x8 (1000 binary), AutoRun is disabled on drive D.
A bit set to 1 disables AutoRun on a particular drive. For example, if the data value is set to 0x8 (1000 binary), AutoRun is disabled on drive D.

=== Evaluation order ===

The <tt>NoDriveAutoRun</tt> and <tt>NoDriveTypeAutoRun</tt> Registry entries can exist in two places, the per-user setting (under HKEY_CURRENT_USER) and the per-machine setting (under HKEY_LOCAL_MACHINE). If an entry appears under HKEY_LOCAL_MACHINE, then any corresponding entry under HKEY_CURRENT_USER is completely ignored. The data values are not merged in any way.

When deciding whether to activate AutoRun, both <tt>NoDriveAutoRun</tt> and <tt>NoDriveTypeAutoRun</tt> Registry entries are consulted. If either value indicates a drive should be disabled then AutoRun is disabled for that drive.

Thus in the following example:

{| class="wikitable"
|-
! colspan="2" | HKEY_LOCAL_MACHINE !! colspan="2" | HKEY_CURRENT_USER
|-
! NoDriveAutoRun !! NoDriveTypeAutoRun !! NoDriveAutoRun !! NoDriveTypeAutoRun
|-
| 0x08 || (Not Present) || 0x03FFFFFF || 0x95
|}

the data value taken for <tt>NoDriveAutoRun</tt> is 0x08, disabling drive D and the data value taken for <tt>NoDriveTypeAutoRun</tt> is 0x95, disabling removable and network drives. The per-user <tt>NoDriveAutoRun</tt> entry is never used.


=== Group Policy ===
=== Group Policy ===
Line 235: Line 234:
[[Image:Group Policy Turn off Autoplay.gif|thumb|The Group Policy settings dialog]]
[[Image:Group Policy Turn off Autoplay.gif|thumb|The Group Policy settings dialog]]


The only Group Policy settings available for AutoRun affect the <tt>NoDriveTypeAutoRun</tt> Registry entries. The policy is available on either a per-machine or a per-user basis reflecting the Registry entry location in either HKLM or HKCU.<ref name=reg_nodtar/><ref name=reg_nodar/>
The only Group Policy settings available for AutoRun affect the <tt>NoDriveTypeAutoRun</tt> Registry entries. The policy is available on either a per-machine or a per-user basis reflecting the Registry entry location in either HKLM or HKCU.<ref name=reg_nodtar/><ref name=reg_nodar/> As described [[#Evaluation order|above]], a per-machine policy setting will cause the per-user policy setting to be ignored.

As described [[#Evaluation order|above]], a per-machine policy setting will cause the per-user policy setting to be ignored.


When a policy is ''Enabled'', Group Policy will add the <tt>NoDriveTypeAutoRun</tt> entry to the Registry. If the policy is ''Disabled'' or set to ''Not configured'', Group Policy deletes this entry from the Registry. System defaults may then take effect as described in the [[#NoDriveTypeAutoRun|NoDriveTypeAutoRun]] section.
When a policy is ''Enabled'', Group Policy will add the <tt>NoDriveTypeAutoRun</tt> entry to the Registry. If the policy is ''Disabled'' or set to ''Not configured'', Group Policy deletes this entry from the Registry. System defaults may then take effect as described in the [[#NoDriveTypeAutoRun|NoDriveTypeAutoRun]] section.


The policy names, locations and possible settings vary slightly between Windows versions. The list of settings are relatively short and are always additional to the system default setting.
The policy names, locations and possible settings vary slightly between Windows versions. The list of settings are relatively short and are always additional to the system default setting. Therefore, on Windows 2000, enabling the "Disable Autoplay" policy and setting it to "CD-ROM drives", disables AutoRun (as distinct from AutoPlay) for CD-ROM and DVD drives, removable drives, network drives, and drives of unknown type.

Therefore, on Windows 2000, enabling the "Disable Autoplay" policy and setting it to "CD-ROM drives", disables AutoRun (as distinct from AutoPlay) for CD-ROM and DVD drives, removable drives, network drives, and drives of unknown type.


This setting cannot be used to enable AutoRun on drives on which it is disabled by default or disable AutoRun for drives not listed. To disable or enable any particular drives or drive types, the Registry must be edited manually.
This setting cannot be used to enable AutoRun on drives on which it is disabled by default or disable AutoRun for drives not listed. To disable or enable any particular drives or drive types, the Registry must be edited manually.
Line 271: Line 266:
Two related policies were added in Vista and Server 2008:<ref>[http://www.microsoft.com/downloads/details.aspx?FamilyID=41DC179B-3328-4350-ADE1-C0D9289F09EF&displaylang=en Group Policy Settings Reference, Windows Vista], Microsoft, ''Downloads'', [[Microsoft Excel|Excel]] Spreadsheet.</ref>
Two related policies were added in Vista and Server 2008:<ref>[http://www.microsoft.com/downloads/details.aspx?FamilyID=41DC179B-3328-4350-ADE1-C0D9289F09EF&displaylang=en Group Policy Settings Reference, Windows Vista], Microsoft, ''Downloads'', [[Microsoft Excel|Excel]] Spreadsheet.</ref>


'''Default behavior for AutoRun'''


<ul>
{| class="wikitable"
<li>Default behavior for AutoRun

{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
Line 287: Line 284:
Sets the default behavior for AutoRun commands found in autorun.inf files.
Sets the default behavior for AutoRun commands found in autorun.inf files.


Prior to Windows Vista, when media containing an autorun.inf with <code>open</code> or <code>shellexecute</code> commands was inserted, the default action was to automatically execute the program without user intervention.
Prior to Windows Vista, when media containing an autorun.inf specifying an AutoRun task was inserted, the default action was to automatically execute the program without user intervention. From Windows Vista the default behaviour is to invoke AutoPlay representing the AutoRun task as one of the dialog options. This is also the behaviour when this policy is Not configured or Disabled.

The default behaviour in Windows Vista is to invoke AutoPlay. The autorun.inf command is then represented as one of the dialog options. This is the behaviour when the policy is Not configured or Disabled.


If this policy is Enabled, the behaviour can be changed to either:
If this policy is Enabled, the behaviour can be changed to either:
Line 295: Line 290:
* Automatically execute the autorun.inf command as per previous Windows versions.
* Automatically execute the autorun.inf command as per previous Windows versions.


'''Don't set the always do this checkbox'''


</li>
{| class="wikitable"
<li> Don't set the always do this checkbox

{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
Line 310: Line 307:


If this policy is Enabled, the "Always do this..." checkbox in the AutoPlay dialog will not be set by default when the dialog is shown.
If this policy is Enabled, the "Always do this..." checkbox in the AutoPlay dialog will not be set by default when the dialog is shown.
</li>
</ul>

==== Windows 7 ====

Given that autorun.inf commands are completely disabled for all volume types except CD and DVD drives, it is expected that further policy settings will be available to fine tune this behaviour. However, no information is currently available.



== Altering AutoRun behaviour ==
== Altering AutoRun behaviour ==

=== Pressing the Shift key ===
=== Pressing the Shift key ===


If the {{keypress|Shift}} key is held down at a certain point in the execution sequence Windows Vista executes AutoPlay regardless of any settings.<ref name=vista_ap_faq/> <!--Previous versions of Windows do not execute anything.<ref name=enadis/>--><!-- The given source is not about safety and mentions this only implicitely, I would not trust it to mean any previous versions. -->
If the {{keypress|Shift}} key is held down at a certain point in the execution sequence Windows Vista invokes the AutoPlay dialog regardless of any AutoPlay settings to the contrary.<ref name=vista_ap_faq/> Previous versions of Windows do not execute the AutoRun task.<ref name=enadis/>


Given that Shift must be held down until Windows checks for it, it may be a considerable amount of time before it becomes effective. The time taken primarily depends on the time to recognise the new hardware and time taken for CD-ROMs to spin up.
Given that Shift must be held down until Windows checks for it, it may be a considerable amount of time before it becomes effective. The time taken primarily depends on the time to recognise the new hardware and the time taken for CD-ROMs to spin up. It is unsafe to rely on this method.


=== Auto Insert Notification ===
=== Auto Insert Notification ===


Certain "Media Change Notification" events may be suppressed by altering certain Registry entries. "Media Change Notification" is the generic term; for CD-ROM drives, the specific term is "Auto Insert Notification".
Certain [[#Initiation and notification|Media Change Notification]] events may be suppressed by altering certain Registry entries. "Media Change Notification" is the generic term; for CD-ROM drives, the specific term is "Auto Insert Notification".


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\SYSTEM\CurrentControlSet\Services\Cdrom</tt>
| colspan="4" | <tt>HKLM\SYSTEM\CurrentControlSet\Services\Cdrom</tt>
Line 334: Line 339:
|}
|}


For CD-ROM drives, changing the value of this Registry entry to 0, will disable Auto Insert Notification for CD-ROM drives only.<ref>[http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/30300.mspx Windows 2000 Registry: AutoRun], Microsoft, ''TechNet''</ref> A Windows restart will be necessary.
For CD-ROM drives, changing the value of this Registry entry to 0, will disable Auto Insert Notification for CD-ROM drives only.<ref>[http://technet.microsoft.com/en-gb/library/cc976182.aspx Windows 2000 Registry: AutoRun], Microsoft, ''TechNet''</ref> A Windows restart will be necessary.


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
! Data value !! Meaning
! Data value !! Meaning
Line 353: Line 358:
Thus, as a side effect only, this disables AutoRun for CD-ROM drives. However, Explorer will now not update its view when a new CD is inserted; it will show the contents of the previous CD until {{keypress|F5}} is pressed or View/Refresh is selected from the Explorer menu. This could result in severe confusion for users.
Thus, as a side effect only, this disables AutoRun for CD-ROM drives. However, Explorer will now not update its view when a new CD is inserted; it will show the contents of the previous CD until {{keypress|F5}} is pressed or View/Refresh is selected from the Explorer menu. This could result in severe confusion for users.


For this reason the Media Change Notification message should not be disabled unless there is absolutely no alternative; AutoRun can be disabled for individual drives using TweakUI, Group Policy or the Registry.
For this reason the Media Change Notification message should not be disabled unless there is absolutely no alternative; AutoRun can be disabled for individual drives using Group Policy or the Registry.


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="2" | <tt>HKLM\SYSTEM\CurrentControlSet\Services\Cdrom</tt>
| colspan="2" | <tt>HKLM\SYSTEM\CurrentControlSet\Services\Cdrom</tt>
Line 365: Line 370:
|}
|}


This entry is used to suppress the MCN message for specifically listed type of CD-ROM drive,<ref>[http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/regentry/58493.mspx Windows 2000 Registry: AutoRunAlwaysDisable], Microsoft, ''TechNet''</ref> primarily CD-ROM changers. The data is a set of device identifiers, which matches those identifiers reported to the system by the devices themselves.
This entry is used to suppress the MCN message for specifically listed type of CD-ROM drive,<ref>[http://technet.microsoft.com/en-gb/library/cc960238.aspx Windows 2000 Registry: AutoRunAlwaysDisable], Microsoft, ''TechNet''</ref> primarily CD-ROM changers. The data is a set of device identifiers, which matches those identifiers reported to the system by the devices themselves.


The default value for this entry consists of products identified by Microsoft testing as being unable to support AutoRun. This entry should not be altered from its default.
The default value for this entry consists of products identified by Microsoft testing as being unable to support AutoRun. This entry should not be altered from its default.
Line 374: Line 379:


However, Group Policy would be the accepted method of disabling AutoRun on an entire Windows domain.
However, Group Policy would be the accepted method of disabling AutoRun on an entire Windows domain.

=== TweakUI ===

[[Image:TweakUI AutoPlay Types.gif|thumb|200px|TweakUI AutoPlay Types]]

[[TweakUI]] is a user interface customisation application produced by Microsoft and is available from their website as part of the [http://www.microsoft.com/windowsxp/Downloads/powertoys/Xppowertoys.mspx PowerToys] toolset.

TweakUI has options to disable AutoRun on a drive or drive type basis under the "My Computer/AutoPlay" settings tree. The options here are given in the inverse from normal - TweakUI shows "enable" options while Group Policy and the Registry show "disable" options - and set the corresponding entries in the Registry:

* Settings under ''Drives'' set <tt>NoDriveAutoRun</tt>
* Settings under ''Types'' set <tt>NoDriveTypeAutoRun</tt>

[[Image:TweakUI AutoPlay Drives.gif|thumb|200px|left|TweakUI AutoPlay Drives]]

However, TweakUI apparently<ref>[http://www.tomshardware.com/forum/35351-45-autoplay-disabled Discussion thread on AutoPlay and TweakUI], ''TomsHardware.com''</ref> sets those Registry entries under the per-user Registry hive, HKEY_CURRENT_USER. In the case of corresponding entries existing under HKEY_LOCAL_MACHINE, the settings would not be effective.

TweakUI is able to change these settings without a reboot being needed. It possibly uses <tt>SendMessage</tt> to send a setting change (WM_SETTINGCHANGE) broadcast (HWND_BROADCAST) to let Explorer know of a change in policy.<ref>[http://technet.microsoft.com/en-us/library/bb742499.aspx Implementing Registry-Based Group Policy for Applications], Microsoft, ''TechNet''</ref>
{{clear}}


=== Registry files ===
=== Registry files ===
Line 397: Line 384:
A Registry setting file can be created that, when executed, makes the desired changes in the Registry.
A Registry setting file can be created that, when executed, makes the desired changes in the Registry.


{| style="font-size:90%; margin:1.5em 1em 1.5em 2em;"
<!-- Note that the registry example has an Alt-255 to have syntax highlighting while preserving the blank line. Yes, that's horrible. Carveone -->
|-

{|style="background:transparent; font-size:90%"
|-valign="top"
|
|
<source lang=reg>
<source lang="reg">
Windows Registry Editor Version 5.00
Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
"NoDriveTypeAutoRun"=dword:000000ff

</source>
</source>

|-valign="top"
:''Note that the actual file should always end with a blank line. This is not optional.<ref name=kb310516/>''
|
:''Note that the example ends with a blank line. This is not optional.<ref name=kb310516/>''
|}
|}


If the above snippet is saved as a file with a .reg extension, for example "<tt>killautorun.reg</tt>", and then the file icon double-clicked, the setting will be entered into the Registry, permissions allowing. In the above example, AutoRun would be disabled for all drives and for all users. This example would need to be run as Administrator and a reboot would be needed for the setting to take complete effect.
In the above example, AutoRun would be disabled for all drives and for all users. This example would need to be run as Administrator and a reboot would be needed for the setting to take complete effect.


=== Initialisation file mapping ===
See the section on the [[#Registry and Group Policy|Registry and Group Policy]] for details on the relevant Registry entries.


Windows Vista and later versions of Windows have a policy setting, "Default behavior for AutoRun", that can be set to disallow the reading of an autorun.inf file on any volume. This avoids certain scenarios where [[malware]] leverages autorun.inf functionality to infect a machine. Previous versions of Windows do not have this policy setting but the use of [[INI file#File mapping|initialisation file mapping]] is an effective workaround.<ref>[http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html Memory stick worms], ''Nick Brown's blog''</ref>
== Issues and workarounds ==
=== The AutoRun disable bug ===


As an autorun.inf file is a standard Windows [[INI file]], the appropriate [[API]] calls are used by Windows when fetching its settings. These API calls can be redirected using the INI file mapping method. The following [[#Registry files|Registry file]] illustrates the workaround, where all autorun.inf settings are taken solely from the <tt>HKEY_LOCAL_MACHINE\Software\DoesNotExist</tt> Registry key:
There has been a longstanding issue with Windows failing to handle AutoRun-relevant Registry entries properly.<ref name=certvuln>[http://www.kb.cert.org/vuls/id/889747 Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value], [[US-CERT]]</ref>


{| style="font-size:90%; margin:1.5em 1em 1.5em 2em;"
When AutoRun is disabled, Windows should not proceed further through the [[#AutoRun activation|activation]] sequence than the Registry check. However, it parses any autorun.inf found and does everything except the final action to invoke AutoPlay or execute an application.
|-
|
<source lang="reg">
Windows Registry Editor Version 5.00


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
This leaves the user open to attack from malware which uses the autorun.inf to alter the double-click and contextual menu behaviours. Double clicking the drive icon will infect the machine. Right Clicking and selecting the "Explore" or "Open" options from the context menu is not a workaround as these menu items can be coopted by the appropriate autorun.inf entries.
@="@SYS:DoesNotExist"


</source>
This bug has been fixed in security updates issued in July 2008. For Windows Vista and Windows Server 2008 the relevant Knowledge Base Article is <tt>950582</tt><ref>[http://support.microsoft.com/kb/950582 Vulnerability in Windows Explorer could allow remote code execution], Microsoft, ''Knowledge Base''</ref> with further details in the security bulletin itself.<ref>[http://www.microsoft.com/technet/security/bulletin/ms08-038.mspx Vulnerability in Windows Explorer Could Allow Remote Code Execution], Microsoft, ''TechNet''</ref>

For Windows XP, Windows Server 2003 and Windows 2000 the relevant Knowledge Base Article is <tt>953252</tt><ref name=kb953252>[http://support.microsoft.com/kb/953252 How to correct "disable Autorun registry key" enforcement...], Microsoft, ''Knowledge Base''</ref> with details and links to the OS specific patches available from that page. Windows 95 and Windows 98 are not affected.

These are fixes which address the Double Click, Contextual Menu and AutoPlay functionality.

These patches also allows reverting to the previous functionality on a per-user and per-machine basis by changing a Registry entry:<ref name=kb953252/>

{| class="wikitable"
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt> <br> <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer</tt>
|-
! Entry name !! Data type !! Range !! Default
|-
| <tt>HonorAutorunSetting</tt>
| <center> REG_DWORD </center>
| <center> 0 or 1 </center>
| <center> 1 </center>
|}
|}


As this key does not exist, it is as if the autorun.inf file contains no settings information. It is important to note that this applies to any autorun.inf in any location and on any drive.
When you install the security update, this Registry entry is created only in the HKEY_LOCAL_MACHINE Registry hive with a default value of 1. This enables the functionality for this update, and for all users.


Both the policy setting and this workaround have the drawback is that installation of software from an autorunning install CD or DVD is no longer automatic. It will be necessary to view the CD's autorun.inf file and then execute the appropriate install program manually.
Setting the Registry entry data to 0 results in the previous insecure behaviour. If the key is present in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE, the HKLM value is used and the HKCU is ignored.


=== Workarounds for the AutoRun bug ===
=== TweakUI ===


[[TweakUI]] is a user interface customisation application produced by Microsoft and is available from their website as part of the [http://www.microsoft.com/windowsxp/Downloads/powertoys/Xppowertoys.mspx PowerToys] toolset.
In the case that the patches referred to above cannot be applied, there are several workarounds available. Two are documented by Microsoft:<ref name=kb953252/>


TweakUI has options to disable AutoRun on a drive or drive type basis under the "My Computer/AutoPlay" settings tree. The options here are given in the inverse from normal - TweakUI shows "enable" options while Group Policy and the Registry show "disable" options - and set the corresponding entries in the Registry:
* Disabling the use of USB devices described in Knowledge Base Article <tt>823732</tt><ref>[http://support.microsoft.com/kb/823732/ How to disable the use of USB storage devices], Microsoft, ''Knowledge Base''</ref>
* Preventing autorun.inf invocation from network shares by following these steps:
*# Delete any existing autorun.inf file from the root of a mapped network drive.
*# Do not give anyone Create rights to the root of a mapped network drive.


* Settings under ''Drives'' set <tt>NoDriveAutoRun</tt>
==== Initialisation file mapping ====
* Settings under ''Types'' set <tt>NoDriveTypeAutoRun</tt>


However, TweakUI apparently<ref>[http://www.tomshardware.com/forum/35351-45-autoplay-disabled Discussion thread on AutoPlay and TweakUI], ''TomsHardware.com''</ref> and unexpectedly sets those Registry entries under the per-user Registry hive, HKEY_CURRENT_USER, for every user on the machine. In the case of corresponding entries existing under HKEY_LOCAL_MACHINE, the settings would not be effective. The settings would not exist for users added later. TweakUI ignores any [[#NoDriveTypeAutoRun|default settings]]. The options are not available unless TweakUI is run with Administrator privileges.
The other workaround involves using [[INI file#File mapping|initialisation file mapping]] to create a mapping between the autorun.inf [[INI file|initialisation file]] and the Registry. This procedure relies on the fact that an autorun.inf file is a standard Windows INI file; so, the appropriate [[API]] calls are used by Windows when fetching its settings. These API calls can be redirected using the INI file mapping method.


<blockquote>
This method was first mentioned in Nick Brown's blog<ref>[http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html Memory stick worms], ''Nick Brown's blog''</ref> and is also referred to in the US-CERT Vulnerability Note.<ref name=certvuln/>
TweakUI is able to change these settings without a reboot being needed. It possibly uses <tt>SendMessage</tt> to send a setting change (WM_SETTINGCHANGE) broadcast (HWND_BROADCAST) to let Explorer know of a change in policy.<ref>[http://technet.microsoft.com/en-us/library/bb742499.aspx Implementing Registry-Based Group Policy for Applications], Microsoft, ''TechNet''</ref>
</blockquote>


Group Policy is the accepted method for correctly effecting AutoRun policy changes.
Create a subkey called <code>autorun.inf</code> under the <tt>HKLM\Software\Microsoft\Windows&nbsp;NT\CurrentVersion\IniFileMapping</tt> key. Change the <tt>(Default)</tt> entry under the new autorun.inf key to the string <code>@SYS:DoesNotExist</code>:


{| class="wikitable"
|-
| colspan="3" | <tt>HKLM\Software\Microsoft\Windows&nbsp;NT\CurrentVersion\IniFileMapping\autorun.inf</tt>
|-
! Entry name !! Data type !! Value
|-
| <tt>(Default)</tt>
| <center> REG_SZ </center>
| <center> @SYS:DoesNotExist </center>
|}
: ''The (Default) Registry entry name is also called (NULL) or, in a Registry file, "@"''


== Issues and security ==
Alternatively, create a [[#Registry files|Registry file]] with the following contents to make the change:


=== The AutoRun disable bug ===
{|style="background:transparent; font-size:90%"
|-
|
<source lang=reg>
Windows Registry Editor Version 5.00


From Windows 2000 through to Windows 2008 Server, AutoRun-relevant Registry entries were not handled properly leading to a security vulnerability.<ref>[http://www.kb.cert.org/vuls/id/889747 Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value], [[US-CERT]]</ref> Windows 95 and Windows 98 were not affected.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"
</source>
|}


When AutoRun is disabled, Windows should not proceed further through the [[#AutoRun activation|activation]] sequence than the Registry check. However, it parses any autorun.inf found and does everything except the final action to invoke AutoPlay or execute an application.
Now whenever Windows tries to read a file called "<tt>autorun.inf</tt>" using the INI programming calls, it is forbidden from reading from the actual file. Instead, all settings are read from the
<tt>HKEY_LOCAL_MACHINE\Software\DoesNotExist</tt> Registry key. As this key does not exist, it is as if the autorun.inf file contains no settings information. This applies to any autorun.inf in any location and on any drive.


This leaves the user open to attack from malware which uses the autorun.inf to alter the double-click and contextual menu behaviours. Double clicking the drive icon will infect the machine. Right Clicking and selecting the "Explore" or "Open" options from the context menu is not a workaround as these menu items can be coopted by the appropriate autorun.inf entries.
The only drawback is that installation of software from an autorunning install CD or DVD is no longer automatic. It will be necessary to view the CD's autorun.inf file and then execute the appropriate install program manually.


This bug was fixed in a number of security updates, detailed in [[Microsoft Knowledge Base]] article <tt>967715</tt>.<ref name=kb967715/>
==== Patch KB950582 ====


=== Problems ===
In February 2009 Microsoft issued a hotifx KB950582 to address the problem. It is described in article [http://support.microsoft.com/default.aspx/kb/953252 KB953252] and [http://www.microsoft.com/technet/security/advisory/967940.mspx security advisory 967940].

=== MountPoints2 ===

<!-- I guess this needs more research but there is no concrete information about this key anywhere. I've put this section in just to be complete -->

There are a number of websites that assert that a certain Registry key, <tt>MountPoints2</tt>, contains cached information about every memory stick or other removable device seen so far. The key can be found under the Registry key:

: <tt>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer</tt>

It is deemed possible that it overrides the <tt>NoDriveTypeAutoRun</tt> entry when a device the PC already knows about is inserted.

It is currently unknown whether the AutoRun Bug patch fixes any issues with this key. There is no Microsoft documentation available on this Registry entry, as it is intended to track [[piracy]] of the operating system by direct disk-to-disk transfers.

=== Other issues ===


<ul>
<ul>
<li> If you add the computer to an Active Directory domain, the <tt>NoDriveTypeAutoRun</tt> value may be reset to a default value.<ref name=kb895108/> This is due to Group Policy settings in the domain taking effect. This is not a bug. </li>
<li> If you add the computer to an Active Directory domain, the <tt>NoDriveTypeAutoRun</tt> value may be reset to a default value.<ref>[http://support.microsoft.com/kb/895108 The NoDriveTypeAutoRun subkey value is reset...], Microsoft, ''Knowledge Base''</ref> This is due to Group Policy settings in the domain taking effect. This is not a bug. </li>


<li> Some programs may deliberately change AutoRun Registry settings. Early versions of CD burning software like Roxio have been known to change settings in this way.<ref name=kb330135>[http://support.microsoft.com/kb/330135 The AutoRun feature or the AutoPlay feature does not work...], Microsoft, ''Knowledge Base''</ref> </li>
<li> Some programs may deliberately change AutoRun Registry settings. Early versions of CD burning software like Roxio have been known to change settings in this way.<ref name=kb330135>[http://support.microsoft.com/kb/330135 The AutoRun feature or the AutoPlay feature does not work...], Microsoft, ''Knowledge Base''</ref> </li>


<li> If the Group Policy "Restrict CD-ROM access to locally logged-on user only" security option under:
<li>

If the Group Policy "Restrict CD-ROM access to locally logged-on user only" security option under:


: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options


is turned on (Enabled), then AutoRun may not function.<ref name=kb330135/> </p>
is turned on (Enabled), then AutoRun may not function.<ref name=kb330135/>


<p> Windows Installers will also malfunction because "Local System" access to the CD-ROM will be denied.<ref>[http://support.microsoft.com/kb/230895 You receive an "Installation ended prematurely because..."], Microsoft, ''Knowledge Base''</ref>
<p>Windows Installers will also malfunction because "Local System" access to the CD-ROM will be denied.<ref>[http://support.microsoft.com/kb/230895 You receive an "Installation ended prematurely because..."], Microsoft, ''Knowledge Base''</ref></p>


This Group Policy setting reflects the value of the Registry entry:
This Group Policy setting reflects the value of the Registry entry:


{| class="wikitable"
{| class="wikitable" style="margin:1.5em 1em 1.5em 2em;"
|-
|-
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</tt>
| colspan="4" | <tt>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon</tt>
Line 546: Line 481:
|}
|}


and should be set to 0.
and should be set to 0.


</li>
</li>


<li> Real Player 10 interferes with AutoPlay functionality to the extent that it may look as if AutoRun or AutoPlay is not working at all.<ref>[http://gladiator-antivirus.com/forum/index.php?s=&showtopic=15090&view=findpost&p=54229 Camera and Scanner Wizard, stopped working], ''Gladiator Security chat forum''</ref><ref>[http://www.vista-xp.co.uk/forums/hardware-operating-problems/3469-autoplay-not-working-digital-camera-sorted.html#post30012 Autoplay not working with digital camera], ''vista-xp chat forum''</ref><ref>[http://www.tech-archive.net/Archive/WinXP/microsoft.public.windowsxp.photos/2005-01/0365.html How to repair your camera Autoplay download], ''tech-archive.net chat forum''</ref> </li>
<li> Real Player 10 interferes with AutoPlay functionality to the extent that it may look as if AutoRun or AutoPlay is not working at all.<ref>[http://gladiator-antivirus.com/forum/index.php?s=&showtopic=15090&view=findpost&p=54229 Camera and Scanner Wizard, stopped working], ''Gladiator Security chat forum''</ref><ref>[http://www.vista-xp.co.uk/forums/hardware-operating-problems/3469-autoplay-not-working-digital-camera-sorted.html#post30012 Autoplay not working with digital camera], ''vista-xp chat forum''</ref><ref>[http://www.tech-archive.net/Archive/WinXP/microsoft.public.windowsxp.photos/2005-01/0365.html How to repair your camera Autoplay download], ''tech-archive.net chat forum''</ref> </li>
</ul>
</ul>


== Attack vectors ==
=== Attack vectors ===


AutoRun functionality has been used as a [[malware]] vector for some time. Prior to Windows Vista, the default action with a CD-ROM drive type was to follow any autorun.inf file instructions without prompts or warnings. This makes rogue CD-ROMs one possible infection vector.
AutoRun functionality has been used as a malware vector for some time. Prior to Windows Vista, the default action with a CD-ROM drive type was to follow any autorun.inf file instructions without prompts or warnings. This makes rogue CD-ROMs one possible infection vector.


In the same category are mixed content CD-ROMs. An audio CD, that a user would not expect to contain software at all, can contain a data section with an autorun.inf. Some companies, such as [[2005 Sony BMG CD copy protection scandal|Sony BMG]], have used this vector to install software that attempts to protect against copying of the audio tracks.
In the same category are mixed content CD-ROMs. An audio CD, that a user would not expect to contain software at all, can contain a data section with an autorun.inf. Some companies, such as [[2005 Sony BMG CD copy protection scandal|Sony BMG]], have used this vector to install software that attempts to protect against copying of the audio tracks.
Line 565: Line 500:
[[Image:Conficker worm AutoPlay Vista.png|thumb|Social Engineering: The [[Conficker]] worm [http://isc.sans.org/diary.html?storyid=5695 in action] ]]
[[Image:Conficker worm AutoPlay Vista.png|thumb|Social Engineering: The [[Conficker]] worm [http://isc.sans.org/diary.html?storyid=5695 in action] ]]


With a standard flash drive, social engineering attacks can be employed to entice a user to click on the appropriate item in the AutoPlay dialog. An alluring [[#%5bautorun%5d|action]] string promising free games or pornography would lure many users into the trap. At any time, double clicking on the drive icon will use the autorun.inf automatically, a trap more advanced users could fall into.
With a standard flash drive, social engineering attacks can be employed to entice a user to click on the appropriate item in the AutoPlay dialog. An alluring [[autorun.inf#%5bautorun%5d|action]] string promising free games or pornography would lure many users into the trap. At any time, double clicking on the drive icon will use the autorun.inf automatically, a trap more advanced users could fall into.


Any user can configure AutoPlay to make various decisions for them; by checking the appropriate box in the AutoPlay dialog, running flash drive malware becomes silent and automatic.
Any user can configure AutoPlay to make various decisions for them; by checking the appropriate box in the AutoPlay dialog, running flash drive malware becomes silent and automatic.
Line 571: Line 506:
AutoRun malware has been extended to use hard drives,<ref>[http://www.channelregister.co.uk/2007/11/12/maxtor_infected_hdd_updated/ Chinese Trojan on Maxtor HDDs spooks Taiwan], ''[[The Register]]'', 12 November 2007</ref> picture frames and other digital devices.<ref>[http://www.theregister.co.uk/2008/01/11/malware_digital_devices/ Malware hitches a ride on digital devices], ''The Register'', 11 January 2008</ref> Care in dealing with external devices is a security priority.
AutoRun malware has been extended to use hard drives,<ref>[http://www.channelregister.co.uk/2007/11/12/maxtor_infected_hdd_updated/ Chinese Trojan on Maxtor HDDs spooks Taiwan], ''[[The Register]]'', 12 November 2007</ref> picture frames and other digital devices.<ref>[http://www.theregister.co.uk/2008/01/11/malware_digital_devices/ Malware hitches a ride on digital devices], ''The Register'', 11 January 2008</ref> Care in dealing with external devices is a security priority.


Mitigation of malware attacks:
=== Mitigation ===


* Do not habitually run with Administrator privileges
* Do not habitually run with [[Superuser|Administrator]] privileges
* Apply all relevant security patches
* Disable AutoRun (but see the [[#The AutoRun disable bug|AutoRun disable bug]])
* Disable AutoRun (but see the [[#The AutoRun disable bug|AutoRun disable bug]])
* Use Group Policy under Vista to disable autorun.inf commands
* Use Group Policy under Vista to disable autorun.inf commands
* Use [[#Initialisation file mapping|initialisation file mapping]] to nullify autorun.inf sections
* Use [[#Initialisation file mapping|initialisation file mapping]] to nullify autorun.inf sections
* Prevent autorun.inf invocation from network shares by:<ref name=kb967715/>
* Use Autorun Protector to prevent your PC and removable device from infecting with autorun worms
*# Deleting any existing autorun.inf file from the root of a mapped network drive
*# Denying Create rights to the root of a mapped network drive
* Prevent the use of USB storage devices. The Registry settings to accomplish this are described in Knowledge Base article <tt>823732</tt>.<ref>[http://support.microsoft.com/kb/823732/ How can I prevent users from connecting to a USB storage device?], Microsoft, ''Knowledge Base''</ref> Glue is an ineffective and damaging way to accomplish the same thing.


== The autorun.inf file ==

<tt>autorun.inf</tt> is an [[ASCII]] text file located in the root folder of a CD-ROM or other removable media. The structure is that of a classic Windows [[INI file|.ini]] file, containing information and commands as "key=value" pairs, grouped into sections.<ref name=appcreate/> These keys specify:

* The name and the location of a program to call when the media is inserted.

* The name of a file that contains an icon that represents the media in Explorer (instead of the standard drive icon).

* Commands for the menu that appears when the user right-clicks the drive icon.

* The default command that runs when the user double-clicks the drive icon.

* Settings that alter AutoPlay detection routines or search parameters

* Settings that indicate the presence of drivers.

On Windows XP versions previous to Service Pack 2, drives of type DRIVE_REMOVABLE do not have any autorun.inf support.<ref name=appcreate/>

From Service Pack 2, removable drives may have an autorun.inf file recognised and used by including an <code>action</code> key. The text from this key may be combined with an icon given by the <code>icon</code> key and this will be used in the AutoPlay dialog presented to the user.<ref name=infentries/>

Following are the sections and keys allowed in a valid autorun.inf.<ref name=infentries/> There also exist architecture specific section types for systems such as Windows NT 4 running on RISC. These are outdated and not described here.

=== Sample autorun.inf ===

This simple autorun.inf file specifies <tt>setup.exe</tt> as the application to run when AutoRun is activated. The first icon stored within the setup.exe itself will represent the drive in Explorer:
{|style="background:transparent" width="100%"
|-valign="top"
|
<source lang="ini">
[autorun]
open=setup.exe
icon=setup.exe,0
label=My install CD
</source>
|}

=== &#91;autorun&#93; ===

The <tt>autorun</tt> section contains the default AutoRun commands. Valid autorun.inf files must contain this section. Keys allowed are:

<tt> action=text </tt> <br> <tt><nowiki> action=@[filepath\]filename,-resourceID </nowiki></tt>

:: ''Windows XP SP2 or later; drives of type DRIVE_REMOVABLE and DRIVE_FIXED''

: Specifies text used in the AutoPlay dialog to represent the program specified in the <code>open</code> or <code>shellexecute</code> keys. The text is expressed as either text or as a resource reference. The <code>icon</code> is displayed next to the text. This item is always first in the AutoPlay dialog and is always selected by default.

: If the (action) key does not appear on drives of type:

::{|style="background:transparent"
|-valign="top"
| DRIVE_REMOVABLE || &nbsp; || the AutoPlay dialog appears but without additional menu items. Essentially, the autorun.inf is ignored. This makes the action key mandatory for drives of this type.
|-valign="top"
| DRIVE_FIXED || &nbsp; || default text is created and used in the AutoPlay dialog.
|}

: On all other drive types the key is ignored.

<tt><nowiki> icon=iconfilename[,index] </nowiki></tt>

: The name of an file resource containing an icon. This icon replaces the standard drive icon in Windows Explorer. This file must be in the same directory as the file specified by the <code>open</code> key.

<tt> label=text </tt>

: Specifies a text label representing the drive in Windows Explorer.

<tt><nowiki> open=[exepath\]exefile [param1 [param2] ...] </nowiki></tt>

: Specifies the path, file name and optional parameters to the application that AutoRun launches when a user inserts a disc in the drive. It is the <tt>CreateProcess</tt> function that is called by AutoRun.

<tt><nowiki> shellexecute=[filepath\]filename[param1, [param2]...] </nowiki></tt>

:: ''Windows 2000, Windows ME or later''

: Similar to open, but using file association information to run the application. The file name can therefore be an executable or a data file. It is the <tt>ShellExecuteEx</tt> function that is called by AutoRun.

<tt> UseAutoPlay=1 </tt>

:: ''Windows XP or later; drives of type DRIVE_CDROM''

: Use AutoPlay rather than AutoRun with CD-ROMs. The action taken on CD-ROM insertion will depend on the version of Windows being used.

: On versions of Windows earlier than XP, this key has no effect and actions specified by <code>open</code> or <code>shellexecute</code> are performed.

: On Windows XP and later, the user will be presented with the AutoPlay dialog and any actions specified by <code>open</code> or <code>shellexecute</code> are ignored.

<tt> shell\''verb''\command=<nowiki>[exepath\]exefile [param1 [param2] ...]</nowiki> </tt>

: Adds a custom command to the drive's shortcut menu. ''verb'' is a string with no embedded spaces. ''verb'' is also the text that will appear in the shortcut menu unless specifically altered to some other text. See below for an example.

<tt> shell\''verb''=MenuText </tt>

: Optionally specify the text displayed in the shortcut menu for the ''verb'' above. Use an ampersand (&) to select a hotkey for the menu. See below for an example.

<tt> shell=''verb'' </tt>

: Defines the menu command referred to by <code>shell\''verb''</code> as the default command in the shortcut menu. The default command is the command executed when the drive icon is double-clicked. If missing, the default menu item will be "AutoPlay", which launches the application specified by the <code>open</code> entry.

: Example:
:{|style="background:transparent"
|-valign="top"
|
<source lang="ini">
shell\readme\command=notepad readme.txt
shell\readme=Read &Me
shell=readme
</source>
|}

=== &#91;Content&#93; ===

: ''Windows Vista or later''

The <tt>Content</tt> section allows authors to communicate the type and intent of content to AutoPlay without AutoPlay having to examine the media.

Valid keys are: <code>MusicFiles</code>, <code>PictureFiles</code>, <code>VideoFiles</code>. Each key can be set to indicate true or false values and values are not case sensitive.

:{|style="background:transparent"
|-valign="top"
| true || (or 1, y, yes, t) || : || display the handlers associated with that content type
|-valign="top"
| false || (or 0, n, no, f) || : || do not display the handlers associated with that content type
|}

Example:
{|style="background:transparent" width="100%"
|-valign="top"
|
<source lang="ini">
[Content]
MusicFiles=Y
PictureFiles=0
VideoFiles=false
</source>
|}

=== &#91;ExclusiveContentPaths&#93; ===

: ''Windows Vista or later''

Limits AutoPlay's content search to only those folders listed, and their subfolders. The folder names are always taken as absolute paths (a path from the root directory of the media) whether or not a leading slash is used.

Example:
{|style="background:transparent" width="100%"
|-valign="top"
|
<source lang="ini">
[ExclusiveContentPaths]
\pictures
\music
more music\special
</source>
|}

=== &#91;IgnoreContentPaths&#93; ===

: ''Windows Vista or later''

AutoPlay's content search system will not scan the folders listed, nor their subfolders. <tt>IgnoreContentPaths</tt> takes precedence over <tt>ExclusiveContentPaths</tt> so if a path given in a &#91;IgnoreContentPaths&#93; section is a subfolder of a path given in an &#91;ExclusiveContentPaths&#93; section it is still ignored.

=== &#91;DeviceInstall&#93; ===

: ''Windows XP or later''

This section is used to indicate where driver files may be located. This prevents a lengthy search through the entire contents of a CD-ROM. Windows XP will fully search:

* floppy disks in drives A or B
* CD/DVD media less than 1 GB in size.

without this section present. All other media should include this section to have Windows XP autodetect any drivers stored on that media.

The section is not used with AutoRun or AutoPlay and is only referred to during a driver installation phase. The only valid key is:

: <tt>DriverPath=directorypath</tt>

which lists a path Windows will search for driver files. All subdirectories of that path are also searched. Multiple key entries are allowed.

If no <code>DriverPath</code> entry is provided in the <tt>&#91;DeviceInstall&#93;</tt> section or the <code>DriverPath</code> entry has no value, then that drive is skipped during a search for driver files.

Example:
{|style="background:transparent" width="100%"
|-valign="top"
|
<source lang="ini">
[DeviceInstall]
DriverPath=drivers\video
DriverPath=drivers\audio
</source>
|}


== See also ==
== See also ==


* [[autorun.inf]]
* [[AutoPlay]]
* [[AutoPlay]]



== References ==
== References ==
{{Reflist|2}}
{{Reflist|2}}



== External links ==
== External links ==
* [http://raylin.wordpress.com/downloads/autorun-protector/ Autorun Protector: Prevent your PC and removable device from infecting with autorun worms.]
* [http://blogs.computerworld.com/node/12993/print Autorun and Autoplay: screwed by terminology], ''Michael Horowitz''
* [http://msdn.microsoft.com/en-us/library/cc136610(VS.85).aspx AutoRun and AutoPlay Reference], Microsoft, ''MSDN Library''
* [http://msdn.microsoft.com/en-us/library/cc136610(VS.85).aspx AutoRun and AutoPlay Reference], Microsoft, ''MSDN Library''
* [http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html Memory stick worms], ''Nick Brown's blog''
* [http://nick.brown.free.fr/blog/2007/10/memory-stick-worms.html Memory stick worms], ''Nick Brown's blog''
Line 786: Line 538:
* [http://blogs.computerworld.com/test_your_defenses_against_malicious_usb_flash_drives Test your defenses against malicious USB flash drives], ''Computerworld blog, January 24, 2009''
* [http://blogs.computerworld.com/test_your_defenses_against_malicious_usb_flash_drives Test your defenses against malicious USB flash drives], ''Computerworld blog, January 24, 2009''
* [http://blogs.computerworld.com/the_best_way_to_disable_autorun_to_be_protected_from_infected_usb_flash_drives The best way to disable Autorun for protection from infected USB flash drives], ''Computerworld blog, January 30, 2009''
* [http://blogs.computerworld.com/the_best_way_to_disable_autorun_to_be_protected_from_infected_usb_flash_drives The best way to disable Autorun for protection from infected USB flash drives], ''Computerworld blog, January 30, 2009''

* [http://support.microsoft.com/kb/967715 How to correct "disable Autorun registry key" enforcement in Windows], ''Microsoft KB967715''


{{Microsoft Windows components}}
{{Microsoft Windows components}}

Revision as of 13:25, 30 August 2009

AutoRun and the companion feature AutoPlay are components of the Microsoft Windows operating system that dictate what actions the system takes when a drive is mounted.

AutoRun was introduced in Windows 95 to ease application installation for non-technical users and reduce the cost of software support calls. When an appropriately configured CD-ROM is inserted into a CD-ROM drive, Windows detects the arrival and checks the contents for a special file containing a set of instructions. For a commercial application, these instructions normally initiate installation of the software from the CD-ROM. To maximise the likelihood of installation success, AutoRun also acts when the drive is accessed ("double-clicked") in Windows Explorer (or "My Computer").

Until the introduction of Windows XP, the terms AutoRun and AutoPlay were used interchangeably, developers often using the former term and end users the latter. This tendency is reflected in Windows Policy settings named AutoPlay that change Windows Registry entries named AutoRun, and in the autorun.inf file which causes "AutoPlay" to be added to drives’ context menus. The terminology was of little importance until the arrival of Windows XP and its addition of a new feature to assist users in selecting appropriate actions when new media and devices were detected. This new feature was called AutoPlay and a differentiation between the two terms was created.[1]


AutoRun

AutoRun, a feature of Windows Explorer (actually of the shell32 dll) introduced in Windows 95, enables media and devices to launch programs by use of commands listed in a file called autorun.inf, stored in the root directory of the medium.

Primarily used on installation CD-ROMs, the applications called are usually application installers. The autorun.inf file can also specify an icon which will represent the device visually in Explorer along with other advanced features.[1]

The terms AutoRun and AutoPlay tend to be interchangeably used when referring to the initiating action, the action that detects and starts reading from discovered volumes. The flowchart illustration in the AutoPlay article shows how AutoRun is positioned as a layer between AutoPlay and the Shell Hardware Detection service and may help in understanding the terminology. However, to avoid confusion, this article uses the term AutoRun when referring to the initiating action.


AutoPlay

AutoPlay in Windows Vista

AutoPlay is a feature introduced in Windows XP which examines removable media and devices and, based on content such as pictures, music or video files, launches an appropriate application to play or display the content.[1] If available, settings in an autorun.inf file can add to the options presented to the user.

AutoPlay is based on a set of handler applications registered with the AutoPlay system. Each media type (Pictures, Music, Video) can have a set of registered handlers which can deal with playing or display that type of media.

Each hardware device can have a default action occurring on discovery of a particular media type, or the AutoPlay dialog can prompt the user what action to take.


AutoRun activation

The AutoRun sequence starts with the initial discovery of a new device or new piece of media. Following this, notification of interested parties occurs, of which the Windows Explorer shell is of primary interest. After checking certain Registry settings to see if AutoRun can proceed, parsing of an optional autorun.inf may occur and any necessary actions are taken.

The initial sequence is handled much the same in every version of Windows from Windows 95. However, the way the autorun.inf file is read and acted upon and the level of integration of AutoRun with AutoPlay has changed significantly from the time AutoPlay was introduced in Windows XP until the present handling in Windows 7.

Initiation and notification

When a device with AutoRun-compatible drivers receives new media, a "Media Change Notification" event occurs. The Windows OS then notifies interested applications that a device change has occurred. The notification method used can change depending on the device type.

If the device changed is a volume (like a CD) or a port (like a serial port) Windows broadcasts a WM_DEVICECHANGE notification to all top level windows.[2][3] Windows calls this a "basic" notification. A top level window is one which is a descendant of the desktop.

However, if the device changed is not one of these types an application can use the RegisterDeviceNotification[4] function to register to receive device notifications.

An article on the CodeProject website, "Detecting Hardware Insertion and/or Removal", with clarifications from a blog by Doran Holan is of particular technical interest here.

Non-volume devices are those devices that do not appear as drive letters in "My Computer". These are not handled by any part of AutoRun - any actions taken for these devices are taken either by device specific software or by AutoPlay. See AutoPlay#Devices that are not drives.

When Explorer receives notification of a volume change, it performs a number of actions:[5][6]

  1. Checks to see if AutoRun has been disabled through the Registry. If AutoRun is disabled for that drive or drive type, Explorer does not proceed further. There have been bugs in this area.
  2. Checks that the root directory of the inserted media contains an autorun.inf file, which might be read. See below.
  3. Sends a QueryCancelAutoPlay message to the foreground window. An application which has registered its interest in receiving this message using RegisterWindowMessage can respond to this message to halt AutoRun (and thus AutoPlay) at this point. Any application, foreground or not, can also be notified by using the IQueryCancelAutoPlay COM interface[7] available in Windows XP and later.
  4. Alters double-click and contextual menu behaviours. When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens is fully programmable by settings in the autorun.inf file.
  5. Adds an autorun.inf controllable icon and descriptive text to the drive icon.
  6. Checks to see if the ⇧ Shift key is held down. If it is then Windows Vista (and later Windows versions) will invoke the AutoPlay dialog regardless of settings to the contrary.[8] Previous versions of Windows will not continue with the process.[6]
  7. Finally, if this point has been reached, either:
    • takes no further action.
    • executes the "AutoRun task", the application optionally specified in the open or shellexecute keys in an autorun.inf's [autorun] section.
    • invokes AutoPlay.
    Which choice is made depends on the version of Windows in use, instructions from the autorun.inf if available and the type of the media discovered.

Changing behaviour

See also: autorun.inf § Inf handling

Before AutoPlay

On Windows versions prior to Windows XP, an autorun.inf file on any drive type will be read and its instructions followed. The AutoRun task, if specified, is executed immediately without user interaction.[9] This includes DRIVE_REMOVABLE, DRIVE_FIXED and DRIVE_REMOTE drive types.

AutoRun will work with network drives (the DRIVE_REMOTE drive type) that are mapped to a drive letter. AutoRun will also work with floppy drives that are provided with autorun-compatible drivers.[6]

The default Registry settings on Windows versions prior to Windows XP (See NoDriveTypeAutoRun), disable Remote and Removable drives from AutoRun initiation, leaving Fixed and CDROM drive types active by default.

Introducing AutoPlay

With the introduction of AutoPlay in Windows XP, the final stage action (stage 7 above) for some drive types changed from executing an application to invoking AutoPlay. From Windows Vista, the AutoPlay system is integrated into every aspect of media handling and there is no automatic execution of the AutoRun task.

The default Registry settings add Removable drives to those that initiated AutoRun. In Windows XP and higher, except Windows Server 2003, only the Unknown and Remote drive types are not active for AutoRun.

The handling of the autorun.inf file changes very significantly between each Windows version. The details can be found in the autorun.inf article. The current handling in Windows 7 is that only drives of type DRIVE_CDROM read and use the autorun.inf file.

The AutoPlay safety net

It would appear that AutoPlay, by transferring control of what were previously automatic and invisible actions to AutoPlay, acts to increase user control and safety. This applies especially from Windows Vista, where all media and devices fall under AutoPlay control.

However it is important to note that:

  • A user can instruct AutoPlay to make automatic choices on their behalf, including the execution of any AutoRun task.
  • When a user double clicks on the drive icon in Explorer or right clicks to get a context menu, what happens next is fully programmable by the autorun.inf file and is essentially outside AutoPlay's purview. This is true under any Windows operating system.
  • Disabling AutoRun may force a user to double click the drive icon to get a contents list thus actually increasing the chance of malware infiltration.


Registry and Group Policy

AutoRun consults Windows Registry values to decides whether to initiate actions for any particular drive or drive type. These values can be changed using several methods, one of which is using Group Policy.

The primary relevant Registry entry names are NoDriveTypeAutoRun and NoDriveAutoRun. These exist in both per-machine and per-user settings and their location and priority in the Registry are described in further detail below.

Drive types

The drive types are distinguished by Type Name as follows:[10]

Type name Description
DRIVE_UNKNOWN The drive type cannot be determined
DRIVE_REMOVABLE The drive has removable media (floppy drive, USB flash drive)
DRIVE_FIXED The disk cannot be removed from the drive (hard disk)
DRIVE_REMOTE The drive is a remote (network) drive
DRIVE_CDROM The drive is a CD-ROM or DVD-ROM drive
DRIVE_RAMDISK The drive is a RAM disk

Registry terminology

The Windows Registry is a directory which stores settings and options for the operating system. The terminology is somewhat misleading so it is briefly summarised here.

A Registry key is similar to a folder that, in addition to values, each key can contain subkeys which in turn may contain subkeys, and so on.

A Registry value consists of a name-data pair. Microsoft documentation commonly uses the term "entry" as an equivalent term. It also uses "value" for "data" when it is obvious what is meant. To avoid confusion, this article always uses the term "entry" when referring to the name-data pair.

Two Registry keys that are very commonly referred to are HKEY_LOCAL_MACHINE which contains per-machine settings, and HKEY_CURRENT_USER which contains settings for the currently logged-on user. These are almost always abbreviated as HKLM and HKCU respectively. There may be many users of a machine; their settings are stored in HKEY_USERS, HKCU is actually just a link to the appropriate place in HKEY_USERS.

Changing Registry settings

Registry settings may be changed directly by using the GUI regedit tool or the command line reg.exe utility. Settings can also be placed in a text file[11], named with a .reg extension type. For example, "mychanges.reg". When the file is double clicked, the settings in the file are entered into the Registry, permissions allowing.

They can be changed indirectly by using Group Policy, applied locally to a single computer with GPEdit.msc or to a domain with gpmc.msc.

It may be necessary to either logout or restart the computer in order for any Registry changes to take effect.

Evaluation order

The NoDriveAutoRun and NoDriveTypeAutoRun Registry entries can exist in two places, the per-user setting (under HKEY_CURRENT_USER) and the per-machine setting (under HKEY_LOCAL_MACHINE). If an entry appears under HKEY_LOCAL_MACHINE, then any corresponding entry under HKEY_CURRENT_USER is completely ignored. The data values are not merged in any way.

When deciding whether to activate AutoRun, both NoDriveAutoRun and NoDriveTypeAutoRun Registry entries are consulted. If either value indicates a drive should be disabled then AutoRun is disabled for that drive.

Thus in the following example:

HKEY_LOCAL_MACHINE HKEY_CURRENT_USER
NoDriveAutoRun NoDriveTypeAutoRun NoDriveAutoRun NoDriveTypeAutoRun
0x08 (Not Present) 0x03FFFFFFF 0x95

the data value taken for NoDriveAutoRun is 0x08, disabling drive D and the data value taken for NoDriveTypeAutoRun is 0x95, disabling removable and network drives. The per-user NoDriveAutoRun entry is never used.

NoDriveTypeAutoRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Entry name Data type Range Default
NoDriveTypeAutoRun
REG_DWORD
0x0 to 0xFF
0x95 or 0x91

This Registry entry disables or enables the AutoRun feature on all drives of the type specified.[12] It reflects the setting of the relevant Autoplay Group Policy. Valid data ranges from 0x00 to 0xFF in hexadecimal notation. If the entry is not present, the default data value is either 0x95 or 0x91 depending on the version of Windows used. An entry present in HKLM overrides any entry present in HKCU.

The entry data is a bitmapped value, where a bit set to 1 disables AutoRun on a particular type of drive. The bit settings for each type of drive are shown below:

drive type bitwise settings
drive type bitwise settings

Note that bit number 1 is unused and that the "Unknown" type is represented twice. Setting all bits to 1 would give a hexadecimal value of 0xFF, decimal 255, and would disable AutoRun on all types of drives.

The default setting for this entry depends on the version of Windows being used:[9][13]

Operating system Default setting
Windows 7
0x91
Windows Server 2008
0x91
Windows Vista
0x91
Windows Server 2003
0x95
Windows XP
0x91
Windows 2000
0x95
Windows 95/98
0x95

NoDriveAutoRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Entry name Data type Range Default
NoDriveAutoRun
REG_DWORD
0x0 to 0x03FFFFFF
0x0

This Registry entry disables or enables the AutoRun feature on individual drives.[14] It is not associated with a Group Policy and does not exist by default. The data value is taken to be 0 if the entry is not present. An entry present in HKLM overrides any entry present in HKCU.

The data is a 32 bit (DWORD) bitmapped value, of which the lower 26 bits are used to represent each of the 26 drive letters from A to Z. Thus the valid data range is from 0x0 to 0x03FFFFFFF. The least significant bit (the right most bit) represents drive A, and the 26th bit from the right represents drive Z.

A bit set to 1 disables AutoRun on a particular drive. For example, if the data value is set to 0x8 (1000 binary), AutoRun is disabled on drive D.

Group Policy

The Group Policy settings dialog

The only Group Policy settings available for AutoRun affect the NoDriveTypeAutoRun Registry entries. The policy is available on either a per-machine or a per-user basis reflecting the Registry entry location in either HKLM or HKCU.[12][14] As described above, a per-machine policy setting will cause the per-user policy setting to be ignored.

When a policy is Enabled, Group Policy will add the NoDriveTypeAutoRun entry to the Registry. If the policy is Disabled or set to Not configured, Group Policy deletes this entry from the Registry. System defaults may then take effect as described in the NoDriveTypeAutoRun section.

The policy names, locations and possible settings vary slightly between Windows versions. The list of settings are relatively short and are always additional to the system default setting. Therefore, on Windows 2000, enabling the "Disable Autoplay" policy and setting it to "CD-ROM drives", disables AutoRun (as distinct from AutoPlay) for CD-ROM and DVD drives, removable drives, network drives, and drives of unknown type.

This setting cannot be used to enable AutoRun on drives on which it is disabled by default or disable AutoRun for drives not listed. To disable or enable any particular drives or drive types, the Registry must be edited manually.

Windows Server 2003, Windows XP, and Windows 2000

The per-machine policy location is:

Computer Configuration \ Administrative Templates \ System

The per-user policy location is:

User Configuration \ Administrative Templates \ System

The relevant policy is "Turn off Autoplay". In Windows 2000 the policy is called "Disable Autoplay" instead.

Once the policy is Enabled it can be set to "All drives" or "CD-ROM drives". The latter setting adds CD-ROM drives to the existing list of disabled drive types as described above.

Windows Vista, Windows Server 2008

The per-machine policy location is:[15]

Computer Configuration \ Administrative Templates \ Windows Components \ Autoplay Policies

The per-user policy location is:

User Configuration \ Administrative Templates \ Windows Components \ AutoPlay Policies

The relevant policy is "Turn off Autoplay" and can be set for CD-ROM, DVD-ROM and removable drives or all drives.

Two related policies were added in Vista and Server 2008:[16]


  • Default behavior for AutoRun
    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    Entry name Data type Range Default
    NoAutoRun
    REG_DWORD

    Sets the default behavior for AutoRun commands found in autorun.inf files.

    Prior to Windows Vista, when media containing an autorun.inf specifying an AutoRun task was inserted, the default action was to automatically execute the program without user intervention. From Windows Vista the default behaviour is to invoke AutoPlay representing the AutoRun task as one of the dialog options. This is also the behaviour when this policy is Not configured or Disabled.

    If this policy is Enabled, the behaviour can be changed to either:

    • Completely disable autorun.inf commands or
    • Automatically execute the autorun.inf command as per previous Windows versions.


  • Don't set the always do this checkbox
    HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    Entry name Data type Range Default
    DontSetAutoplayCheckbox
    REG_DWORD

    If this policy is Enabled, the "Always do this..." checkbox in the AutoPlay dialog will not be set by default when the dialog is shown.

Windows 7

Given that autorun.inf commands are completely disabled for all volume types except CD and DVD drives, it is expected that further policy settings will be available to fine tune this behaviour. However, no information is currently available.


Altering AutoRun behaviour

Pressing the Shift key

If the ⇧ Shift key is held down at a certain point in the execution sequence Windows Vista invokes the AutoPlay dialog regardless of any AutoPlay settings to the contrary.[8] Previous versions of Windows do not execute the AutoRun task.[6]

Given that Shift must be held down until Windows checks for it, it may be a considerable amount of time before it becomes effective. The time taken primarily depends on the time to recognise the new hardware and the time taken for CD-ROMs to spin up. It is unsafe to rely on this method.

Auto Insert Notification

Certain Media Change Notification events may be suppressed by altering certain Registry entries. "Media Change Notification" is the generic term; for CD-ROM drives, the specific term is "Auto Insert Notification".

HKLM\SYSTEM\CurrentControlSet\Services\Cdrom
Entry name Data type Range Default
AutoRun
REG_DWORD
0 or 1
1

For CD-ROM drives, changing the value of this Registry entry to 0, will disable Auto Insert Notification for CD-ROM drives only.[17] A Windows restart will be necessary.

Data value Meaning
0
 Does not send an MCN message
1
 Sends an MCN message

Under Windows 95/98/ME, this setting can be changed under Device Manager, accessible from the System icon in Control Panel.

Auto insert notification under Windows 98

Although the Registry entry is named "AutoRun", it only suppresses the MCN message. The MCN message does trigger AutoRun initiation but it also instructs the Explorer shell to update its views and contents.

Thus, as a side effect only, this disables AutoRun for CD-ROM drives. However, Explorer will now not update its view when a new CD is inserted; it will show the contents of the previous CD until F5 is pressed or View/Refresh is selected from the Explorer menu. This could result in severe confusion for users.

For this reason the Media Change Notification message should not be disabled unless there is absolutely no alternative; AutoRun can be disabled for individual drives using Group Policy or the Registry.

HKLM\SYSTEM\CurrentControlSet\Services\Cdrom
Entry name Data type
AutoRunAlwaysDisable REG_MULTI_SZ

This entry is used to suppress the MCN message for specifically listed type of CD-ROM drive,[18] primarily CD-ROM changers. The data is a set of device identifiers, which matches those identifiers reported to the system by the devices themselves.

The default value for this entry consists of products identified by Microsoft testing as being unable to support AutoRun. This entry should not be altered from its default.

Editing Group Policy

AutoRun may be suppressed on particular drives and drive types by using Group Policy as described in the section on the Registry and Group Policy. However, the Group Policy Editor is not available on Home versions of Windows XP[19] and does not provide any fine-grained drive selection facilities.

However, Group Policy would be the accepted method of disabling AutoRun on an entire Windows domain.

Registry files

A Registry setting file can be created that, when executed, makes the desired changes in the Registry. 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff
Note that the actual file should always end with a blank line. This is not optional.[11]

In the above example, AutoRun would be disabled for all drives and for all users. This example would need to be run as Administrator and a reboot would be needed for the setting to take complete effect.

Initialisation file mapping

Windows Vista and later versions of Windows have a policy setting, "Default behavior for AutoRun", that can be set to disallow the reading of an autorun.inf file on any volume. This avoids certain scenarios where malware leverages autorun.inf functionality to infect a machine. Previous versions of Windows do not have this policy setting but the use of initialisation file mapping is an effective workaround.[20]

As an autorun.inf file is a standard Windows INI file, the appropriate API calls are used by Windows when fetching its settings. These API calls can be redirected using the INI file mapping method. The following Registry file illustrates the workaround, where all autorun.inf settings are taken solely from the HKEY_LOCAL_MACHINE\Software\DoesNotExist Registry key: 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

As this key does not exist, it is as if the autorun.inf file contains no settings information. It is important to note that this applies to any autorun.inf in any location and on any drive.

Both the policy setting and this workaround have the drawback is that installation of software from an autorunning install CD or DVD is no longer automatic. It will be necessary to view the CD's autorun.inf file and then execute the appropriate install program manually.

TweakUI

TweakUI is a user interface customisation application produced by Microsoft and is available from their website as part of the PowerToys toolset.

TweakUI has options to disable AutoRun on a drive or drive type basis under the "My Computer/AutoPlay" settings tree. The options here are given in the inverse from normal - TweakUI shows "enable" options while Group Policy and the Registry show "disable" options - and set the corresponding entries in the Registry:

  • Settings under Drives set NoDriveAutoRun
  • Settings under Types set NoDriveTypeAutoRun

However, TweakUI apparently[21] and unexpectedly sets those Registry entries under the per-user Registry hive, HKEY_CURRENT_USER, for every user on the machine. In the case of corresponding entries existing under HKEY_LOCAL_MACHINE, the settings would not be effective. The settings would not exist for users added later. TweakUI ignores any default settings. The options are not available unless TweakUI is run with Administrator privileges.

TweakUI is able to change these settings without a reboot being needed. It possibly uses SendMessage to send a setting change (WM_SETTINGCHANGE) broadcast (HWND_BROADCAST) to let Explorer know of a change in policy.[22]

Group Policy is the accepted method for correctly effecting AutoRun policy changes.


Issues and security

The AutoRun disable bug

From Windows 2000 through to Windows 2008 Server, AutoRun-relevant Registry entries were not handled properly leading to a security vulnerability.[23] Windows 95 and Windows 98 were not affected.

When AutoRun is disabled, Windows should not proceed further through the activation sequence than the Registry check. However, it parses any autorun.inf found and does everything except the final action to invoke AutoPlay or execute an application.

This leaves the user open to attack from malware which uses the autorun.inf to alter the double-click and contextual menu behaviours. Double clicking the drive icon will infect the machine. Right Clicking and selecting the "Explore" or "Open" options from the context menu is not a workaround as these menu items can be coopted by the appropriate autorun.inf entries.

This bug was fixed in a number of security updates, detailed in Microsoft Knowledge Base article 967715.[13]

Problems

  • If you add the computer to an Active Directory domain, the NoDriveTypeAutoRun value may be reset to a default value.[24] This is due to Group Policy settings in the domain taking effect. This is not a bug.
  • Some programs may deliberately change AutoRun Registry settings. Early versions of CD burning software like Roxio have been known to change settings in this way.[25]
  • If the Group Policy "Restrict CD-ROM access to locally logged-on user only" security option under:
    Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
    is turned on (Enabled), then AutoRun may not function.[25]

    Windows Installers will also malfunction because "Local System" access to the CD-ROM will be denied.[26]

    This Group Policy setting reflects the value of the Registry entry:

    HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    Entry name Data type Range Default
    allocatecdroms
    REG_SZ
    0 or 1
    0

    and should be set to 0.

  • Real Player 10 interferes with AutoPlay functionality to the extent that it may look as if AutoRun or AutoPlay is not working at all.[27][28][29]

Attack vectors

AutoRun functionality has been used as a malware vector for some time. Prior to Windows Vista, the default action with a CD-ROM drive type was to follow any autorun.inf file instructions without prompts or warnings. This makes rogue CD-ROMs one possible infection vector.

In the same category are mixed content CD-ROMs. An audio CD, that a user would not expect to contain software at all, can contain a data section with an autorun.inf. Some companies, such as Sony BMG, have used this vector to install software that attempts to protect against copying of the audio tracks.

U3 enabled flash drives, by emulating a CD-ROM unit, can also cause Windows to execute commands from the autorun.inf found on the emulated CD-ROM.

Devices like the Huawei E220 HSDPA modem, validly use this method to autoinstall drivers for the modem itself. However plugging in a flash drive from an unknown source is an unwise move. USB Switchblade, and other similar tools, have made U3 flash drive attacks trivial. Given the ease of writing script based attacks, anti-virus software may be ineffective in preventing data and password stealing.

Social Engineering: The Conficker worm in action

With a standard flash drive, social engineering attacks can be employed to entice a user to click on the appropriate item in the AutoPlay dialog. An alluring action string promising free games or pornography would lure many users into the trap. At any time, double clicking on the drive icon will use the autorun.inf automatically, a trap more advanced users could fall into.

Any user can configure AutoPlay to make various decisions for them; by checking the appropriate box in the AutoPlay dialog, running flash drive malware becomes silent and automatic.

AutoRun malware has been extended to use hard drives,[30] picture frames and other digital devices.[31] Care in dealing with external devices is a security priority.

Mitigation

  • Do not habitually run with Administrator privileges
  • Apply all relevant security patches
  • Disable AutoRun (but see the AutoRun disable bug)
  • Use Group Policy under Vista to disable autorun.inf commands
  • Use initialisation file mapping to nullify autorun.inf sections
  • Prevent autorun.inf invocation from network shares by:[13]
    1. Deleting any existing autorun.inf file from the root of a mapped network drive
    2. Denying Create rights to the root of a mapped network drive
  • Prevent the use of USB storage devices. The Registry settings to accomplish this are described in Knowledge Base article 823732.[32] Glue is an ineffective and damaging way to accomplish the same thing.


See also


References

  1. ^ a b c What's the difference between AutoPlay and AutoRun?, Microsoft, Windows Vista Help
  2. ^ How to receive notification of CD-ROM insertion or removal, Microsoft, Knowledge Base
  3. ^ Detecting media insertion or removal, Microsoft, MSDN Library
  4. ^ RegisterDeviceNotification function, Microsoft, MSDN Library
  5. ^ Creating an AutoRun-Enabled Application, Microsoft, MSDN Library
  6. ^ a b c d Enabling and Disabling AutoRun, Microsoft, MSDN Library
  7. ^ IQueryCancelAutoPlay Interface, Microsoft, MSDN Library
  8. ^ a b AutoPlay: frequently asked questions, Microsoft, Windows Vista Help
  9. ^ a b How to Test autorun.inf Files, Microsoft, Knowledge Base
  10. ^ GetDriveType Function, Microsoft, MSDN Library
  11. ^ a b How to use a registration entries file, Microsoft, Knowledge Base
  12. ^ a b Windows 2000 Registry: NoDriveTypeAutoRun, Microsoft, TechNet
  13. ^ a b c How to disable the Autorun functionality in Windows, Microsoft, Knowledge Base
  14. ^ a b Windows 2000 Registry: NoDriveAutoRun, Microsoft, TechNet
  15. ^ Windows Vista Security Guide, Chapter 3, Microsoft, TechNet
  16. ^ Group Policy Settings Reference, Windows Vista, Microsoft, Downloads, Excel Spreadsheet.
  17. ^ Windows 2000 Registry: AutoRun, Microsoft, TechNet
  18. ^ Windows 2000 Registry: AutoRunAlwaysDisable, Microsoft, TechNet
  19. ^ Windows XP Pro Resource Kit, Differences with Windows XP Home Edition, Microsoft, TechNet
  20. ^ Memory stick worms, Nick Brown's blog
  21. ^ Discussion thread on AutoPlay and TweakUI, TomsHardware.com
  22. ^ Implementing Registry-Based Group Policy for Applications, Microsoft, TechNet
  23. ^ Windows Vista fails to properly handle the NoDriveTypeAutoRun registry value, US-CERT
  24. ^ The NoDriveTypeAutoRun subkey value is reset..., Microsoft, Knowledge Base
  25. ^ a b The AutoRun feature or the AutoPlay feature does not work..., Microsoft, Knowledge Base
  26. ^ You receive an "Installation ended prematurely because...", Microsoft, Knowledge Base
  27. ^ Camera and Scanner Wizard, stopped working, Gladiator Security chat forum
  28. ^ Autoplay not working with digital camera, vista-xp chat forum
  29. ^ How to repair your camera Autoplay download, tech-archive.net chat forum
  30. ^ Chinese Trojan on Maxtor HDDs spooks Taiwan, The Register, 12 November 2007
  31. ^ Malware hitches a ride on digital devices, The Register, 11 January 2008
  32. ^ How can I prevent users from connecting to a USB storage device?, Microsoft, Knowledge Base


External links


Retrieved from "https://en.wikipedia.org/w/index.php?title=AutoRun&oldid=310883961"