Technology content trusted in North America and globally since 1999
8,192 Reviews & Articles | 61,983 News Posts

US-Cert says Microsoft got fix wrong

Dissabling AutoRun not effective
By: Sean Kalinich | Posted: Jan 22, 2009 3:36 pm

Microsoft may be misleading users as to an effective method for dealing with the W32.Downadup worm that is spreading quickly around the web.


In a KB article MS explains that simply disabling AutoRun is an effective solution; US-CERT disagrees and says that this is an ineffective workaround.


AutoRun and AutoPlay are functions within Windows that allows newly attached drives and other media to play without user intervention.
This is usually down to an Autorun.inf which contains information on what to do when the disk or drive is accessed.
For example (taken from an Office 2003 CD-ROM)






The code tells the computer to run certain applications when inserted or when accessed through double clicking.


Cert has a method to properly disable AutoRun but users are still cautioned to have good malware protection.


Read more here.


US-Cert says Microsoft got fix wrong

The Autorun and NoDriveTypeAutorun registry values are both ineffective for fully disabling AutoRun capabilities on Microsoft Windows systems. Setting the Autorun registry value to 0 will not prevent newly connected devices from automatically running code specified in the Autorun.inf file. It will, however, disable Media Change Notification (MCN) messages, which may prevent Windows from detecting when a CD or DVD is changed. According to Microsoft, setting the NoDriveTypeAutorun registry value to 0xFF "disables Autoplay on all types of drives." Even with this value set, Windows may execute arbitrary code when the user clicks the icon for the device in Windows Explorer.


Related Tags

Got an opinion on this news? Post a comment below!