News - Micrsoft disables Autorun to stop viruses in their tracks

Quote:

---

Windows Update pushes a patch to remove feature from older versions of OS.

---

Read more.

About time.

Autorun always annoys me whenever I plug a USB stick in someone else's computer. I've already loaded up the Explorer window, I really don't need some stupid popup searching for an autorun.ini file which I don't have, before asking if I wanted to open the folder or do whatever else with it. It's already open..

Yes, strikes me as being a little bit late, this one.

Seen these types of things spread around two schools in my time, one where I was a pupil and didn't care, and one where I was meant to be admin and really did care. USBs are far too vulnerable - in the days of floppy disks and CD-ROMs autorun made a lot of sense, but not now.

They only got to realise that autorun is bad in 2011? Shocking.

U3 USB sticks suddenly will become less popular :P

I've been doing this myself on any new installs/reformats I do for friends+family, as above, it's about flipping time!

I used a program called autorun eater to stop the viruses when I disinfected a stick for a client as at the time no commercial program seemed able to stop the exploit.

The variant in question also hid the files on the disk and copied the file name of one of the proper folders and named itself that with a folder icon. It also disabled the option to show hidden files.

Bit of a case of shutting the gate after the horse has bolted me thinks.

As for not seeing the viruses on optical media I think that is unlikely not to have happened. The strains I saw copied themselves into the boot sectors of every drive in the infected machine (thereby meaning windows reinstallation would not delete the viruses unless every drive was scrubbed) so not to insert itself onto any media burned would seem idiotic.

er.. original thread?

Quote:

---

The change in functionality is expected to appear in next week's Windows 7 Release Candidate, and will be implemented into Windows XP and Windows Vista via future software updates.

---

<2 years :)

I've been disabling autorun on XP desktops for years, i'm surprised its taken MS so long to patch it up properly

I think the problem is that changing the default behaviour in a manner which may break something is a big decision. Its not that they didn't realise it was a gaping sagging hole, its the fact it might break stuff.

It reminds me of DEP been turned off by default, because it might break backwards compatability.

XP SP2 broke a lot of stuff, so why they didn't do it then I don't know, prior to SP2 most bits of DCOM just worked, by that I mean had little / no security model, we're talking apple level of security here. And the barstards at MS just fixed it with little in the way of warning for most people, no list of apps that were going to be effected (this would have been trival to make a tool that would warn you). One of my first proper full time jobs was involved with fixing NT4 designed DCOM and COM+ crap, thanks to MS breaking it all because they realised security was needed.

Auto run is the most annoying thing ever. I remember using tweakUI to remove it until I found out about disabling it in the gpedit.msc

I couldn't agree more, it always happens - you plug in a flash drive/CD, open Computer and browser, then the stupid autorun dialogue pops up and steals focus.
Oh and I love your sig picture BTW! ;)