«
»

Automatic Computer Malware

According to a Security Intelligence Report from Microsoft, AutoRun—the feature in Windows that automatically executes files when you plug in a USB or connect to a network—accounts for almost half of all malware infections.  These are infections that don’t require any user-input from you, so it’s kind of not your fault that your computer gets infected. By turning off AutoRun, you’ll add an extra step to certain tasks, but it’s worth it to cut down on malware 50%.

This report states that Windows XP SP3 systems get infected about ten times as much as Windows 7 SP1 64-bit systems, and six times as much vs. 32-bit Windows 7 systems. That alone is one reason why you might want to upgrade your parents’ machines to Linux. bear in mind that Windows XP should have been mostly fixed back in February of 2011. See Microsoft Security Advisory 967940. The update does not disable auto-play for CD nor DVD media, but only USB drives, external hard drives and network shares.

The easiest way to disable AutoRun is to download a free utility like Disable AutoRun and run it, and call it a day (these apps are made specifically to turn off AutoRun). On the other hand, if you’re comfortable with editing the registry, here’s a quick guide to doing it yourself.

Removable USB/thumb drives use the Autorun feature to load files when the drives are plugged into the USB port. Malware exploits the Autorun feature to spread from thumb drive to PC. Disable the autorun feature to prevent malware from spreading.

Difficulty: Easy
Time Required: 2 minutes
Here’s How:

  1. The easiest and most effective means to truly disable autorun can be done via this simple autorun registry hack:REGEDIT4
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
    @=”@SYS:DoesNotExist”
  2. To use this method, Open Notepad and copy/paste the following into a text file:REGEDIT4
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
    @=”@SYS:DoesNotExist”Save the file as something.reg. (You have to be sure to change the “Save File as Type” to “All Files” before saving, or Windows will try to save it as a .txt even if you typed in .reg.
  3. Locate the file you just saved and double-click the file to run it. You will receive a prompt asking if you want to add the data to the registry. Click yes to allow the modification.
  4. The above method nulls any request for autorun.inf and works on XP Home or Pro, as well as Windows Vista. Credit for this tip goes to Nick Brown.If you opt to disable autorun using any other method, you will first need to install an autorun patchfrom Microsoft that allegedly resolves issues that cause autorun to run even after it’s been disabled (using methods other than the above recommended method).
  5. XP Pro users who have installed the appropriate Microsoft patch for your system and wish to disable autorun using a method other than described above, follow steps 3 through 8 only. XP Home users begin at step 9. Vista users, see How to Disable Autorun in Windows Vista.
  6. Windows XP Pro users: Click Start and then click Run. Type gpedit.msc and click OK. The Group Policy window will open. In the left pane, double-click Administrative Templates
  7. In the right pane, double-click System, scroll down the list and double-click Turn Off Autoplay
  8. In the Turn Off Autoplay Properties window, select Enabled. From the dropdown next to Turn Off Autoplay on, select All drives and then click OK. Exit Group Policy by selecting File, then choosingExit from the menu.
  9. XP Home users will need to make the changes by editing the registry directly. To begin, click Start and then click Run
  10. Type regedit and click OK. The Registry Editor window will open.
  11. In the left pane, navigate to:
    HKEY_CURRENT_USER
    Software
    Microsoft
    Windows
    CurrentVersion
    Policies
    Explorer    .
    (Note: For help navigating the registry, see the Windows Basics System Registry tutorial).
  12. With Explorer highlighted, in the right-pane right click the value NoDriveTypeAutoRun and selectModify from the drop down menu. The base value will be set to Hexadecimal. If not, select Hexadecimal.
  13. Type 95 and click OK.
    Note that this will stop Autorun on removable/USB drives, but still allow it on CD ROM drives. If you want to disable autorun on both, substitute b5 for the 95. (Thanks to Ian L. of Manitoba for the tip).
  14. Exit Registry Editor by selecting File, then choosing Exit from the menu.
  15. You will now need to reboot your computer for the changes to take effect.

 

Print Friendly

This entry was posted on Friday, December 2nd, 2011 at 05:17 by dsmith and is filed under Attack, Best Practices, Malware, Security, Trojan, Vulnerability, Windows, Windows 7, Windows Vista, Windows XP. You can follow any responses to this entry through the RSS 2.0 feed.