AutoRun

From Wikipedia, the free encyclopedia

(Redirected from Autorun)

Jump to: navigation, search

AutoRun, and its companion feature AutoPlay, are components of the
Microsoft Windows operating system that
dictate which actions the system takes when a drive is mounted.

AutoRun is a specification which was introduced in Windows 95 with AutoPlay
officially introduced in Windows XP. As developers
often used the former term and users the latter, there can be some confusion
about which term refers to what functionality.

When a CD-ROM
is inserted into a CD-ROM drive, AutoRun is the technology that starts an
install program, or plays audio content. AutoPlay is the feature that can detect
content on the CD-ROM, or indeed any removable media, and give the user options
based on the media type of files found.[1]

The terms AutoRun and AutoPlay tend to be interchangeably used when referring
to the initiating action, the one that detects and starts reading from
discovered media. This tendency is reflected in Windows Policy settings named
AutoPlay that change Windows Registry entries named AutoRun. This article will
use the term AutoRun when referring to the initiating action.

Contents

1 AutoRun

2 AutoPlay

3 AutoRun
activation

3.1 Initiation and
notification

3.2 Inf handling

3.2.1 Before
AutoPlay

3.2.2 Introducing
AutoPlay

3.3 The AutoPlay safety
net

4 Registry and Group
Policy

4.1 Drive types

4.2 Registry
terminology

4.3 Changing Registry
settings

4.4 NoDriveTypeAutoRun

4.5 NoDriveAutoRun

4.6 Evaluation
order

4.7 Group Policy

4.7.1 Windows Server
2003, Windows XP, and Windows 2000

4.7.2 Windows Vista,
Windows Server 2008

5 Altering AutoRun
behaviour

5.1 Pressing the Shift
key

5.2 Auto Insert
Notification

5.3 Editing Group
Policy

5.4 TweakUI

5.5 Registry
files

6 Issues and
workarounds

6.1 The AutoRun disable
bug

6.2 Workarounds for the
AutoRun bug

6.2.1 Initialisation file
mapping

6.3 MountPoints2

6.4 Other issues

7 Attack vectors

8 The autorun.inf
file

8.1 Sample
autorun.inf

8.2 [autorun]

8.3 [Content]

8.4 [ExclusiveContentPaths]

8.5 [IgnoreContentPaths]

8.6 [DeviceInstall]

9 References

10 External links

[edit]
AutoRun

AutoRun, a feature of Windows Explorer
(actually the shell32 dll) introduced in
Windows 95, enables media and devices to launch programs by use of commands
listed in a file called autorun.inf, stored in the root
directory of the medium.

Primarily used on install CD-ROMs, the applications called are usually
application installers. The autorun.inf file can also specify an icon which will
represent the device visually in Explorer along with other advanced
features.[1]

[edit]
AutoPlay

AutoPlay in Windows
Vista

AutoPlay is a feature
introduced in Windows XP which examines removable media and devices and, based
on content such as pictures, music or video files, launches an appropriate
application to play or display the content.[1]
If available, settings in an autorun.inf file can add to the options presented
to the user.

AutoPlay is based on a set of handler applications registered with the
AutoPlay system. Each media type (Pictures, Music, Video) can have a set of
registered handlers which can deal with playing or display that type of
media.

Each hardware device can have a default action occurring on discovery of a
particular media type, or the AutoPlay dialog can prompt the user what action to
take.

[edit]
AutoRun activation

The AutoRun sequence consists of the initial discovery of a new device or new
piece of media. Following this, notification of interested parties occurs, of
which the Windows Explorer shell is of primary interest.

After checking Registry settings to
see can AutoRun proceed, parsing of an optional autorun.inf
occurs and any necessary actions are taken.

The initial sequence is handled much the same in every version of Windows
from Windows 95. However, the way the autorun.inf file is read and acted upon
and the level of integration of AutoRun with AutoPlay has changed significantly
from the time AutoPlay was introduced in Windows XP until the present handling
in Windows Vista.

[edit]
Initiation and notification

When a device with AutoRun-compatible drivers receives new media, a "Media
Change Notification" event occurs. The Windows OS then notifies
interested applications that a device change has occurred. The notification
method used can change depending on the device type.

If the device changed is a volume (like a CD) or a port (like a serial port)
Windows broadcasts a WM_DEVICECHANGE notification to all top level
windows.[2][3]
Windows terms this a "basic" notification. A top level window is one which is a
descendant of the desktop.

However, if the device changed is not one of these types an application can
use the RegisterDeviceNotification[4]
function to register to receive device notifications.

An article on the CodeProject website, "Detecting Hardware Insertion and/or Removal", with clarifications from a blog by Doran Holan is of
particular technical interest here.

When Explorer receives notification of a volume change, it performs a number
of actions:[5][6]

checks to see if AutoRun has been disabled through the Registry. If
AutoRun is disabled for that drive or drive type, Explorer does not proceed
further. However, there have been bugs
in this area.

checks that the root directory of the inserted media contains a file
called autorun.inf and if so, reads and parses it. However, see below for an
exception.

sends a QueryCancelAutoPlay message to the foreground window. An
application which has registered its interest in receiving this message using
RegisterWindowMessage can respond to this message to suppress
AutoRun. Any application, foreground or not, can also be notified by using the
IQueryCancelAutoPlay COM
interface[7]
available in Windows XP and later.

Alters double-click and
contextual menu behaviours. When a user double clicks on the drive icon in
Explorer or right clicks to get a context menu, what
happens is fully programmable by settings in the autorun.inf file.

Adds an autorun.inf controllable icon and descriptive text to the drive
icon.

Checks to see if the Shift key is held
down. If it is then Windows Vista will invoke AutoPlay regardless of
settings.[8]
Previous versions of Windows will not continue with the process.[6]

Finally, if shift is not held down, either:

executes an application on instructions from the open or
shellexecute keys optionally present in an autorun.inf's [autorun]
section.

invokes AutoPlay.

Which choice is made depends on the version of
Windows in use, instructions from the autorun.inf if available and the type of
the media discovered. See the next section on inf handling for details.

[edit]
Inf handling

[edit]
Before AutoPlay

On Windows versions prior to Windows XP, an autorun.inf on any drive type
will be parsed and instructions from open or
shellexecute followed immediately and silently.[9]
This includes DRIVE_REMOVABLE, DRIVE_FIXED and DRIVE_REMOTE drive types.

AutoRun will work with network drives (the DRIVE_REMOTE drive type) that are
mapped to a drive letter. AutoRun will also work with floppy drives that are
provided with autorun-compatible drivers.[6]

The default Registry settings on Windows versions previous to Windows XP (See
NoDriveTypeAutoRun),
disable Remote and Removable drives from AutoRun initiation, leaving Fixed and
CDROM drive types active by default.

[edit]
Introducing AutoPlay

With the introduction of AutoPlay in Windows XP, the final stage action
(stage 7 above) for some drive types changed from executing an application to
invoking AutoPlay. In Windows Vista, the AutoPlay system is integrated into
every aspect of media handling and there is no automatic execution of any
autorun.inf open or shellexecute instructions.

The default Registry settings added Removable drives to those that initiated
AutoRun. From XP onwards, only Unknown and Network drive types are not active
for AutoRun.

Under Windows XP, autorun.inf support was removed for DRIVE_REMOVABLE drive
types.[5]
Any discovered removable media would be handled by invoking AutoPlay. Note that
drives of type DRIVE_FIXED would parse and execute autorun.inf as before.[10]

Windows XP Service Pack 2 reintroduced autorun.inf support for Removable
drives[10]
but handled the open and shellexecute features as a
display item within the AutoPlay dialog (See the action key in the
[autorun]
section).

This handling also now applied to Fixed drive types, an important change in
functionality from previous Windows versions.

For drives of type DRIVE_CDROM, Windows XP uses an autorun.inf if one is
available, otherwise AutoPlay is invoked. In Windows Vista, a CD-ROM with an
autorun.inf simply adds another option to the AutoPlay dialog list.

[edit]
The AutoPlay safety net

It would appear that AutoPlay, by transferring control of what were
previously automatic and invisible actions to AutoPlay, acts to increase user
control and safety. This applies especially under Windows Vista, where all media
and devices fall under AutoPlay control.

However it is important to note that:

a user can instruct AutoPlay to make the autorun.inf choice for them,
indeed any choices for them, and bypass any AutoPlay dialog prompting.

When a user double clicks on the drive icon in Explorer or right clicks to
get a context menu, what happens next is fully programmable by the autorun.inf
file and is essentially outside AutoPlay's purview. This is true under any
Windows operating system.

disabling AutoRun under Vista may force a user to double click the drive
icon to get a contents list thus actually increasing the chance of malware
infiltration.

[edit]
Registry and Group Policy

AutoRun consults Windows Registry values
to decides whether to initiate actions for any particular drive or drive type.
These values can be changed using several methods, one of which is using Group Policy.

The primary relevant Registry entry names are NoDriveTypeAutoRun and
NoDriveAutoRun. These exist in both per-machine and per-user settings
and their location and priority in the Registry are described in further detail
below.

[edit]
Drive types

The drive types are distinguished by Type Name as follows:[11]

Type name

Description

DRIVE_UNKNOWN

The drive type cannot be determined

DRIVE_REMOVABLE

The drive has removable media (floppy drive, USB flash
drive)

DRIVE_FIXED

The disk cannot be removed from the drive (hard disk)

DRIVE_REMOTE

The drive is a remote (network) drive

DRIVE_CDROM

The drive is a CD-ROM or DVD-ROM drive

DRIVE_RAMDISK

The drive is a RAM
disk

[edit]
Registry terminology

The Windows Registry is a directory which stores settings and options for the
operating system. The terminology is somewhat misleading so it is briefly
summarised here.

A Registry key is similar to a folder that, in addition to values,
each key can contain subkeys which in turn may contain subkeys, and so on.

A Registry value consists of a name-data pair. Microsoft documentation
commonly uses the term "entry" as an equivalent term. It also uses "value" for
"data" when it is obvious what is meant. To avoid confusion, this article always
uses the term "entry" when referring to the name-data pair.

Two Registry keys that are very commonly referred to are
HKEY_LOCAL_MACHINE which contains per-machine settings, and
HKEY_CURRENT_USER which contains settings for the currently logged-on
user. These are almost always abbreviated as HKLM and HKCU
respectively. There may be many users of a machine; their settings are stored in
HKEY_USERS, HKCU is actually just a link to the appropriate
place in HKEY_USERS.

[edit]
Changing Registry settings

Registry settings may be changed directly by using the GUI regedit
tool or the command line reg.exe utility. Settings can also be placed
in a text
file[12],
named with a .reg extension type. For example, "mychanges.reg". When
the file is double clicked, the settings in the file are entered into the
Registry, permissions allowing.

They can be changed indirectly by using Group Policy, applied locally to a
single computer with GPEdit.msc or to a domain with
gpmc.msc.

It may be necessary to either logout or restart the computer in order for any
Registry changes to take effect.

[edit]
NoDriveTypeAutoRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Entry name

Data type

Range

Default

NoDriveTypeAutoRun

REG_DWORD

0x0 to 0xFF

0x95 or 0x91

This Registry entry disables or enables the AutoRun feature on all drives of
the type specified.[13]
It reflects the setting of the relevant Autoplay Group Policy. Valid data ranges
from 0x00 to 0xFF in hexadecimal notation. If the
entry is not present, the default data value is either 0x95 or 0x91 depending on
the version of Windows used.

The entry data is a bitmapped value, where a bit set to 1 disables AutoRun on
a particular type of drive. The bit settings for each type of drive are shown
below:

Note that bit number 1 is unused and that the "Unknown" type is represented
twice. Setting all bits to 1 would give a hexadecimal value of 0xFF, decimal
255, and would disable AutoRun on all types of drives.

The default setting for this entry depends on the version of Windows being
used:[14][9]

Operating system

Default setting

Microsoft Windows Vista

0x91

Microsoft Windows Server 2003

0x95

Microsoft Windows XP

0x91

Microsoft Windows 2000

0x95

Microsoft Windows 95/98

0x95

Versions of Windows before Windows XP, including Windows 2000 and Windows
Server 2003 use the value 0x95. This disables AutoRun on Unknown, Network and
Removable drives.

Windows XP and later use the value 0x91, which disables AutoRun on Unknown
and Network drives. Removable drives are now enabled, reflecting the added
AutoPlay feature in Windows XP.

AutoRun is, by default, enabled for CD and DVD, Fixed and RAM drives on all
versions of Windows from Windows 95.

[edit]
NoDriveAutoRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Entry name

Data type

Range

Default

NoDriveAutoRun

REG_DWORD

0x0 to 0x3FFFFFF

0x0

This Registry entry disables or enables the AutoRun feature on individual
drives.[15]
It is not associated with a Group Policy and does not exist by default. The data
value is taken to be 0 if the entry is not present.

The data is a 32 bit (DWORD) bitmapped value, of which the lower 26 bits are
used to represent each of the 26 drive letters from A to Z. Thus the valid data
range is from 0x0 to 0x3FFFFFFF. The least significant bit (the right most bit)
represents drive A, and the 26th bit from the right represents drive Z.

A bit set to 1 disables AutoRun on a particular drive. For example, if the
data value is set to 0x8 (1000 binary), AutoRun is disabled on drive D.

[edit]
Evaluation order

The NoDriveAutoRun and NoDriveTypeAutoRun Registry entries
can exist in two places, the per-user setting (under HKEY_CURRENT_USER) and the
per-machine setting (under HKEY_LOCAL_MACHINE). If an entry appears under
HKEY_LOCAL_MACHINE, then any corresponding entry under HKEY_CURRENT_USER is
completely ignored. The data values are not merged in any way.

When deciding whether to activate AutoRun, both NoDriveAutoRun and
NoDriveTypeAutoRun Registry entries are consulted. If either value
indicates a drive should be disabled then AutoRun is disabled for that
drive.

Thus in the following example:

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

NoDriveAutoRun

NoDriveTypeAutoRun

NoDriveAutoRun

NoDriveTypeAutoRun

0x08

(Not Present)

0x3FFFFFFF

0x95

the data value taken for NoDriveAutoRun is 0x08, disabling drive D
and the data value taken for NoDriveTypeAutoRun is 0x95, disabling
removable and network drives. The per-user NoDriveAutoRun entry is
never used.

[edit]
Group Policy

The Group Policy settings dialog

The only Group Policy settings available for AutoRun affect the
NoDriveTypeAutoRun Registry entries. The policy is available on either
a per-machine or a per-user basis refecting the Registry entry location in
either HKLM or HKCU.[13][15]

As described above, a
per-machine policy setting will cause the per-user policy setting to be
ignored.

When a policy is Enabled, Group Policy will add the
NoDriveTypeAutoRun entry to the Registry. If the policy is
Disabled or set to Not configured, Group Policy deletes this entry
from the Registry. System defaults may then take effect as described in the NoDriveTypeAutoRun
section.

The policy names, locations and possible settings vary slightly between
Windows versions. The list of settings are relatively short and are always
additional to the system default setting.

Therefore, on Windows 2000, enabling the "Disable Autoplay" policy and
setting it to "CD-ROM drives", disables AutoRun (as distinct from AutoPlay) for
CD-ROM and DVD drives, removable drives, network drives, and drives of unknown
type.

This setting cannot be used to enable AutoRun on drives on which it is
disabled by default or disable AutoRun for drives not listed. To disable or
enable any particular drives or drive types, the Registry must be edited
manually.

[edit]
Windows Server 2003, Windows XP, and Windows
2000

The per-machine policy location is:

Computer Configuration \ Administrative Templates \ System

The per-user policy location is:

User Configuration \ Administrative Templates \ System

The relevant policy is "Turn off Autoplay". In Windows 2000 the policy is
called "Disable Autoplay" instead.

Once the policy is Enabled it can be set to "All drives" or "CD-ROM drives".
The latter setting adds CD-ROM drives to the existing list of disabled drive
types as described above.

[edit]
Windows Vista, Windows Server 2008

The per-machine policy location is:[16]

Computer Configuration \ Administrative Templates \ Windows Components \
Autoplay Policies

The per-user policy location is:

User Configuration \ Administrative Templates \ Windows Components \
AutoPlay Policies

The relevant policy is "Turn off Autoplay" and can be set for CD-ROM, DVD-ROM
and removable drives or all drives.

Two related policies were added in Vista and Server 2008:[17]

Default behavior for AutoRun

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Entry name

Data type

Range

Default

NoAutoRun

REG_DWORD

Sets the default behavior for AutoRun commands found in autorun.inf
files.

Prior to Windows Vista, when media containing an autorun.inf with
open or shellexecute commands was inserted, the
default action was to automatically execute the program without user
intervention.

The default behaviour in Windows Vista is to invoke AutoPlay. The autorun.inf
command is then represented as one of the dialog options. This is the behaviour
when the policy is Not configured or Disabled.

If this policy is Enabled, the behaviour can be changed to either:

Completely disable autorun.inf commands or

Automatically execute the autorun.inf command as per previous Windows
versions.

Don't set the always do this checkbox

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Entry name

Data type

Range

Default

DontSetAutoplayCheckbox

REG_DWORD

If this policy is Enabled, the "Always do this..." checkbox in the AutoPlay
dialog will not be set by default when the dialog is shown.

[edit]
Altering AutoRun behaviour

[edit]
Pressing the Shift key

If the Shift
key is held down at a certain point in the execution sequence Windows Vista
executes AutoPlay regardless of any settings.[8]
Previous versions of Windows do not execute anything.[6]

Given that Shift must be held down until Windows checks for it, it may be a
considerable amount of time before it becomes effective. The time taken
primarily depends on the time to recognise the new hardware and time taken for
CD-ROMs to spin up.

[edit]
Auto Insert Notification

Certain "Media Change Notification" events may be suppressed by altering
certain Registry entries. "Media Change Notification" is the generic term; for
CD-ROM drives, the specific term is "Auto Insert Notification".

HKLM\SYSTEM\CurrentControlSet\Services\Cdrom

Entry name

Data type

Range

Default

AutoRun

REG_DWORD

0 or 1

1

For CD-ROM drives, changing the value of this Registry entry to 0, will
disable Auto Insert Notification for CD-ROM drives only.[18]
A Windows restart will be necessary.

Data value

Meaning

0

Does not send an MCN message

1

Sends an MCN message

Under Windows 95/98/ME, this setting can be changed under Device Manager,
accessible from the System icon in Control Panel.

Auto insert notification under Windows 98

Although the Registry entry is named "AutoRun", it only suppresses the MCN
message. The MCN message does trigger AutoRun initiation but it also instructs
the Explorer shell to update its views and contents.

Thus, as a side effect only, this disables AutoRun for CD-ROM drives.
However, Explorer will now not update its view when a new CD is inserted; it
will show the contents of the previous CD until F5
is pressed or View/Refresh is selected from the Explorer menu. This could result
in severe confusion for users.

For this reason the Media Change Notification message should not be disabled
unless there is absolutely no alternative; AutoRun can be disabled for
individual drives using TweakUI, Group Policy or the Registry.

HKLM\SYSTEM\CurrentControlSet\Services\Cdrom

Entry name

Data type

AutoRunAlwaysDisable

REG_MULTI_SZ

This entry is used to suppress the MCN message for specifically listed type
of CD-ROM drive,[19]
primarily CD-ROM changers. The data is a set of device identifiers, which
matches those identifiers reported to the system by the devices themselves.

The default value for this entry consists of products identified by Microsoft
testing as being unable to support AutoRun. This entry should not be altered
from its default.

[edit]
Editing Group Policy

AutoRun may be suppressed on particular drives and drive types by using Group
Policy as described in the section on the Registry
and Group Policy. However, the Group Policy Editor is not available on Home
versions of Windows XP[20]
and does not provide any fine-grained drive selection facilities.

However, Group Policy would be the accepted method of disabling AutoRun on an
entire Windows domain.

[edit]
TweakUI

TweakUI AutoPlay Types

TweakUI is a user interface
customisation application produced by Microsoft and is available from their
website as part of the PowerToys toolset.

TweakUI has options to disable AutoRun on a drive or drive type basis under
the "My Computer/AutoPlay" settings tree. The options here are given in the
inverse from normal - TweakUI shows "enable" options while Group Policy and the
Registry show "disable" options - and set the corresponding entries in the
Registry:

Settings under Drives set NoDriveAutoRun

Settings under Types set NoDriveTypeAutoRun

TweakUI AutoPlay Drives

However, TweakUI apparently[21]
sets those Registry entries under the per-user Registry hive, HKEY_CURRENT_USER.
In the case of corresponding entries existing under HKEY_LOCAL_MACHINE, the
settings would not be effective.

TweakUI is able to change these settings without a reboot being needed. It
possibly uses SendMessage to send a setting change (WM_SETTINGCHANGE)
broadcast (HWND_BROADCAST) to let Explorer know of a change in policy.[22]

[edit]
Registry files

A Registry setting file can be created that, when executed, makes the desired
changes in the Registry.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

Note that the example ends with a blank line. This is not
optional.[12]

If the above snippet is saved as a file with a .reg extension, for example
"killautorun.reg", and then the file icon double-clicked, the setting
will be entered into the Registry, permissions allowing. In the above example,
AutoRun would be disabled for all drives and for all users. This example would
need to be run as Administrator and a reboot would be needed for the setting to
take complete effect.

See the section on the Registry
and Group Policy for details on the relevant Registry entries.

[edit]
Issues and workarounds

[edit]
The AutoRun disable bug

There has been a long standing issue with Windows failing to handle
AutoRun-relevant Registry entries properly.[23]

When AutoRun is disabled Windows should not proceed further through the activation
sequence than the Registry check. However, it parses any autorun.inf found and
does everything except the final action to invoke AutoPlay or execute an
application.

This leaves the user open to attack from malware which uses the autorun.inf
to alter the double-click and contextual menu behaviours. Double clicking the
drive icon will infect the machine. Right Clicking and selecting the "Explore"
or "Open" options from the context menu is not a workaround as these menu items
can be coopted by the appropriate autorun.inf entries.

This bug has been fixed in security updates issued in July 2008. For Windows
Vista and Windows Server 2008 the relevant Knowledge Base Article is
950582[24]
with further details in the security bulletin itself.[25]

For Windows XP, Windows Server 2003 and Windows 2000 the relevant Knowledge
Base Article is 953252[26]
with details and links to the OS specific patches available from that page.
Windows 95 and Windows 98 are not affected.

These are fixes which address the Double Click, Contextual Menu and AutoPlay
functionality.

These patches also allows reverting to the previous functionality on a
per-user and per-machine basis by changing a Registry entry:[26]

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Entry name

Data type

Range

Default

HonorAutorunSetting

REG_DWORD

0 or 1

1

When you install the security update, this Registry entry is created only in
the HKEY_LOCAL_MACHINE Registry hive with a default value of 1. This enables the
functionality for this update, and for all users.

Setting the Registry entry data to 0 results in the previous insecure
behaviour. If the key is present in both HKEY_CURRENT_USER and
HKEY_LOCAL_MACHINE, the HKLM value is used and the HKCU is ignored.

[edit]
Workarounds for the AutoRun bug

In the case that the patches referred to above cannot be applied, there are
several workarounds available. Two are documented by Microsoft:[26]

Disabling the use of USB devices described in Knowledge Base Article
823732[27]

Preventing autorun.inf invocation from network shares by following these
steps:

Delete any existing autorun.inf file from the root of a mapped network
drive.

Do not give anyone Create rights to the root of a mapped network drive.

[edit]
Initialisation file mapping

The other workaround involves using initialisation file
mapping to create a mapping between the autorun.inf initialisation file and the
Registry. This procedure relies on the fact that an autorun.inf file is a
standard Windows INI file and so the appropriate API calls are used by Windows when
fetching its settings. These API calls can be redirected using the INI file
mapping method.

This method was first mentioned in Nick Brown's blog[28]
and is also referred to in the US-CERT Vulnerability Note.[23]

Create a subkey called autorun.inf under the
HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping
key. Change the (Default) entry under the new autorun.inf key to the
string @SYS:DoesNotExist:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\IniFileMapping\autorun.inf

Entry name

Data type

Value

(Default)

REG_SZ

@SYS:DoesNotExist

The (Default) Registry entry name is also called (NULL) or, in a
Registry file, "@"

Alternatively, create a Registry file
with the following contents to make the change:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Now whenever Windows tries to read a file called "autorun.inf" using
the INI programming calls, it is forbidden from reading from the actual file.
Instead, all settings are read from the
HKEY_LOCAL_MACHINE\Software\DoesNotExist Registry key. As this key does
not exist, it is as if the autorun.inf file contains no settings information.
This applies to any autorun.inf in any location and on any drive.

The only drawback is that installation of software from an autorunning
install CD or DVD is no longer automatic. It will be necessary to view the CD's
autorun.inf file and then execute the appropriate install program manually.

[edit]
MountPoints2

There are a number of websites that assert that a certain Registry key,
MountPoints2, contains cached information about every memory stick or
other removable device seen so far. The key can be found under the Registry
key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer

It is deemed possible that it overrides the NoDriveTypeAutoRun entry
when a device the PC already knows about is inserted.

It is currently unknown whether the AutoRun Bug patch fixes any issues with
this key. There is no Microsoft documentation available on this Registry
entry.

[edit]
Other issues

If you add the computer to an Active Directory domain, the
NoDriveTypeAutoRun value may be reset to a default value.[14]
This is due to Group Policy settings in the domain taking effect. This is not
a bug.

Some programs may deliberately change AutoRun Registry settings. Early
versions of CD burning software like Roxio have been known to change settings
in this way.[29]

If the Group Policy "Restrict CD-ROM access to locally logged-on user only"
security option under:

Computer Configuration\Windows Settings\Security Settings\Local
Policies\Security Options

is turned on (Enabled), then AutoRun may not function.[29]

Windows Installers will also malfunction because "Local System" access to
the CD-ROM will be denied.[30]

This Group Policy setting reflects the value of the Registry entry:

HKLM\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon

Entry name

Data type

Range

Default

allocatecdroms

REG_SZ

0 or 1

0

and should be set to 0.

Real Player 10 interferes with AutoPlay functionality to the extent that
it may look as if AutoRun or AutoPlay is not working at all.[31][32][33]

[edit]
Attack vectors

AutoRun functionality has been used as a malware vector for some time. Prior
to Windows Vista, the default action with a CD-ROM drive type was to follow any
autorun.inf file instructions without prompts or warnings. This makes rogue
CD-ROMs one possible infection vector.

In the same category are mixed content CD-ROMs. An audio CD, that a user
would not expect to contain software at all, can contain a data section with an
autorun.inf. Some companies
have used this vector to install software that attempts to protect against
copying of the audio tracks.

U3 enabled flash
drives, by emulating a CD-ROM unit, can
also cause Windows to execute commands from the autorun.inf found on the
emulated CD-ROM.

Devices like the Huawei E220 HSDPA modem,
validly use this method to autoinstall drivers for the modem itself. However
plugging in a flash drive from an unknown source is an unwise move. USB
Switchblade, and other similar tools, have made U3 flash drive attacks
trivial. Given the ease of writing script based attacks,
anti-virus software may be ineffective in preventing data and password
stealing.

Social Engineering: The Conficker worm in
action

With a standard flash drive, social engineering attacks can be employed to
entice a user to click on the appropriate item in the AutoPlay dialog. An
alluring action string
promising free games or pornography would lure many users into the trap. At any
time, double clicking on the drive icon will use the autorun.inf automatically,
a trap more advanced users could fall into.

Any user can configure AutoPlay to make various decisions for them; by
checking the appropriate box in the AutoPlay dialog, running flash drive malware
becomes silent and automatic.

AutoRun malware has been extended to use hard drives,[34]
picture frames and other digital devices.[35]
Care in dealing with external devices is a security priority.

Mitigation of malware attacks:

Do not habitually run with Administrator privileges

Disable AutoRun (but see the AutoRun
disable bug)

Use Group Policy under Vista to disable autorun.inf commands

Use initialisation
file mapping to nullify autorun.inf sections

[edit]
The autorun.inf file

autorun.inf is an ascii text file located in the root folder of a
CD-ROM or other removable media. The structure is that of a classic Windows .ini file,
containing information and commands as "key=value" pairs, grouped into
sections.[5]
These keys specify:

The name and the location of a program to call when the media is inserted.

The name of a file that contains an icon that represents the media in
Explorer (instead of the standard drive icon).

Commands for the menu that appears when the user right-clicks the drive
icon.

The default command that runs when the user double-clicks the drive icon.

Settings that alter AutoPlay detection routines or search parameters

Settings that indicate the presence of drivers.

On Windows XP versions previous to Service Pack 2, drives of type
DRIVE_REMOVABLE do not have any autorun.inf support.[5]

From Service Pack 2, removable drives may have an autorun.inf file recognised
and used by including an action key. The text from this key may be
combined with an icon given by the icon key and this will be used
in the AutoPlay dialog presented to the user.[10]

Following are the sections and keys allowed in a valid autorun.inf.[10]
There also exist architecture specific section types for systems such as Windows
NT 4 running on RISC. This are outdated and not described here.

[edit]
Sample autorun.inf

This simple autorun.inf file specifies setup.exe as the application
to run when AutoRun is activated. The first icon stored within the setup.exe
itself will represent the drive in Explorer:

[autorun]
open=setup.exe
icon=setup.exe,0
label=My install CD

[edit]
[autorun]

The autorun section contains the default AutoRun commands. Valid
autorun.inf files must contain this section. Keys allowed are:

action=text
action=@[filepath\]filename,-resourceID

Windows XP SP2 or later; drives of type DRIVE_REMOVABLE and
DRIVE_FIXED

Specifies text used in the AutoPlay dialog to represent the program
specified in the open or shellexecute keys. The text
is expressed as either text or as a resource reference. The icon
is displayed next to the text. This item is always first in the AutoPlay
dialog and is always selected by default.

If the (action) key does not appear on drives of type:

DRIVE_REMOVABLE

the AutoPlay dialog appears but without additional menu items.
Essentially, the autorun.inf is ignored. This makes the action key
mandatory for drives of this type.

DRIVE_FIXED

default text is created and used in the AutoPlay
dialog.

On all other drive types the key is ignored.

icon=iconfilename[,index]

The name of an file resource containing an icon. This icon replaces the
standard drive icon in Windows Explorer. This file must be in the same
directory as the file specified by the open key.

label=text

Specifies a text label representing the drive in Windows Explorer.

open=[exepath\]exefile [param1 [param2] ...]

Specifies the path, file name and optional parameters to the application
that AutoRun launches when a user inserts a disc in the drive. It is the
CreateProcess function that is called by AutoRun.

shellexecute=[filepath\]filename[param1, [param2]...]

Windows 2000, Windows ME or later

Similar to open, but using file association information to run the
application. The file name can therefore be an executable or a data file. It
is the ShellExecuteEx function that is called by AutoRun.

UseAutoPlay=1

Windows XP or later; drives of type DRIVE_CDROM

Use AutoPlay rather than AutoRun with CD-ROMs. The action taken on CD-ROM
insertion will depend on the version of Windows being used.

On versions of Windows earlier than XP, this key has no effect and actions
specified by open or shellexecute are performed.

On Windows XP and later, the user will be presented with the AutoPlay
dialog and any actions specified by open or
shellexecute are ignored.

shell\verb\command=[exepath\]exefile [param1 [param2]
...]

Adds a custom command to the drive's shortcut menu. verb is a
string with no embedded spaces. verb is also the text that will appear
in the shortcut menu unless specifically altered to some other text. See below
for an example.

shell\verb=MenuText

Optionally specify the text displayed in the shortcut menu for the
verb above. Use an ampersand (&) to select a hotkey for the menu.
See below for an example.

shell=verb

Defines the menu command referred to by shell\verb as
the default command in the shortcut menu. The default command is the command
executed when the drive icon is double-clicked. If missing, the default menu
item will be "AutoPlay", which launches the application specified by the
open entry.

Example:

shell\readme\command=notepad readme.txt
shell\readme=Read &Me
shell=readme

[edit]
[Content]

Windows Vista or later

The Content section allows authors to communicate the type and
intent of content to Autoplay without AutoPlay having to examine the media.

Valid keys are: MusicFiles, PictureFiles,
VideoFiles. Each key can be set to indicate true or false values
and values are not case sensitive.

true

(or 1, y, yes, t)

:

display the handlers associated with that content type

false

(or 0, n, no, f)

:

do not display the handlers associated with that content
type

Example:

[Content]
MusicFiles=Y
PictureFiles=0
VideoFiles=false

[edit]
[ExclusiveContentPaths]

Windows Vista or later

Limits AutoPlay's content search to only those folders listed, and their
subfolders. The folder names are always taken as absolute paths (a path from the
root directory of the media) whether or not a leading slash is used.

Example:

[ExclusiveContentPaths]
\pictures
\music
more music\special

[edit]
[IgnoreContentPaths]

Windows Vista or later

AutoPlay's content search system will not scan the folders listed, nor their
subfolders. IgnoreContentPaths takes precedence over
ExclusiveContentPaths so if a path given in a [IgnoreContentPaths]
section is a subfolder of a path given in an [ExclusiveContentPaths] section it
is still ignored.

[edit]
[DeviceInstall]

Windows XP or later

This section is used to indicate where driver files may be located. This
prevents a lengthy search through the entire contents of a CD-ROM. Windows XP
will fully search:

floppy disks in drives A or B

CD/DVD media less than 1 GB in size.

without this section present. All other media should include this section to
have Windows XP autodetect any drivers stored on that media.

The section is not used with AutoRun or AutoPlay and is only referred to
during a driver installation phase. The only valid key is:

DriverPath=directorypath

which lists a path Windows will search for driver files. All subdirectories
of that path are also searched. Multiple key entries are allowed.

If no DriverPath entry is provided in the
[DeviceInstall] section or the DriverPath entry has no
value, then that drive is skipped during a search for driver files.

Example:

[DeviceInstall]
DriverPath=drivers\video
DriverPath=drivers\audio

[edit]
References

^ a
b
c
What's the difference between AutoPlay and AutoRun?,
Microsoft, Windows Vista Help

^ How to receive
notification of CD-ROM insertion or removal, Microsoft, Knowledge
Base

^ Detecting media insertion or removal, Microsoft, MSDN
Library

^ RegisterDeviceNotification function, Microsoft, MSDN
Library

^ a
b
c
d
Creating an AutoRun-Enabled Application, Microsoft, MSDN
Library

^ a
b
c
d
Enabling and Disabling AutoRun, Microsoft, MSDN
Library

^ IQueryCancelAutoPlay Interface, Microsoft, MSDN
Library

^ a
b
AutoPlay: frequently asked questions, Microsoft, Windows
Vista Help

^ a
b
How to Test
autorun.inf Files, Microsoft, Knowledge Base

^ a
b
c
d
Autorun.inf Entries, Microsoft, MSDN Library

^ GetDriveType Function, Microsoft, MSDN Library

^ a
b
How to use a
registration entries file, Microsoft, Knowledge Base

^ a
b
Windows 2000 Registry: NoDriveTypeAutoRun, Microsoft, TechNet

^ a
b
The
NoDriveTypeAutoRun subkey value is reset..., Microsoft, Knowledge
Base

^ a
b
Windows 2000 Registry: NoDriveAutoRun, Microsoft,
TechNet

^ Windows Vista Security Guide, Chapter 3, Microsoft,
TechNet

^ Group Policy Settings Reference, Windows Vista, Microsoft,
Downloads, Excel Spreadsheet.

^ Windows 2000 Registry: AutoRun, Microsoft, TechNet

^ Windows 2000 Registry: AutoRunAlwaysDisable, Microsoft,
TechNet

^ Windows XP Pro Resource Kit, Differences with Windows XP Home
Edition, Microsoft, TechNet

^ Discussion thread on AutoPlay and TweakUI,
TomsHardware.com

^ Implementing Registry-Based Group Policy for Applications,
Microsoft, TechNet

^ a
b
Windows Vista fails
to properly handle the NoDriveTypeAutoRun registry value, US-CERT

^ Vulnerability in
Windows Explorer could allow remote code execution, Microsoft,
Knowledge Base

^ Vulnerability in Windows Explorer Could Allow Remote Code
Execution, Microsoft, TechNet

^ a
b
c
How to correct
"disable Autorun registry key" enforcement..., Microsoft, Knowledge
Base

^ How to disable the
use of USB storage devices, Microsoft, Knowledge Base

^ Memory stick worms, Nick Brown's blog

^ a
b
The AutoRun feature
or the AutoPlay feature does not work..., Microsoft, Knowledge Base

^ You receive an
"Installation ended prematurely because...", Microsoft, Knowledge
Base

^ Camera and Scanner Wizard, stopped working, Gladiator
Security chat forum

^ Autoplay not working with digital camera, vista-xp chat
forum

^ How to repair your camera Autoplay download,
tech-archive.net chat forum

^ Chinese Trojan on Maxtor HDDs spooks Taiwan, The
Register, 12 November 2007

^ Malware hitches a ride on digital devices, The
Register, 11 January 2008

[edit]
External links

AutoRun and AutoPlay Reference, Microsoft, MSDN
Library

Memory stick worms, Nick Brown's blog

Dan McCloy's Autorun
Reference Guide

Security Watch Island Hopping: The Infectious Allure of Vendor
Swag, TechNet Magazine

Figure 4:
querycancelautoplay example code, Microsoft Systems Journal,
September 1998

AutoPlay Repair Wizard, Microsoft Download Center

v • d • e

Windows
components

Core

Aero ·
AutoRun · ClearType ·
Desktop
Window Manager · DirectX ·
Explorer ·
Taskbar ·
Start
menu · Shell (namespace ·
Special
Folders · File
associations) · Search (Saved
search · iFilters) ·
Graphics
Device Interface · Imaging
Format · .NET
Framework · Server
Message Block  · XML
Paper Specification · Active
Scripting (WSH ·
VBScript ·
JScript) ·
COM
(OLE ·
OLE
Automation · DCOM ·
ActiveX ·
ActiveX
Document · Structured
storage · Transaction
Server) · Previous
Versions · Win32
console

Management
tools

Backup
and Restore Center · command.com ·
cmd.exe ·
Control
Panel (Applets) ·
Device
Manager · Disk
Cleanup · Disk
Defragmenter · Driver
Verifier · Event
Viewer · Management
Console · Netsh ·
Problem
Reports and Solutions · Sysprep ·
System
Configuration · Task
Manager · System File
Checker · System
Restore · Windows
Installer · PowerShell ·
Windows
Update · WinSAT ·
Windows
Easy Transfer · System
Policy Editor

Applications

Calculator ·
Calendar ·
Character
Map · Contacts ·
DVD
Maker · Fax and
Scan · Internet
Explorer · Journal ·
Mail ·
Magnifier ·
Media
Center · Media
Player · Meeting
Space · Mobile
Device Center · Mobility
Center · Movie
Maker · Narrator ·
Notepad ·
Paint ·
Photo
Gallery · Private
Character Editor · Remote
Assistance · Sidebar ·
Snipping
Tool · Sound
Recorder · Speech
Recognition · WordPad

Games

Chess
Titans · FreeCell ·
Hearts ·
Hold
'Em · InkBall ·
Mahjong
Titans · Minesweeper ·
Purble
Place · Solitaire ·
Spider
Solitaire  · Tinker

Kernel

Ntoskrnl.exe ·
hal.dll ·
System Idle
Process · Svchost.exe ·
Registry ·
Windows
service · Service
Control Manager · DLL ·
EXE ·
NTLDR /
Boot
Manager · Winlogon ·
Recovery
Console · I/O ·
WinRE ·
WinPE ·
Kernel
Patch Protection

Services

BITS ·
Task
Scheduler · Wireless
Zero Configuration · Shadow
Copy · Error
Reporting · Multimedia
Class Scheduler · CLFS

File systems

NTFS (Hard
link · Junction
point · Mount
Point · Reparse
point · Symbolic
link · TxF ·
EFS) ·
FAT32·FAT16·FAT12 ·
exFAT ·
CDFS ·
UDF ·
DFS ·
IFS

Server

Domains ·
Active
Directory · DNS ·
Group
Policy · Roaming
user profiles · Folder
redirection · Distributed
Transaction Coordinator · MSMQ ·
Windows
Media Services · Rights
Management Services · IIS ·
Terminal
Services · WSUS ·
Windows
SharePoint Services · Network
Access Protection · DFS
Replication · Remote
Differential Compression · Print
Services for UNIX · Remote
Installation Services · Windows
Deployment Services · System
Resource Manager · Hyper-V

Architecture

NT
series architecture · Object
Manager · Startup
process (Vista) ·
I/O request
packets · Kernel
Transaction Manager · Logical
Disk Manager · Security
Accounts Manager · Windows
Resource Protection · LSASS ·
CSRSS ·
SMSS ·
MinWin

Security

UAC ·
BitLocker ·
Defender ·
DEP ·
Protected
Media Path · Mandatory
Integrity Control · UIPI ·
Windows
Firewall · Security
Center

Compatibility

Unix
subsystem (Microsoft
POSIX  · Interix) ·
Virtual DOS
machine · Windows on
Windows · WOW64

Retrieved from "http://en.wikipedia.org/wiki/AutoRun"

Category: Windows
components

Views

Article

Discussion

Edit
this page

History

Personal tools

Log
in / create account

Navigation

Main page

Contents

Featured
content

Current events

Random article

Search

Interaction

About Wikipedia

Community
portal

Recent
changes

Contact Wikipedia

Donate to Wikipedia

Help

Toolbox

What links
here

Related
changes

Upload file

Special pages

Printable
version

Permanent link

Cite
this page

Languages

Русский

This page was last modified on 23 January 2009, at 11:22.

All text is available under the terms of the GNU
Free Documentation License. (See Copyrights
for details.)
Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a
U.S. registered 501(c)(3) tax-deductible
nonprofit charity.

Privacy policy

About Wikipedia

Disclaimers