[13965] in bugtraq
Re: AUTORUN.INF Vulnerability
daemon@ATHENA.MIT.EDU (Philip Hannay)
Tue Feb 22 21:19:41 2000
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Message-Id: <8025688D.0032669E.00@titanic.Notesnet>
Date: Tue, 22 Feb 2000 09:10:27 +0000
Reply-To: Philip Hannay <philip.hannay@SOPHOS.COM>
From: Philip Hannay <philip.hannay@SOPHOS.COM>
X-To: BUGTRAQ@SECURITYFOCUS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
>To disable the autoinsert notification:
>
>Win9x - HKEY_LOCAL_MACHINE\Enum\SCSI\Name_of_cdrom\MF&...(nasty long key)\
>AutoInsertNotification (binary value, default 01) set to 00
>
>WinNT - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\
>Autorun (hex DWORD value, default 0x00000001) set to 0x00000000
>
>Secondary workaround:
>
>Win9x -
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
>NoDriveTypeAutoRun (binary value, default 95 00 00 00) set to 9d 00 00 00
>
>WinNT -
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
>NoDriveTypeAutoRun (hex DWORD, default 0x00000095) set to 0x0000009d
An alternative method for NT, which seems to have disabled autorun completely,
is to change the all the security settings on the HKEY_CLASSES_ROOT\AutoRun key
to read-only.
Philip Hannay, Virus Analyst, Sophos Anti-Virus
email philip.hannay@sophos.com http://www.sophos.com
US Support +1-888-SOPHOS-9 UK Support +44-1235-559933
