Feeds

Disabling Windows Autorun - there's a right way and a wrong way

Redmond's Downadup protection

Next gen security for virtualised datacentres

After some confusion about exactly how Windows users can protect themselves against a prolific computer worm called Downadup, Microsoft security watchers are once again reiterating the steps for disabling the Autorun feature.

Downadup has managed to infect an estimated 9 million machines at last count using multiple attack vectors. Two of those vectors are USB flash drives and mapped network drives, which are booby-trapped with files that compromise machines that are configured to automatically connect to CD and DVD drives and other types of media.

Disabling the feature has long been a good idea, as the 2005 fiasco involving the Sony rootkit made clear. Those unfortunate enough to have Autorun configured - and the feature is turned on by default - found their machines were secretly infected by digital rights management software after playing certain Sony BMG CDs on their PCs. With Downadup spreading like wildfire, disabling Autorun is an even better idea than ever.

For the low-down on exactly how that's done, head over Microsoft Knowledge Base article 953252. The May 2008 article revises an earlier Knowledge Base item that didn't completely remove the dangers inherent in Autorun.

It would appear that the US Computer Emergency Readiness Team referred to that older article when it warned the world on Wednesday that Microsoft's instructions "are not fully effective" and "could be considered a vulnerability."

The group went on to give labored instructions for changing registry settings that disable all Autorun features. We're sure they work, but we can't imagine Aunt Mildred having the slightest clue how to pull them off. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.