Autorun.inf [RESOLVED]

[Guest]

[metalforlife]

Is there a way to get an alert when the operating system tries to read the autorun.inf file from an external disk?

[Endymion]

Is there a way to get an alert when the operating system tries to read the autorun.inf file from an external disk?

Probably not.

Though I guess the Update to the AutoPlay functionality in Windows might prove an useful alternative.

Such update provides the same approach enforced on Windows 7  even on previous versions and disable AutoRun task in the AutoPlay dialog for devices that are not removable optical media (CD/DVD) whereas IIRC previous updates should have already disabled auto execution of autorun files on such devices.

[metalforlife]

I have it disabled, but I am not sure whether doing that will be good enough.

Is there an alternative with CIS itself? I am guessing that CIS would alert me of the executions of files from removable drives?

[metalforlife]

Anyone?

[OmeletGuy]

Goto my Blocked files, and add "*:\Autorun.inf" without the quotes.

That should block every Autorun in any drive.

[metalforlife]

I don't want to block autorun. I want to get alerts when files from external disks auto-execute. That should be enough, shouldn't it?

Slightly OT: What is the difference between autorun and autoplay? Will having also autoplay enabled prove dangerous? And, finally, is there a way with Defense+ to block both?

[SS26]

Update to the AutoPlay functionality in Windows

Thanks for the link.  I was not aware of this trick 

[metalforlife]

I don't want to block autorun. I want to get alerts when files from external disks auto-execute. That should be enough, shouldn't it?

Slightly OT: What is the difference between autorun and autoplay? Will having also autoplay enabled prove dangerous? And, finally, is there a way with Defense+ to block both?

It doesn't look like I'll be getting an answer. But, please! Answer this question, at least - Is it safe to insert infected CDs or flash disks with D+ in Clean PC mode?

[panic]

Yes. Software executed from removable media is always treated as non-trusted and will produce alerts.

[metalforlife]

I am safe, then. Thanks, that is all I needed.

[Tags:]