How To Disable AutoRun.inf?

Earlier we saw how to remove the AutoRun Virus that abuse the autorun.inf file, to spread itself. Now, let us see how to turn off AutoRun.inf and thus protect your PC from AutoRun viruses and malware.

Windows had a bug in the way it handled AutoRun related Registry entries. When AutoRun is disabled, Windows operating system should not go past the Registry check. However, Windows continued to parse autorun.inf found on the removable media and did everything except the final action to invoke AutoPlay.

How to Disable AutoRun.inf?

Nick Brown came up with a solution to prevent AUTORUN.INF files from being used on a PC, from any medium. This method involved using an initialization file mapping, to create a mapping between the AUTORUN.INF initialization file and the Registry. “IniFileMapping” is a key which tells Windows how to handle the .INI files which those applications typically used to store their configuration data (before the registry existed).This procedure relied on the fact that an autorun.inf file is a standard Windows INI file and so the appropriate API calls are used by Windows when fetching its settings. These API calls can be redirected using the INI file mapping method. In this case, it says “whenever you have to handle a file called AUTORUN.INF, don’t use the values from the file. You’ll find alternative values at HKEY_LOCAL_MACHINE\SOFTWARE\DoesNotExist.” How is this done?

Create a Registry file with the following contents and save it as “DISABLEAUTORUN.REG”.

Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist" 

Double click “DISABLEAUTORUN.REG” to make the relevant changes to Windows Registry. Whenever Windows tries to read a file called “autorun.inf” using the INI programming calls, it is forbidden to read from the actual file. Instead, all settings are read from the HKEY_LOCAL_MACHINE\Software\DoesNotExist Registry key. As this key does not exist, it is as if the autorun.inf file contains no settings information. This applies to any autorun.inf in any location and on any drive.

The only drawback with this approach is you need to manually trigger the setup program in any inserted CD or USB Stick. But isn’t it better to live with this than with AutoRun viruses?

7 comments on “How To Disable AutoRun.inf?

  1. Thanks.

  2. To disable autorun.inf and autoplay just run disable.reg and add key to the registry.

  3. Sir I did all of your instructions but I don’t know why the autoplay still opens whenever I insert a usb device.

    This is strange because I also did this to one of my computers and it worked perfectly but when I did this to my laptop the autoplay still opens. Both of the pcs are using Microsoft XP pro with service pack 2.

    Can you tell me why the registry hack doesn’t work on all pcs?

    Thanks

  4. if registry dose not work, try to create yourself a .reg file in notepad and installing it.

  5. You can try this one, just to make the protection more comprehensive:

    =================================================================

    Windows Registry Editor Version 5.00

    [HKEY_CLASSES_ROOTJSFileShell]
    @=”Edit”
    [HKEY_CLASSES_ROOTJSEFileShell]
    @=”Edit”
    [HKEY_CLASSES_ROOTVBEFileShell]
    @=”Edit”
    [HKEY_CLASSES_ROOTVBSFileShell]
    @=”Edit”
    [HKEY_CLASSES_ROOTWSFFileShell]
    @=”Edit”
    [HKEY_CLASSES_ROOTWSHFileShellEditCommand]
    @=”Notepad.exe %1″

    [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]
    “DisallowRun”=dword:00000001
    “NoDriveAutoRun”=hex:ff,0f,00,00
    “NoDriveTypeAutoRun”=dword:000000b5

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer]
    “NoDriveAutoRun”=dword:03ffffff
    “NoDriveTypeAutoRun”=dword:00000004

    [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIniFileMappingAutorun.inf]
    @=”@SYS:DoesNotExist”

    =================================================================

  6. sir, i did as u told…
    but still there is the same problem..
    actually i have set the value of DisableRegistryTools as 0 then i can use regedit…but in the 2 seconds only after 2 seconds there is a same problem…

    plz help me sir..
    how do i disable autorun.inf ????

  7. Have you used the free tool to disable autorun? Are you using window 7 or vista or xp?

Leave a Reply

Your email address will not be published. Required fields are marked *

*