Maximum PC AutoPlay RSS Feed

Microsoft Blocks AutoRun/AutoPlay Vulnerability in XP, Vista, and Windows Server [Updated!]

Mark Edward Soper — Mon, 31 Aug 2009 11:41:03 -0500

AutoRun was originally intended to help automatically start programs stored on optical media. However, once USB drives became popular, AutoRun also became a popular way to launch programs from hard disks and thumb drives by working with Windows' built-in AutoPlay functionality.

AutoRun Versus AutoPlay

AutoRun uses an AutoRun.inf file in the root folder of CD or DVD media and other removable drives to specify what happens when the media is inserted or the drive is plugged into a USB or other hot-swap port. Allowable actions include launching a program, displaying an icon, and so on.

AutoPlay is a hot-swap-drive-specific technology in Windows that displays a list of actions that are specific to the media and its content. For example, if you insert a music CD, the AutoPlay menu would provide options for music playback with Windows Media Player or other installed media playback programs. If you connect a USB thumb drive or hard disk that contains different types of media, the AutoPlay list displays programs that can be used to view or play back each of the supported media types (such as photos, music, videos, and so on) stored on the drive. In Windows XP, AutoPlay is configured on a drive-by-drive basis, using programs such as TweakUI. Windows Vista and Windows 7 control AutoPlay on a media-type basis through the Control Panel's AutoPlay applet.

On removable drives, any executable files included in the AutoRun.inf file are automatically added to the AutoPlay menu [thanks to reader MRrelabled for suggesting this new section - updated 8-31-2009].

AutoRun is Not Your Friend (Unless You're a Malware Developer)

Unfortunately, AutoRun's ability to provide instant launching for programs has also been widely exploited by malware such as the notorious Conficker/Downadup worm and others.

First Windows 7, Now the Rest

Back in May, we reported how Microsoft changed how AutoPlay and AutoRun work in Windows 7, preventing USB drives from automatically starting programs using AutoRun. Now, as promised, Redmond's reining in AutoRun's interaction with AutoPlay on Windows XP, Windows Vista, and Windows Server 2003 with its KB971029 security update. It's not available on Windows Update yet, so if you want the update, download and install it manually.

Once you install KB971029, only CD and DVD drives (and programs that emulate CD/DVD drives, such as U3, which is used by SanDisk and other USB flash drive makers) can use AutoRun.

Better Security, But at a Price

Are there downsides to disabling AutoRun? Microsoft points out that you'll need to launch programs from USB drives manually - unless the USB drive emulates a CD drive when you plug it in (such as SanDisk Cruzers and others that use U3 software).

Like the improved security? Find it annoying? Want to report problems with some of your favorite utilities? Hit Comment and sound off.

Redmond Reins in AutoRun, AutoPlay to Help Make Windows More Secure

Mark Edward Soper — Fri, 01 May 2009 19:04:35 -0500

AutoRun and AutoPlay, Microsoft's "dangerous duo" for launching programs from CD/DVD and other removable media types, have become among malware authors' favorite infection vectors - and Microsoft has finally said, "enough already!"

A research study by Forefront Client Security cited by the Engineering Windows 7 blog determined that infections that can be started with AutoRun amounted to 17.7% of detected infections in the second half of 2008.

Although AutoRun was originally designed strictly for optical media, it can be used for other types of media. For example, you can create an autorun.inf file that adds the program on the media to the AutoPlay menu Windows displays, and change the default icon to make the malware program mimic a legitimate program. Conficker used this method to spread, as illustrated here.

Starting in Windows 7 RC, Microsoft has changed how both AutoRun and AutoPlay work:

AutoPlay no longer supports AutoRun on non-optical removable media. An autorun.inf file on a USB or other type of non-optical removable media will be disregarded. Only AutoPlay options that pertain to the types of files on the media will be listed.
When AutoPlay displays programs present on the media, the dialog now states that those programs will be run from the media.

Microsoft's Security Research and Defense blog provides sample dialogs and more details of how these changes work. The best news? Microsoft is planning to extend these security improvements to Windows Vista and XP users as well.

Are there any downsides? For a vigorous discussion of programs and devices that might not work after this change, see the comment thread at the Engineering Windows 7 blog. To start a MaximumPC-style discussion, you know what to do: click Comment and sound off!

When Windows XP AutoPlay Goes Wrong, and How to Fix It

Mark Soper — Fri, 01 Jun 2007 12:51:29 -0500

Why I Like AutoPlay - Really!

I like Windows XP AutoPlay. There, I've said it, and I feel great! Seriously, although there are some folks out there who don't like Windows' sniffing around their USB flash drives, CDs, and DVDs to figure out the best ways to enjoy that removable-media digital goodness when you plug in the drive or insert media, I appreciate AutoPlay. It makes Scanner and Camera Wizard leap to attention to pull images from my digital camera, spins up my music with Windows Media Player, and much more. So, what can you do when AutoPlay breaks? You have a couple of options, based on what's wrong with AutoPlay.

Tweaking a Misbehaving AutoPlay with TweakUI

If AutoPlay ignores some drives, but it's working on others, download TweakUI from Microsoft's Windows XP PowerToys page. TweakUI offers a boatload of ways to adjust and repair your system, but let's focus here, people. To fix problems with TweakUI on some drives, open the My Computers node and select AutoPlay. Use the Drives menu to enable or disable AutoPlay on any drive . Use the Types menu to enable or disable AutoPlay on CD/DVD drives or on removable-media drives. To specify what media type(s) should be handled by a particular AutoPlay handler (the programs used by AutoPlay to play or edit content), use the Handlers menu.

AutoPlay Doesn't Play at All? AutoFix to the Rescue

If AutoPlay isn't working at all, download the Autoplay Repair Wizard (AutoFix.exe) from the Downloads page at Microsoft.com (By the way, AutoFix.exe, like virtually all Windows XP downloads these days, is sitting behind the Microsoft Genuine Advantage firewall. Don't have a legit copy of Windows XP? You're out of luck). AutoFix checks the operation of the Shell Hardware Detection service, and then prompts you to insert and remove the drive that AutoPlay won't work with . At the end of the process, AutoPlay reports any errors detected and may fix the problem. Keep in mind that you must log off Windows XP and then log back on before repairs performed by AutoFix can be used.

What AutoFix Can't Fix

AutoFix can't fix problems with an individual program it lists (for example, if Scanner and Camera Wizard shows up in the AutoPlay menu but doesn't run), but it can fix problems that prevent AutoPlay from working at all.