How To Disable 'Autorun.Inf' To Prevent Virus Attack Computer.

Tags: tips
Enable/Disable Autorun
--------------------------------------------------------------------------------

How To Enable/Disable Autorun (Windows 95/98/Me)

Select the Device Manager tab.

Select the CD-ROM folder.

Select the entry for your CD-ROM drive.

Select Properties.

Select the Settings tab.

Turn on or off the Auto insert notification option.

Select OK.

Select OK

------------------------------------------
How To Enable/Disable Autorun (Windows NT/2000)
Start RegEdit (regedt32.exe).

Go to HKEY_LOCAL_MACHINE/System/CurrentControlSet/Services/Cdrom.

Edit the Autorun value to '1' to enable autorn, and '0' to disable autorun.

Close RegEdit
------------------------------------------
How To Enable Autorun for Other Removable Media
Autorun can be enabled or disabled for all Removable media types, such as a floppy or Zip disk.
Windows systems are configured to enable CD Notification, other removable media are by default
disabled.

The System Properties User interface only exposes the CD Enable or Disable selection. The
setting reflected in this dialog makes an entry in the System Registry. It is in this same location
that other media types are configured.

Notes:
Modifiying the Registry is not for the inexperienced user. Anyone will tell you, be VERY careful.
The modifications made in this case use Hex not Decimal numbers. If you are unfamiliar with the
Registry or the characteristics of base numbering and Hex, studying these topics prior to making
these modifications is advisable.
To Modify these Registry Settings, Use Regedit and navigate to the following Key:

HKEY_CURRENT_USER
Software
Microsoft
Windows
CurrentVersion
Policies
Explorer
"NoDriveTypeAutoRun"

The default value for the setting is 95 0 0 0. Change the first byte to 91. Restart the computer to
make the new setting take effect. You may have to right-click on the floppy and choose AutoPlay
from the menu to see the AutoPlay behavior.

-----------------------------------------
Additional Technical Info
The first byte defines which drive types to EXCLUDE from Autorun behavior. The hex value of the
byte is the sum of all of the drive type values to exclude + 128.

DRIVE_UNKNOWN 1
DRIVE_NO_ROOT_DIR 2
DRIVE_REMOVABLE 4 (floppy disks and removable cartridges)
DRIVE_FIXED 8 (hard disks)
DRIVE_REMOTE 16 (network drives)
DRIVE_CDROM 32 (CD-ROMs)
DRIVE_RAMDISK 64

The default configuration excludes UNKNOWN (1), REMOVABLE (4) and REMOTE (16) which
would be 16 + 4 + 1 + 128 = 149, which is hex 95. If you take out REMOVABLE you get 16 + 1 +
128 = 145, which is hex 91.

The calculation for this value is 1 + 4 + 16 + 128 = 149. 149 Decimal is 95 Hex

The new calculation is 1 + 16 + 128 = 145. 149 Decimal is 91 Hex

You may have to restart for the system to recognize a floppy or Zip as an Autoplay drive. If your
floppy drive does not show a custom icon or AutoPlay in the menu when right-clicked, double-
click on the icon for your computer on the desktop and press F5 to refresh the information in the
Explorer window. Zips and floppies will not autolaunch when media is inserted. You must double-
click their icon or right-click and choose AutoPlay from the menu.

------------------------------------------
How To Disable 'Autorun.Inf' To Prevent Virus Attack Computer.
Tags: tips

Recently there are many case reported that 'autorun' virus spread through so many computer due
to using flash memory or pendrive,so we need a preventive action to stop this virus spread to our
computer.

As we insert a pendrive to computer,window will scan and check is there have 'autorun.inf' file
and then write into 'mountpoint2' registry,'mountpoint2' will amend the act to open a disk or pop
up menu.Although you already set up ' disable auto play' ,use right click or use 'explore' to open
disk,the result still will run 'virus .exe'.

Therefore,we need to banned the 'mountpoint2' registry area,the method as below,

1.START ->RUN ->Key in 'regedit' to open registry.

2. HKEY_CURRENT_USER\ Software\Microsoft\ Windows\CurrentVersion

3.Right click 'mountpoints2' and select 'permission'

4.Then click 'Advance',uncheck 'inherit from parent the permission entires that apply to child
objects.Include these with entires explicity defined here'.

5.Click 'remove'.'Yes' and 'ok'.

Now,even you insert a pendrive with virus and your computer couldn't affected.

---------------------------------------
First of all, you should have administrator privilege.

if you have enough privilege then open group policy by the type gpedit.msc on run then go on
user configuration >>Administrative Templates >> System >> Prevent access to registry editing
tools >> Right Click Properties >> Disabled/Enable

--------------------------------------------
USB storage devices disabled

Once in a while I have a friend, or customer that needs to keep people from using the
USB ports to copy data off of a system.

It is easy to lock a machine down, disable the floppy, and cdrom in the bios. Many times
when you try to disable USB - it disables it entirely.

This can be a real pain on newer laptops or systems that don't even have a PS2 interface
for the mouse or keyboard.

There is a simple registry change that will keep the USB storage drivers from starting
when the system boots. Keeps people from walking up to a PC and copying data off with
a USB key, but allows you to keep your scanner, keyboard, and mouse working.

As always - back your system up before messing around in the registry.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor

Notice the value 'Start'

Switch this value to 4, and USB storage devices are disabled.

Switch this value to 3, and USB storage devices are enabled.

Other one
So a more reasonable option for sysadmins is to disable write access to USB port so
that data files cannot be written to the mass storage device.
The USB thumb drive will be read-only.

Open the Windows Registry and open the following key

Now add a new DWORD called WriteProtect and put the value as 0 to disable write
privileges to the USB port. To reverse the step, either delete the WriteProtect
REG_DWORD or toggle the value to 1 which will enable the port.

------------------------------------------
http://www.megaupload.com/?d=YI3JGGRA