Autorun attacks, like that by the Stuxnet worm, have become a common attack form. That common, that Microsoft has started to patch the autorun functionality in Windows.

Panda Security released USB Vaccine a while ago which offered to vaccinate a computer or USB drive to protect the computer from autorun based attacks.

Bitdefender, another popular security developer, has now released a similar program called Bitdefender Immunizer.

The program offers the same functionality as Panda USB Vaccine. Users can either immunize the computer as a whole, or immunize a connected removable drive.

The product page describes what happens if you immunize an USB drive:

The Immunize option allows you to immunize your USB storage device or SD card against infections with autorun-based malware. Even if your storage device has been plugged into an infected computer, the piece of malware will be unable to create its autorun.inf file, thus annihilating any chance of auto-launching itself.

This basically blocks the creation of autorun.inf files on immunized USB devices.

The computer immunization has the following effect:

The Immunize Computer slider allows you to toggle the autorun feature On or Off for any removable media (except for CD/DVD-ROM devices). If you accidentally plug in an infected USB drive that has not been immunized, the computer will not auto-execute the piece of malware located on the USB storage device.

The security patch linked above seems to have the same effect as the Immunize Computer option.

It has to be noted that immunizing removable devices or computers does not protect the system if the user executes malicious software on the device or computer manually. It only protects against autorun-based attack forms that require no user interaction.

Interested users can download USB Immunizer from the Bitdefender Labs website.

Update: Bastik has posted his findings in the comments, they are important and need to be mentioned in the article. Thanks Bastik for the helpful insight.

The tool does not offer to remove the protection from drives that it has immunized. To unprotect a drive you need to display hidden files in Windows and hidden system files. This can be done via Tools > Folder Options > View in Windows Explorer. You then need to delete the folder autorun.ini on the drive.

The tool displays an email prompt on exit with no apparent option to close it. Just click the ok button without entering an email address to close the program for good.

The update for Windows Autorun has been available for some time. To be precise, it was first released on February 24 by Microsoft and originally made available from the Microsoft Download Center.

Yesterday changed that by offering the update via automatic updating through Windows Update. Affected are all Microsoft operating systems pre-Windows 7, including Windows XP, Windows Vista and the server operating systems Windows Server 2003 and 2008. Windows 7 is not affected as it already has the restrictions in place.

The update restricts AutoPlay functionality to “CD and DVD media”. This protects customers “from attack vectors that involve the execution of arbitrary code by Autorun when inserting a USB flash drive, network shares, or other non-CD and non-DVD media containing a file system with an Autorun.inf file”.

It basically blocks AutoPlay on all devices and media except CD and DVD media even if they contain an autorun.inf file.

Customers may experience several issues after applying the update, including:

• Many existing devices in market, and many upcoming devices, use the Autorun feature with the AutoPlay dialog box to present and install software when DVDs, CDs, and USB flash drives are inserted. The AutoPlay behavior with CD and DVD media is not affected by this update.
• Users who install this update will no longer receive a setup message that prompts them to install programs that are delivered by USB flash drives. Users will have to manually install the software. To do this, users click Open folder to view the files, browse to the software’s setup program, and then double-click the setup program to run the program manually.
• Some USB flash drives have firmware that present these USB flash drives as CD drives when you insert them into computers. The AutoPlay behavior with these USB flash drives is not affected by this update.

The update is only offered if it has not already been installed on the system. Additional information about the update are available at Microsoft’s Security Advisory and the blog post Deeper insight into the Security Advisory 967940 update by Adam Shostack.

Autorun Manager is a portable software for Windows that offers to disable AutoRun selectively for the logged in user or all users of the operating system.

The application displays more than 30 options to disable AutoRun for various devices and media in the Windows operating system.

Inexperienced users may have a hard time finding the right selection amongst the options, as only one option can be selected from the listing.

AutoRun can be disabled on the following devices and media:

• CD-ROM and DVD-ROM
• Removable Devices
• Network Drives
• RAM Disks
• Unknown Devices

Those options are displayed at the top of the listing. The remaining options are all combinations of the devices. It is for instance possible to disable AutoRun on all devices or only on network drives and unknown devices.

The application contains options to disable AutoRun completely (disable all), re-enable AutoRun again and to apply the settings to all users of the system.

AutoRun Manager is a handy tool as it simplifies the process of disabling AutoRun selectively on the system. The application is available for download at Ask VG.

Some users might want to skip loading these autostart programs from time to time to save some time to be able to work on the computer. The following solution works only when running Windows XP operating systems. Microsoft seems to have disabled the option in Windows Vista (and most likely kept it that way in Windows 7).

To start Windows XP without any startup programs press the [Shift] key while the computer system is booting. The key has to be pressed as soon as the Windows desktop background appears. This will prevent startup programs from being loaded automatically. It might take a few tries to get it to work.

Computer vaccination referring to disabling autorun completely from removable media like usb flash drives or optical drives like CDs or DVD drives. To enable the protection of the computer system from programs that are auto-executed if usb flash drives or CDs or DVDs are inserted into the computer drives.

A click on vaccinate computer will immediately disable autorun on the computer system. The USB drive vaccination option on the other hand will disable autorun from selected usb flash drives. The drives have to be connected to the computer system before the computer can be protected. Every connected usb flash drive will be listed in a pulldown menu. A click on vaccinate usb will prevent autorun from being executed from that usb flash drive.

It should be noted that it is not possible to undo the autorun protection of a selected usb flash drive in the computer system using the security software. Another limitation is that it will only work on usb flash drives that have been formatted with the FAT or FAT32 file system.

Panda Research USB Vaccine increases the security of a computer system in regards to usb flash drives and other media with autorun capabilities. The security software has been tested under Windows Vista, Windows XP and even Windows 2000. It will work on all

There is however another solution in the form of the USB security software USB Cop which has been uploaded to Sourceforge yesterday. USB Cop blocks all attempts to run an autorun.inf file on the computer system. It will instead display the contents of the file to the user giving a recommendation what the user should do with it.

Available options are to browse the contents of the disk or to close the dialog without performing an action. The interface itself will display all entries that are located in the autorun.inf file.

The option to execute the autorun.inf file is normally missing from the available options. What this application currently does is block all attempts of running an autorun.inf file on the computer system. The only difference between disabling that option in Windows and using the software is the ability to browse and see the contents of the autorun.inf file a bit faster and automatic with the software. In reality it would simply mean a few additional clicks for the same result without running a software in the background all the time.

The software itself uses about 4.5 Megabytes of computer memory while running.

Update: Development has continued in recent years, the latest version of the program, dubbed USB Cop 1.0 Alpha 1, has been uploaded to the Sourceforge servers in March 2011. It is definitely an alternative for inexperienced users who want recommendations what they should do when they insert a disc or stick with autorun information.

Here is a short explanation if you have never heard of autorun.inf files before: It contains information about files and processes that are automatically executed when a disk is inserted or double-clicked. Autorun is often confused with autoplay but they are not the same. Autorun is directly related to the autorun.inf file on the disk while autoplay automatically reacts to new devices or media, for example a music CD is automatically played in Windows when inserted.

Autorun Eater takes care of autorun.inf files before it can be executed on the system. This is done my actively monitoring the system in real time. It will automatically remove suspicious autorun.inf files and store them in a secure space in case of a false positive.

I know that some of you do not like to run a lot of programs in the background which is also my preferred way. It is possible to disable the autorun.inf system wide which is the only protection that works flawlessly. The common Registry keys NoDriveAutoRun and NoDriveTypeAutoRun do not eliminate the dangers of autorun.inf files. When properly configured they prevent that the autorun.inf file on USB devices gets executed automatically but it will still be executed when a user double-clicks the drive.

The only real autorun.inf protection which disables it completely is the following Registry setting. Just copy the following lines into a text document and name it auto.reg.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
@="@SYS:DoesNotExist"

Double-click that file and restart your computer afterwards. Autorun should now be disabled for all drives on your system.

Instead of browsing through your system menus and launching applications, or even instead of just clicking shortcuts on desktop or on a launcher application, you can create simple (or complex) scripts that will do the job for you while you sit back and watch. With these “session” scripts you can launch multiple applications at once, from one place by clicking one icon. Sometimes when launching manually, you maybe got used to adding delays between starting resource-intensive applications so that your CPU can handle it better. Session scripts can take care of it for you too, you can define as long delays as you want.There are at least 2 ways of creating such scripts:

1) you might want to use some of many task automating applications which can handle a lot of routine work (eg. AutoIt, free; xStarter, paid; EasyMacro, paid)

2) you can write a simple batch script for your system handler using commands like “start %program_xyz% -parameter1 – parameter2 | application_abc” and so on

I won’t describe using automating programs because they vary from each other and moreover they usually contain a comprehensible tutorial or help files. Using batch scripts is very easy (at least for our purpose), you can find a lot of tutorials and examples either for Windows, Mac or Unix systems. To completely hide (minimize) running batch script on Windows, I use a great freeware application called cmdow which lets you do stuff like that and a lot more.

Using these session files can help you to save a little effort, maybe few seconds of your life. But every single second counts, right ;)

This is a very useful tool that every windows user should run from time to time to check on his autostarts, I bet there will be more than you think there are. Removing some helps to speed up windows startup as well.

Simply run Autoruns and it shows you the currently configured auto-start applications as well as the full list of Registry and file system locations available for auto-start configuration. Autostart locations displayed by Autoruns include logon entries, Explorer add-ons, Internet Explorer add-ons including Browser Helper Objects (BHOs), Appinit DLLs, image hijacks, boot execute images, Winlogon notification DLLs, Windows Services and Winsock Layered Service Providers. Switch tabs to view autostarts from different categories.

Autoruns for Windows version 11.0

Autoruns for Windows is a fully comprehensive startup monitor that displays all programs that are configured to run at system bootup or login. It will show you specific entries in the exact order that Windows processes them. It will even show all of the executables that launch at startup. Inclusive in this comprehensive display are programs in the startup folder, Run, RunOnce, and other Registry Keys.

Aside from showing you what is going on during startup/ bootup, Autoruns enables you to configure specifically to show additional locations such as Explorer and shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and just about everything else you could possibly think of. MSConfig is nothing compared to this. Thus, the term “comprehensive” has been used liberally to describe this startup monitor.

Third-party auto-start images which have been added to your system can be a burden to the operating system and drastically slow startup time. Autoruns 11.0 includes a Hide Signed Microsoft Entries option to assist you in isolating these third-party auto-start images and includes support for examining the auto-starting images that have been configured for other accounts on a given system. Included in the Autoruns package is a command-line equivalent which is capable of output in CSV format, Autorunsc.

Just run Autoruns and you will immediately see all of the currently configured auto-start applications and a complete list of Registry and file system locations for auto-start configuration. You will see:

logon entries
Explorer add-ons
IE add-ons
BHOs
Appinit Dlls
Image hijacks
Boot execute images
Winlogon notification DLLs
Windows Services
Winsock Layered Service Providers

When you switch tabs, you will be able to view other categories of autostarts.

Any executable that is configured to run automatically can be viewed by selecting it and then using the Properties menu item or toolbar. Process Explorer may be running at the time and an active process could be executing. The Process Explorer menu item in the Entry menu will open the process properties dialog box.

Use the Jump menu item or the toolbar button to navigate to the Registry or file system location displayed. You can then disable any auto-start entry by unchecking its checkbox. Use the Delete menu item to delete an auto-start configuration.
On-line help is available for further assistance, which may very well be required as this is a complex utility.

The command-line version is Autorunsc. The syntax is as follows:

Usage: autorunsc [-x] [[-a] | [-b] [-c] [-d] [-e] [-g] [-h] [-i] [-k] [-l] [-m] [-o] [-p] [-r] [-s] [-v] [-w] [[-z ] | [user]]]

• -a Show all entries.
• -b Boot execute.
• -c Print output as CSV.
• -d Appinit DLLs.
• -e Explorer addons.
• -g Sidebar gadgets (Vista and higher).
• -h Image hijacks.
• -i Internet Explorer addons.
• -l Logon startups (this is the default).
• -m Hide signed Microsoft entries.
• -n Winsock protocol and network providers.
• -p Printer monitor drivers.
• -r LSA providers.
• -s Autostart services and non-disabled drivers.
• -t Scheduled tasks.
• -v Verify digital signatures.
• -w Winlogon entries.
• -x Print output as XML.
• -z Specifies the offline Windows system to scan.
• user Specifies the name of the user account for which autorun items will be shown.

AutoRuns 11.0 download: http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx