Extra Topics (Joe’s Blog Site)

On one of my article, I discussed how to disable the autorun feature in Windows to minimize the spread of USB viruses. In addition to that, I also created an article about creating a folder named “autorun.inf” on your USB drive to prevent viruses from creating an autorun.inf file.

Unfortunately there are some malware which are smart enough to delete the autorun.inf folder so they could successfuly create an autorun.inf file on your portable drives. To prevent this, we will create a special folder inside your autorun.inf folder. Once this is created, even you wouldn’t be able to delete the autorun.inf folder easily.

Follow the steps below to create a special folder called CON inside your autorun.inf folder. Let us assume that your USB drive letter is E:

1. Click Start->Run… and type CMD.
2. At the command prompt type, E: then hit Enter
3. Type MD AUTORUN.INF, hit Enter (skip this step if you already have an autorun.inf folder)
4. Type CD AUTORUN.INF, hit Enter
5. Type MD .\CON\, hit Enter.

For an explanation about the CON folder, read my article about the “magic” in Microsoft.

It’s very common today that viruses utilize the autorun.inf feature to spread themselves by putting a copy of themselves and creating an autorun.inf file on your removable drives. This would make sure that they would automatically execute when you insert your flash drives in your USB ports and infect your computer. I have already created an article on how to disable the autorun.inf from being automatically executed on your computer to minimize the infection.

How do I prevent autorun.inf from being created on my USB drive?
For additional security, you can prevent viruses from creating an autorun.inf file on your USB flash drive. Without the autorun.inf, these viruses cannot automatically execute themselves. To do this, all you have to do is to create a folder named “autorun.inf” (without the quotes) on your USB drive’s root directory. That’s all! It’s sort of immunizing your USB flash drive. The virus cannot create an autorun.inf file if there’s already a folder with the same name.

Why can’t I create a folder named “autorun.inf”?
If you cannot create this folder, it means there’s already a file called autorun.inf existing on your flash drive. You’ll have to delete this file first. This file was most probably created by a virus if you didn’t put it there.

I cannot see the autorun.inf file to be deleted, what will I do?
It’s just probably hidden by the virus. You must configure your Windows Explorer to show hidden and system files. How? Follow these steps:

1.) In you Windows Explorer window, go to Tools->Folder Options…

2.) Click the View tab and below are the Advanced settings.

3.) Find Hidden files and folders, select “Show hidden files and folders”.

4.) Uncheck “Hide protected operating system files”

5) Click OK.

You should now be able to view the hidden and system files so you can delete it then.

There’s no “Folder options…” under the Tools menu of my Windows Explorer?!
There are several reasons why the “Folder options” isn’t there:

• It could be under the View menu if you’re using earlier versions of Windows like Windows 98.
• The administrator has removed it as a security policy. Contact your systems administrator.
• Your system has been infected and the virus has removed it. Run ComboFix to fix this.

Creating an autorun.inf folder doesn’t mean that your USB flash drive will no longer get infected. The viruses can still make a copy of themselves into your flash drive. But without the autorun.inf, they cannot easily execute when you insert your flash drive unless you double click on the executable virus file. So be sure to recognize which files you really did put on your drive.

NOTE: If the autorun.inf file exists and you haven’t disabled the autorun feature on your operating system yet, there’s a chance that your system has been infected already. If your anti-virus didn’t trigger, then you could run ComboFix to clean your system.

Some people think that the autorun.inf file is a virus. Well it’s not. Autorun.inf is a system file used by operating systems like Windows to automatically run programs when a removable media like a CD-ROM, DVD-ROM or a USB Flash is inserted. For the sake of convenience, software distributed on a disc can automatically start an installer when the disc is inserted using this feature.

Unfortunately, this feature pose a security threat. Virus creators use this feature to easily distribute malware (malicious software) and infect computers. They used this autorun feature to automatically execute a virus when the removable media, especially USB flash drives, are inserted.

To solve this problem, we have to tell Windows NOT to automatically run autorun.inf anymore. We do this by disabling the feature from the Windows registry.

Disabling autorun from the Registry

1. Click Start->Run… or press the Window+R key on the keyboard to show the Run dialog box.
2. Type regedit then hit Enter to execute the Registry Editor.


Run dialog box to open RegEdit

3. On the left, panel double click the folders to expand and go to:
   HKEY_CURRENT_USER\Software\Microsoft\Windows
\CurrentVersion\Policies\Explorer
   

   Regedit Window

4. Once there, check the right panel and double click the NoDriveTypeAutoRun registry key.
5. On the Value Data, type FF for Hexadecimal or 255 for Decimal value.
   

   Change the NoDriveTypeAutorun's value to 255 (or FF in Hexadecimal)

6. Close the Registry Editor and restart the computer.

The problem with this hack is that your installer CDs or DVDs will no longer launch the installer automatically. So what the heck, you can just explore the disc and manually run the installer application which usually has a file name install.exe or setup.exe.