From: Philip Hannay [philip.hannay@SOPHOS.COM]
Sent: Tuesday, February 22, 2000 4:10 AM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Re: AUTORUN.INF Vulnerability

>To disable the autoinsert notification:
>
>Win9x - HKEY_LOCAL_MACHINE\Enum\SCSI\Name_of_cdrom\MF&...(nasty long key)\
>AutoInsertNotification (binary value, default 01) set to 00
>
>WinNT - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\
>Autorun (hex DWORD value, default 0x00000001) set to 0x00000000
>
>Secondary workaround:
>
>Win9x -
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
>NoDriveTypeAutoRun (binary value, default 95 00 00 00) set to 9d 00 00 00
>
>WinNT -
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
>NoDriveTypeAutoRun (hex DWORD, default 0x00000095) set to 0x0000009d

An alternative method for NT, which seems to have disabled autorun completely,
is to change the all the security settings on the HKEY_CLASSES_ROOT\AutoRun key
to read-only.

Philip Hannay,       Virus Analyst,       Sophos Anti-Virus
email philip.hannay@sophos.com        http://www.sophos.com
US Support +1-888-SOPHOS-9       UK Support +44-1235-559933