Oct 27, 2008

When AutoPlay is activated n our Data CD/DVD or flash drives inserted, Windows will execute an Applications which is configured in autorun.inf. Read Wiki for more information of Autorun.inf

Mostly all viruses travels from autorun to system directory or drive

Here ill tell you how to block specific files from autoplay instead of Disabling Autoplay system.

Settings:
1] Run > regedit
2] go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\CancelAutoplay\Files
3] Add New String value and name it with application name which you want to block.
4] e.g.- Some bad coders use shell32.exe (system contains shell32.dll, see the difference between .exe n .dll) to execute virus from autorun.inf
[note:- shell32.exe, run32.exe, ntdetect1.exe these used to run virus cause system contains this named dll]
5] so to block shell32.exe from autorun i'll add new string value - name 'shell32.exe'
6] to block any other applications which contains 32.exe, so ill add '*32.exe'
7] you can block any file formats, e.g- vb scripts like 'killtask.vbs'
8] or you can set '*fun*' something like for blocking fun.exe
9] read by default string names to better understand..

Done. :)



0 comments: