If you need the auto run to launch a file which is stored deeper within another folder, then we can reference this file, by using the folder name before the filename, therefore, nameoffolder/filename.extension.Ī point to remember is those users who are extra security conscious may have disabled the ability for CDs to launch without any user input, and therefore the autorun.inf file will not work in this case. The autorun file will reside on the root of the disc. If your filenames have spaces in the naming convention, then for the purposes of the autorun, (which cannot recognise files names with spaces), either remove the spaces or replace the spaces with underscores in the original files. In 2008, infected digital picture frames exploited the feature and while it was possible to disable AutoRun, doing so was not an easy task.Īt last year's AusCERT security conference IBM accidentally issued delegates a thumb drive which exploited AutoRun.Do not type the apostrophes, only the content within them. One of its reasons for issuing the 'non-security update' was that it found that Windows XP users were 10 times more likely to get infected when faced with such an attack.įirst introduced in Windows 95, the feature has caused security professionals frustration. The feature remained in Windows 7 but Microsoft claimed to have largely addressed AutoRun abuse. So Microsoft wasn't calling its Windows Update a 'security update' but rather an 'Important, non-security update' which effectively disabled AutoRun. In other words, in a very real sense, it's not a bug, it's a feature,' said Adam Shostack, a Microsoft security program manager.

'AutoRun isn't an accident - it's by design, and as I mentioned we care about the very real positive uses of the feature. The problem for Microsoft was that while the obvious solution was to disable AutoRun, it was considered a legitimate feature, which happened to be exploited by the Conficker worm, Rimecud and Taterf.

Autorun software