Checking for autorun.inf

[MrMancunian]

Hi Everybody,

We've got a virus problem in our department and the thing it does is always the same. It creates an autorun.inf in the root of every partition. When the partition is accessed (or initialised, I'm not sure), the autorun.inf runs an executable. I was thinking I could write a program/script that checks all available disks for an autorun.inf and either replaces or deletes the file. This way, the executable doesn't run. Now, surely I'm forgetting something, like doesn't autorun.inf run when I check whether or not it is present? Do you have any suggestions on how to go around this? I'm not asking for code, just ideas are enough.

Thnx,

Steven

[jg007]

vbscript would probably be the best option for this, depending on how you are set up and if you are using activedirectory it could be pushed pretty easily.

I don't think that this would activate it but if so I would probably recomend pushing out a policy to the workstations to disable autourun on drives and you might want to do that anyway

if you want to create a .reg file just use the entries below -

 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000024
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"Autorun"=dword:00000000
 
 

[MrMancunian]

vbscript would probably be the best option for this, depending on how you are set up and if you are using activedirectory it could be pushed pretty easily.

I don't think that this would activate it but if so I would probably recomend pushing out a policy to the workstations to disable autourun on drives and you might want to do that anyway

if you want to create a .reg file just use the entries below -

 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:00000024
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"Autorun"=dword:00000000
 
 

Hi,

We don't use AD (yet), so that is not an option. Furthermore, VBScript isn't something I control, so I wouldn't get very far I'm afraid. Does anyone have another idea?

Thnx,

Steven