How do i disable autorun on my system??

is it windows xp or vista?

1. for vista go to control panel>Autoplay, uncheck USE AUTOPLAY FOR ALL MEDIA AND DEVICES

2. for xp got to run, type gpedit.msc, expand Administrative Templates, select System, on the right pane double click Turn Off Autoplay, set as Enable.

@ Ex Inferis
Thanks my OS is XP, I typed gpedit.msc in the run command, unfortunately it said Windows can't find it and i tried it on a friend's laptop and worked!! what's the prob?

UNLEASHED:

@ Ex Inferis
Thanks my OS is XP, I typed gpedit.msc in the run command, unfortunately it said Windows can't find it and i tried it on a friend's laptop and worked!! what's the prob?

me too

gpedit allows you to edit or configure group policy settings, unfortunately Group policy is available only in win xp professional, not home (and vista basic). so its either you're both using home versions of xp, or certain malware, like Brontok, have locked up or disabled the gpedit launcher. however there is a more challenging workaround involving editing the registry (which i don't always recommend since the registry is the nerve center of windows).

if you still want to forge ahead i can point you the way.

brief note: turning off autoplay is a good idea for all users; ever since the advent of Ravmon and other "jump" worms (meaning they jump from removable media to other media, infecting systems as they go along) it became quite easier to write code that attaches a viral payload to the autorun.ini file of Ravmon or even standalone autorun files to automatically execute the virus and install it on your system the moment you plug in your flsahdrive/external harddisk. this is because autorun detects the autorun.ini file and executes its instrcutions. for your info I'm giving a sample autorun.ini code below:

[autorun]
OPEN=PROGRAM.EXE
shell\open=??(&O)
shell\open\Command=PROGRAM.EXE
shell\open\Default=1
shell\explore=??(&X)
shell\explore\Command=PROGRAM.EXE


simply save as autorun.ini
(ps: program.exe is the virus payload)

since the autorun files and virus payload are supehidden (a tweak in the registry) most antivirus software cannot detect them in the flashdrive.

hence, you have a situation where you keep getting virus infections in your system (your antivirus mostly alerts you after the fact, ie after infection) and keep wondering WHERE you got the virus from.

its resident in your flashdrive!


anyway, to disable autorun, got to run, type regedit, navigate to HKEYLOCALMACHINE>Software>Microsoft>Windows>CurrentVersion>Policies>Explorer, on the right pane double click NoDriveTypeAutoRun, its a DWORD value (ie hexadecimal) with a default of 0x91. change the hexadecimal value from 91 to any of the following:

ff (to disable autorun on ALL drives, not recommended)

4 (to disable autorun on only removable media including USB drives. recommended)

if you choose the second option your new dword value is 0x4. thats it!

just close regedit and restart.


note a few facts: disabling autorun and then doubleclicking the drive icon in My Computer to open the drive automatically runsthe viral autorun.inf script, which installs the virus and defeats the purpose of everything i laid out above.

best and safest way to access your flash? right click and choose Explore, orbetter yet use the Address bar dropdown to navigate to your flash media.

cheers, hope this helps.

Ex Inferis:

anyway, to disable autorun, got to run, type regedit, navigate to HKEYLOCALMACHINE>Software>Microsoft>Windows>CurrentVersion>Policies>Explorer, on the right pane double click NoDriveTypeAutoRun, its a DWORD value (ie hexadecimal) with a default of 0x91. change the hexadecimal value from 91 to any of the following:

ff (to disable autorun on ALL drives, not recommended)

4 (to disable autorun on only removable media including USB drives. recommended)

if you choose the second option your new dword value is 0x4. thats it!

just close regedit and restart.


note a few facts: disabling autorun and then doubleclicking the drive icon in My Computer to open the drive automatically runsthe viral autorun.inf script, which installs the virus and defeats the purpose of everything i laid out above.

best and safest way to access your flash? right click and choose Explore, orbetter yet use the Address bar dropdown to navigate to your flash media.

cheers, hope this helps.

@ Ex inferis
   Thanks a lot, I use XP home edition, I tried what you asked me to do and up to the point of "policies" I opened it's sub under it, I saw nonEnum, Ratings, system. I couldn't find explorer, that sucks!
Any remedy? Thanks a lot pal for helping a bro

UNLEASHED:

@ Ex inferis
   Thanks a lot, I use XP home edition, I tried what you asked me to do and up to the point of "policies" I opened it's sub under it, I saw nonEnum, Ratings, system. I couldn't find explorer, that sucks!
Any remedy? Thanks a lot pal for helping a bro

oops! I'm soryy, ive seen my error. i gave a wrong path. replace HKEY-LOCAL-Machine with HKEYCurrentUser. the path now becomes; HKEYCurrentUser>software>microsoft>windows>currentversion>policies>explorer

i don't use windows as my primary OS, so i hope you understand the omission.

meanwhile allow me to properly explain something i posted above.:

i said:

Ex Inferis:


note a few facts: disabling autorun and then doubleclicking the drive icon in My Computer to open the drive automatically runsthe viral autorun.inf script, which installs the virus and defeats the purpose of everything i laid out above.

best and safest way to access your flash? right click and choose Explore, orbetter yet use the Address bar dropdown to navigate to your flash media.

the reason for this is rooted in the autorun code (a sample i gave above) which tells your computer to execute whatever program is defined in the code (eg PROGRAM.EXE).

again, this is the usual format:

[autorun]
OPEN=PROGRAM.EXE
shell\open=??(&O)
shell\open\Command=PROGRAM.EXE
shell\open\Default=1
shell\explore=??(&X)
shell\explore\Command=PROGRAM.EXE


(the question marks are actually 5, but when i type more than 3 php formats it as  )

PROGRAM.EXE is most often EXPLORER.EXE, a sort of virus that affects the shell.

now if you get infected, ie the virus runs and installs, clicking on the drive icon turns up a dialog asking you what you want to use to open the drive. rightclicking opens a menu with the normal OPEN command replaced by ??(&O) (again, its five question marks), and EXPLORE replaced by ??(&X)

this is visble in the sample code above. selecting any of these corrupted shell operations executes the virus again.

that is why i recommend using the windows address bar at the top to open the flash/external drive.


i feel compelled to write this rather lenghty post because its a common occurence; people unknowingly infect and reinfect their systems and spend lots of time and money on antivirus apps, updating and reformating.

cheers.

You're nice bro, thanks for your time,care and kindness, I just did it!

anytime.