Protect Windows boxes by disabling autorun.inf

I discovered recently that you can protect yourself from security risks spread via USB sticks by preventing windows from reading autorun.inf files. Where I work this is a significant problem.

You use something called inifilemapping to make windows look in the registry for the contents of autorun.inf, rather than in the file itself. If you tell it to look in a non-existant part of the registry then windows just thinks that all autorun.inf files are empty.

Here is a reg file for it:

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]

@="@SYS:DisableAutoRun"

• SYS means look under HKLM\Software
• DisableAutoRun tells Windows to look for a registry key called DisableAutoRun
• The @ before SYS tells Windows not to resort back to the real autorun.inf when it finds no data in HKLM\Software\DisableAutoRun

So when Windows sees an autorun.inf it will look in HKEY_LOCAL_MACHINE\Software\DisableAutoRun to try to find the contents of the autorun.inf, and won't find the DisableAutoRun key so nothing will happen.