Preventing AutoPlay attacks on your Windows PC

In the old days, computer viruses often spread from one computer to another by infecting floppy diskettes. Now, many types of malware spread themselves from one computer to another by infecting portable devices, memory cards, CDs and DVDs. This page shows how to proactively prevent those attacks, by disabling the AutoPlay feature on Windows. This step is a trade-off of reduced ease-of-use in exchange for greater security, and can be reversed if you don't like the results.

I have Windows 2000 First download and install this patch from Microsoft. Then disable AutoPlay using Local Group Policy, or by the method shown in Section III of this U.S. CERT advisory.

I have Windows XP First download and install this patch from Microsoft. You can disable AutoPlay using TweakUI, or by the method shown in Section III of this U.S. CERT advisory..

I have Windows Vista You can disable AutoPlay using the AutoPlay applet in Control Panel, or by the method shown in Section III of this U.S. CERT advisory. Some versions of Windows Vista (Ultimate, Enterprise, and Business) can also disable AutoPlay using Local Group Policy.

What types of devices could carry malware and infect a computer? Here's a partial list:

• MP3 players
• digital cameras
• memory cards
• digital picture frames
• flash drives (aka "thumb drives")
• external hard-disk drives
• CDs and DVDs

There might not be any visible symptoms of an infection, and your antivirus software might not detect the attack, so consider using the proactive approach by disabling or controlling AutoPlay, as well as using a non-Administrator user account for your daily computer use.

TweakUI is a free utility made by Microsoft. You can download it from this page. It works on Windows XP. Log onto your PC with an Administrator account to install TweakUI. Click Start > All Programs > PowerToys > TweakUI to open TweakUI. Click the AutoPlay tab, and uncheck the boxes for AutoPlay on all the drive letters available, including drive letters you do not usually see in use. Close TweakUI and log out of your Administrator account. You're done. :)

Local Group Policy is a built-in feature of Windows 2000, and some versions of Windows XP and Windows Vista. Log onto your PC with an Administrator account. Click Start > Run and type gpedit.msc, then click OK. Local Group Policy Editor opens in a new window. In Local Group Policy Editor, expand User Configuration > Administrative Templates > Windows Components and click on the AutoPlay Policies folder. You'll see the AutoPlay policies in the right-hand panel now. In the right-hand panel, double-click Turn off AutoPlay, and a panel opens. Click on Enabled and choose All drives, then click OK to close the panel. Close the Local Group Policy Editor window and log out of your Administrator account. You're done. :) What else can Local Group Policy Editor do to secure my computer? If you have Windows XP or Windows Vista, then Group Policy lets you add a Software Restriction Policy, one of my favorite proactive security enhancements.

Windows Vista's AutoPlay options panel Click on the Start orb, then type autoplay in the Search box and press the Enter key. The AutoPlay panel from Control Panel will open. Uncheck the box for "Use AutoPlay for all media and devices." Set each option to "Take no action." If you don't like disabling all of the options, you can start by setting all the options to "Take no action," and then enable those exceptions that you really want, such as playing audio CDs, DVD movies, etc.

What are the side effects of disabling AutoPlay?

When AutoPlay is disabled,

• music and movie discs may not play automatically when you insert them. You can still use them, but you might have to manually launch your media player program or go into My Computer and play the disc manually.

• inserting a memory card, a flash drive, or an external hard disk drive won't automatically do anything. You can go into My Computer and access them, or access them from programs as usual.

• plugging in a portable device such as a camera or MP3 player probably will not do anything automatically. You can still access them from My Computer or from programs as usual.