Sunday, August 7, 2011

Disabling Autorun/Autoplay using Registry editor


To get rid off virus affecting your system because of autoplay of drives please use below steps:
1. Type regedit on run prompt.
2. Navigate to below location:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
3. you will find a key value as "NoDriveTypeAutoRun" , which is one byte value.
4. Please set the value of key as "95" Hex value to disable autorun on removable media and Network drives.

Regedit
5. Be very careful while modifying reg values. Below table will explain you to understand the meaning of bits to set for disabling any type of media.

Value              Meaning
0x1/0x80   Disables AutoRun on drives of unknown type
0x4            Disables AutoRun on removable drives
0x8            Disables AutoRun on fixed drives
0x10          Disables AutoRun on network drives
0x20          Disables AutoRun on CD-ROM drives
0x40          Disables AutoRun on RAM disks
0xFF         Disables AutoRun on all kinds of drives


If any of the bit is set into this hex valye, that type of drive will be disabled for autorun.
Bit    Type of Drive
0/7    UNKNOWN

1       NO ROOT DIR
2       REMOVABLE
3       FIXED
4       REMOTE
5       CDROM
6       RAMDISK

For setting values you must always add 0x80 to the value of drive you want to set for.
A few examples for setting values:
for removable drives: 0x80 + 0x04 = 0x84 ( Hexadecimal addition)
for removable & fixed drives : 0x80 + 0x04 + 0x08 = 0x8C
for removable + fixed drives +CD ROM = 0x80 + 0x04 + 0x08 +0x20 = 0xAC(1010 1100)


For changing Autorun option using Group policy please refer to following links:

Disabling autoplay option in Windows XP using Group Policy
turning-off-autoplay-on-all-drives


No comments:

Post a Comment