J
Jim Nugent
If I'm posting to the wrong group, kindly redirect me.
Like many of security/malware conscious colleagues, the Sony DRM "Rootkit"
fiasco finally convinced me to disable AutoPlay via GPO. When I want to
install a program or simulate autorun, one of three things tends to happen:
1. The instructions say "Insert the CD-ROM. If it doesn't start by itself,
type Start->Run and then D:\setup.exe" or similar.
2. I look at the contents of the CD, locate and open autorun.inf, and enter
(or double-click) whatever follows OPEN=...
I even thought about writing a program to automate this for those less
familiar with poking around system related files.
3. Last week I went to install an HP OfficeJet driver and was confronted
with this autorun.inf:
----------------------------------------------------------------------------
--------
[C32]
SetupGlue=0
PdiOffset=..\AiO\hpopdi05.exe
GhoulOffset=hpzghl09.exe
PinOffset=..\AiO\hpopin05.exe
[C32.Dot4Usb]
SetupGlue=1
[C32.Dot4Usb HPZ12]
SetupGlue=1
[C32.Image]
SetupGlue=1
[C32.Printer]
SetupGlue=0
[hpoglu08]
COUNT=1
1=ClassInstall
[hpound08]
COUNT=1
1=ClassInstall
[hpousc08]
COUNT=1
1=PSC.Usb
[hpousb08]
COUNT=2
1=USBPRINT_Inst
2=ClassInstall
[hpzid412]
COUNT=10
1=psc_2100_Inst
2=psc_2200_Inst
3=psc_2150_Inst
4=psc_2170_Inst
5=oj_6100_Inst
6=psc_1000_Inst
7=psc_1100_Inst
8=psc_1200_Inst
9=oj_4100_Inst
10=oj_4105_Inst
[hpzist12]
COUNT=2
1=Dot4Storage_DDI
2=pdr.dev
[hpzius12]
COUNT=2
1=ClassInstall
2=HPDot4Usb_Inst
[hpzipr12]
COUNT=1
1=Dot4Print_Inst
[autorun]
open=setup.exe
icon=setup.exe,0
[Version]
CDGuid={A1062847-0846-427A-92A1-BB8251A91E91}
SoftwareGuid={B75BA3CB-EF2B-44C5-B7B2-94BB1502C398}
InfrastructureDatabaseList=hpomdl04.dat
LanguagesInthisCD=enu
DefaultLanguageInThisRelease=enu
DIVISION=hpo
ICE_REV=04
FIRST_IO_REVISION=08
LAST_IO_REVISION=08
VCD_FILEVER=10
Manufacturer=HP
RegistryManufacturer=Hewlett-Packard
ProductSeries=All-In-One Series
Pre-Install=%ProgramFiles%%Manufacturer%
SilentInstall=No
PreloadICEEngineToGUIDFolder=hpzprl01.dat
PreloadRecoveryMechanism=hpzprl02.dat
UI_03=Yes
UI_20=Yes
UI_25=No
UI_30=Yes
UI_50=No
......
------------------------------------------
GAH! I'll spare you the rest of the 2,633 lines in this file. I had no idea
you could do so much in an autorun.inf. Fortunately it was for a friend who
still had autorun enabled. I brought it home to play with on my
autorun-disabled system. Is there a way manually "execute" the autorun.inf
file? I trield "Install" from the context menu. No go. I guess if I had to
face one of these, I'd have temporarily allow autoplay.
Any ideas?
Thank you,
Like many of security/malware conscious colleagues, the Sony DRM "Rootkit"
fiasco finally convinced me to disable AutoPlay via GPO. When I want to
install a program or simulate autorun, one of three things tends to happen:
1. The instructions say "Insert the CD-ROM. If it doesn't start by itself,
type Start->Run and then D:\setup.exe" or similar.
2. I look at the contents of the CD, locate and open autorun.inf, and enter
(or double-click) whatever follows OPEN=...
I even thought about writing a program to automate this for those less
familiar with poking around system related files.
3. Last week I went to install an HP OfficeJet driver and was confronted
with this autorun.inf:
----------------------------------------------------------------------------
--------
[C32]
SetupGlue=0
PdiOffset=..\AiO\hpopdi05.exe
GhoulOffset=hpzghl09.exe
PinOffset=..\AiO\hpopin05.exe
[C32.Dot4Usb]
SetupGlue=1
[C32.Dot4Usb HPZ12]
SetupGlue=1
[C32.Image]
SetupGlue=1
[C32.Printer]
SetupGlue=0
[hpoglu08]
COUNT=1
1=ClassInstall
[hpound08]
COUNT=1
1=ClassInstall
[hpousc08]
COUNT=1
1=PSC.Usb
[hpousb08]
COUNT=2
1=USBPRINT_Inst
2=ClassInstall
[hpzid412]
COUNT=10
1=psc_2100_Inst
2=psc_2200_Inst
3=psc_2150_Inst
4=psc_2170_Inst
5=oj_6100_Inst
6=psc_1000_Inst
7=psc_1100_Inst
8=psc_1200_Inst
9=oj_4100_Inst
10=oj_4105_Inst
[hpzist12]
COUNT=2
1=Dot4Storage_DDI
2=pdr.dev
[hpzius12]
COUNT=2
1=ClassInstall
2=HPDot4Usb_Inst
[hpzipr12]
COUNT=1
1=Dot4Print_Inst
[autorun]
open=setup.exe
icon=setup.exe,0
[Version]
CDGuid={A1062847-0846-427A-92A1-BB8251A91E91}
SoftwareGuid={B75BA3CB-EF2B-44C5-B7B2-94BB1502C398}
InfrastructureDatabaseList=hpomdl04.dat
LanguagesInthisCD=enu
DefaultLanguageInThisRelease=enu
DIVISION=hpo
ICE_REV=04
FIRST_IO_REVISION=08
LAST_IO_REVISION=08
VCD_FILEVER=10
Manufacturer=HP
RegistryManufacturer=Hewlett-Packard
ProductSeries=All-In-One Series
Pre-Install=%ProgramFiles%%Manufacturer%
SilentInstall=No
PreloadICEEngineToGUIDFolder=hpzprl01.dat
PreloadRecoveryMechanism=hpzprl02.dat
UI_03=Yes
UI_20=Yes
UI_25=No
UI_30=Yes
UI_50=No
......
------------------------------------------
GAH! I'll spare you the rest of the 2,633 lines in this file. I had no idea
you could do so much in an autorun.inf. Fortunately it was for a friend who
still had autorun enabled. I brought it home to play with on my
autorun-disabled system. Is there a way manually "execute" the autorun.inf
file? I trield "Install" from the context menu. No go. I guess if I had to
face one of these, I'd have temporarily allow autoplay.
Any ideas?
Thank you,