AutoRun curtailed in Windows 7 RC; XP, Vista to follow suit

Stephen Withers
Wednesday, 29 April 2009 05:25

Business IT - Technology

Microsoft has decided to significantly curtail Windows' AutoRun feature in order to help curtail the spread of malware. The change will appear in the Windows 7 Release Candidate and will also be applied to XP and Vista.

AutoRun is a Windows feature that automatically runs a program when a CD or other removable medium is inserted or connected to a computer.

Malware has been taking advantage of AutoRun for some time, but it has become a bigger issue recently thanks to Conficker and other pieces of unwanted software.

AutoPlay is a separate but related feature. It allows the selection of the programs that should start when particular types of media are inserted. AutoPlay does look for an Autorun.inf file on the media.

Beginning with the Windows 7 Release Candidate, AutoPlay will only support AutoRun on removable optical media, ie CDs and DVDs. This will stop malware such as Conficker spreading via USB sticks and other removable media.

The reasoning is that optical media is less likely to contain malware, while a read/write device such as a thumb drive can be infected relatively easily. Microsoft officials describe the decision as a balance between security and usability, and imply that it should maintain a reasonable level of convenience (the installer on a software CD will still be offered by AutoPlay) while improving protection.

As part of the change, the AutoPlay dialog now makes it clear that the program to be run comes from the media that was inserted, and is not one that's already installed.

Microsoft officials warn that devices that emulate CD or DVD drives (eg U3 flash drives) will be treated as optical media.

No indication was given concerning the expected arrival of updates that will implement the change on XP or Vista.