Skip to main content

How to stop automatic spreading of worms

One of the ways the Conficker worm and other, similar malware slimes its way from computer to computer is by taking advantage of the Autorun feature in Windows. If Conficker finds removable media (like a USB drive) on a PC it infects, it will infect that media in such a way that it will exploit Autorun to attempt to automatically infect a new computer when the drive is connected. Microsoft has shared instructions for manually disabling Autorun, but the steps are really meant for systems administrators rather than the average person. And up until this week, when Microsoft released a patch, the steps may not have even worked correctly, according to US-CERT. An easier solution, first posted by Nick Brown and then recommended by US-CERT, involves far fewer steps, but you'd still need to copy a few lines of code and create your own script. Not a big deal, but it could be easier. Enter your friendly neighborhood security blogger. I followed the steps described by Brown to create a ready-to-go script that you can simply download and double-click to disable AutoRun. And just to be thorough, I did the same for the step to turn it back on. I believe the script only works for Windows XP, but if you know differently, by all means let us know with a comment below. Also, it's important to note that if you turn off Autorun, you'll have to manually find and double-click installation programs and other things that would have been automatically started by Autorun. You might also run into trouble with U3 usb drives. But you will block off one of malware's dirty tricks.

Comments

Anonymous said…
Hello,

Very informative post and very useful...

This is Priya from SezWho here. I am writing to know your comments on the SezWho plug-in and any feedback that you may have which will help us to enhance the plug-in features and in turn help us serve you better.

Your feedback is important to us.

Look forward to your response.

Thanks
Priya
priya@sezwho.com
Bryan Arancon said…
As of now, i don't know how to use the plug-in...hehehe...Thanks!

Popular posts from this blog

The security log on this system is full. Only administrators can log on to fix the problem.

The security log on this system is full. Only administrators can log on to fix the problem. To resolve this issue, use an account that is a member of the Administrators group to log on to the computer. Then, follow these steps to specify that Security log events can be overwritten: 1. Click Start, point to All Programs, point to Administrative Tools, and then click Event Viewer. 2. Right-click Security, and then click Properties. 3. In the Log Size area of the Security Properties window, click the Overwrite events as needed option under When maximum log size is reached. 4. Click OK. 5. Close Event Viewer.

CWBLM0011 - An Internal License Management Error Occurred.

CWBLM0011 - An Internal License Management Error Occurred. RESA II started recieving error messages when users would sign on with client access express running on Windows 2000, the first client would connect but the second would get a license code error that said internal licensing error, here is a description from IBM's website, "Windows NT/2000 Restricted Users (User Group) attempting to start a 5250 terminal emulation session running Client Access Express (5769XE1) V5R1M0 receive a CWBLM0011 error message. This error does not occur when logged on to the PC as the Windows Administrator. The error appears more frequently when the users attempt to start multiple Client Access sessions." It appears to happen because the user doesn't have permissions to update some registry keys that client access likes to update occasionally, so this error message can happen at any time and doesn't appear to have any rhyme or reason. In RESA II's case, Tim believed it was ca...

ERROR [JDBCExceptionReporter:101] Communications link failure due to underlying exception: ** BEGIN NESTED EXCEPTION ** java.net.SocketException M

ERROR [JDBCExceptionReporter:101] Communications link failure due to underlying exception: ** BEGIN NESTED EXCEPTION ** java.net.SocketException MESSAGE: Broken pipe This error always comes out to my logs, while liferay is up but the good thing is it doesn't have an effect at all. The reason is that the application is left idle after a few hours, then this error will come out. To solve this kind of problem, you have to edit your portal-ext.properties file. In my case, i was connecting to MySQL 5 database and i want to share my settings of my portal-ext.properties file: