The Spykiller

The autorun/autoplay feature, when enabled, causes one of two things to happen depending on previously made choices.

1. When a cd-rom or dvd is inserted, or a usb device (camera, flashdrive, external hard drive, etc) is attached, Windows will open a message window that provides a list of actions to take based on the content of the device or media.
2. If on a prior occasion of the message window, the user selected to always perform the same action with certain types of media/device, there will be no message window opened upon detection of media/device. Instead, it will automatically run the previously selected program or execute the same behaviour.

• Example: with autorun/autoplay enabled you insert a music cd.: Windows will detect the cd and it's contents, then open a message window that might offer to play the cd with Media Player, Music Match Jukebox, or any of the many applications you may or may not have installed.

• Insert a Movie DVD and Windows might prompt you to view it with Power DVD, Media Player, etc.
  • Example: with autorun/autoplay enabled and on a previous prompt for action the box was checked to always apply the same action, Windows might automatically open Roxio CD Creator or Nero Burning ROM when a blank cd is inserted.
  • Plug in a usb camera and Windows might open or prompt you to use the Scanner and Camera Transfer Wizard to transfer the pictures to your computer.
  • Plug in a flash drive and Windows might open or prompt you to use Windows Explorer to browse the contents of the flash drive. Very commonly it will also just automatically execute an infection residing on the flash drive, thereby infecting your computer.
  • Insert a game cd or software cd, and Windows might automatically begin the installation setup.

Malware authors have begun to exploit the autorun/autoplay feature, so the author of ComboFix, in an effort to help protect your computer from becoming infected via that avenue, configured ComboFix to disable it.  Many other security apps disable it as well, and Microsoft recommends disabling it.

Disabling autorun/autoplay does not prevent you from accessing any of those media sources.

They are still available by:

• Opening My Computer and accessing the source drive (cd, dvd, usb flash or external hard drive).
• Pictures on a camera can still be accessed/transferred through My Pictures and selecting Get Pictures from a Scanner or Camera.
• Media can also be accessed via the program you intend to use it with, such as music cds accessed via Media Player,
• blank cds via your burning program, image handling software provided with the camera, etc.

I do recommend you leave the feature disabled and get into the habit of accessing those media devices manually, however, I will send you the information required to re-enable the autoplay feature should you decide to do so.