Autorun. inf alternative immunization

Most common USB flash drives are immune to the registry, and directories with special file names are generated on the USB flash drives. Provides an alternative dynamic immune method.

The specific memory string in the Shell32.dll module of the Process Explorer can achieve the dynamic immunity automatically executed by the USB flash drive.

Shell32.dll version: 6.0.2800.1873

Imagebase: 7CD00000

. Text: 7CD8A162 push eax; lpString1
. Text: 7CD8A163 call ds: lstrcpynW
. Text: 7CD8A169 push offset aAutorun_inf_0; "AutoRun. inf"
. Text: 7CD8A16E lea eax, [esp + 0C5Ch + FileName]
. Text: 7CD8A175 push eax; lpString1
. Text: 7CD8A176 call ds: lstrcatW

Remove Autorun. Inf from the 7CD8A169 Push address [Note Unicode encoding]. Of course, you can change it to your preferred Automatic Execution name.

 

We also found an uncommon AppName:

Autorun

[AutoRun]
Open‑setup.exe

Both of the following appnames can be recognized:

"AutoRun. x86"
"AutoRun"