Windows autorun. inf file is the culprit for the recent spread of Trojans and viruses

The ghost process exists. "Notepad" is automatically displayed when the system is started. It is also a worm. For solutions, see Http://www.openlab.net.cn/blogs/minady/archive/2006/05/26/539400.aspx
.
I want to talk about the operating principle of the virus. Like the previous virus, it runs itself through autorun. inf. In fact, after the Program enters the computer, it is difficult to run without execution conditions, therefore, you need to find a way for the user to execute the virus, but the user cannot be an idiot to run the program without a clear click. Therefore, the virus needs to pretend to be itself or be executed on a fake basis, this is the famous Windows Autorun. the inf file comes in handy. It can be said to be the entry to many Trojans and viruses.
Autorun. INF was originally used on a CD to enable automatic playback of files inserted on the CD. It was designed to make it easier for users to run a file without clicking it. This is exactly the reliable way for virus execution. It not only allows the CD to run the program automatically, but also enables the hard disk to run the program automatically. The method is simple. Open notepad, right-click the file, and select "RENAME" in the pop-up menu ", rename it Autorun. INF, in autorun. INF:
[Autorun] // indicates that the autorun part starts. You must enter
icon = c: \ c. ICO // give drive C a personalized drive letter icon for drive C. ICO
open = c: \ 1.exe // specifies the name and name of the program to be run. Here is the 1.exe file under the C drive
!
as you can see, if 1.exe is a virus execution file, you may accidentally insert a disc or double-click the drive letter to execute it. Most of the previously encountered viruses were executed through autorun. inf. It seems that Microsoft's autorun. inf file is a breeding ground for virus transmission!
in this case, we can disable Autorun by disabling the "Auto Run" function of the system drive. the inf file can be run in the Group Policy Editor gpedit. disable this function in MSC, or refer to the following Article :
http://lancao.blogdriver.com/lancao/1162271.html