device is not running (by default, windows prohibits the automatic operation of devices such as 80 h, 10 h, 4 h, and 01h. The value accumulation is exactly 95 h in hexadecimal format, so NoDriveTypeAutoRun "has a default key value of, 00, (00 ).
From the above analysis, it is not difficult to see that by default, the four Reserved devices that will automatically run are DRIVE_NO_ROOT_DIR, DRIVE_FIXED, DRIV
to change the "NoDriveTypeAutoRun" key value to: BD, 00.
If you want to restore the autorun function of the hard drive or optical drive, perform a reverse operation.
In fact, Autorun is not required in the root directory of most hard disks. INF file to run the program, so we can completely disable the autorun function
for the root directoryDRIVE_REMOVABLE 2 1 04 h removable driveDRIVE_FIXED 3 0 08 h fixed driveDRIVE_REMOTE 4 1 10 h network driveDRIVE_CDROM 5 0 20 h Optical DriveDRIVE_RAMDISK 6 0 40 h RAM disk
Where: retain the drive type not specified for 7 1 80 h
The value "0" indicates that the device is running, and "1" indicates that the device is not running.As shown above, the corresponding DRIVE_NO_ROOT_DIR, DRIVE_FIXED, DRIVE_CDROM, and DRIVE_RAMDISK can b
Prevention Methods: USB flash drives with viruses to your computer and solutions to viruses:
1. When inserting a USB flash drive, press and hold the "shift" key on the keyboard until the message "devices can be used" is displayed. You can release the "shift" key. Do not double-click it when enabling the USB flash drive, do not use context menu.To open a single "open" option, use the Resource Manager(START-allProgram-Attachment-Windows resource manage
EndurerOriginal
2006-12-232Supplementary Revision2006-12-221Version
Yesterday afternoon, an error message box pops up after a friend's computer connected to the USB flash drive, prompting that disk A or something could not be found. After the USB flash drive is closed, it is called again. Let me help you.
Use WinRAR to open the USB flash drive and find the fileAutorun. infAndSss.exe, Which is generated immediately after deletion.
Download hijackthis and procview from http://endurer.ys168.com.
Ru
statement will be called because the sentence is set, when you double-click it, the corresponding ghost file will be searched.
Here we mainly introduce the application of the autorun section content, and for Autorun. alpha is rarely used, while deviceinstall can only be used in Windows XP. It can be used to specify subdirectories for recursive search in the hard
autorun. inf folder under the root directory of the drive. The principle is that the file in the same directory cannot be the same as the folder name. For the second point, we can create an undeletable directory in the autorun. inf folder we just created.
In Windows, the fo
Export ravmone.exe "," rose.exe "," sxs.exe "," copy.exe "," setup.exe "... the mysterious ghost in the root directory, the killer of system security, is called the "USB flash drive virus ". Countless Windows users are focusing on them. This article is a summary of your research on the USB flash drive virus and lessons learned from the fight against the USB flash drive virus.
Windows 95 and later systems al
According to the author: in view of the full introduction of autorun on the Internet. there are not many articles about the inf function. I found an autorun article on the official Microsoft website's official website, called "inf. description of inf in English. This article
startup ......First, autorun. the inf file exists for a long time. In other windows systems (such as Win98 and 2000) before WinXP, if you need to insert the CD and USB flash disk to the machine for automatic operation, you need to rely on autorun. inf.This file is stored in the root directory of the drive (a hidden sy
The virus is improving, and the anti-virus method is also improving.
The original virus spread through a USB flash drive usually writes an autorun. inf file under the root directory of the USB flash drive, so that users can accidentally double-click the USB flash drive to directly run the virus. So someone thought of creating an empty Autorun under the root dir
1. autorun. inf is a file used to manipulate the disk behavior in windows. It must be placed in the root directory of the disc. Some operations are also applicable to hard disks.2. autorun. inf can be disabled. The method is as follows:Click Start> Run and enter regedit or r
following values:
Device type not recognized by DKIVE_UNKNOWN 0101 h
DRIVE_NO_ROOT_DIR 1002 h Drive without the root directory (Drive without root directory)
DRIVE_REMOVABLE 2104 h Removable drive (Removable drive)
DRIVE_FIXED 3008 h Fixed drive (Fixed drive)
DRIVE_REMOTE 4110 h Network drive)
DRIVE_CDROM 5020 h drive (CD-ROM)
DRIVE_RAMDISK 6040 h RAM Disk (RAM Disk)
Retain the drive type not specified for 7180 h
The value 0 in the table listed above indicates that the device is running, and th
In Microsoft Systems, folders are also a type of file, but their attributes are special. In this case, files or folders with the same name cannot appear in the same folder according to Microsoft's regulations. Therefore, we can use this rule to create a folder named Autorun. inf to prevent the Autorun. inf virus.
This
today!
According to the opinions of cnlong friends on cnbeta, the test passes and uses Registry Editor + permission control to completely prevent autorun. inf calls when you double-click the drive letter. The specific method is as follows:
1. Start -- run -- Regedit;2. Locate HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \CurrentVersion \ Explorer \ mountpo
completed, and self-extracting files after disguise are often difficult to find exceptions, so we need to get a pair of eye-catching eyes.Iii. Use AutoRun. inf implementation program self-start using AutoRun. the self-starting method of inf implementation program is already quite old. Microsoft originally set this fun
Kill. bat
CopyCode The Code is as follows: @ echo off
Taskkill/f/IM virus .exe
CD \
For/d % I in (C, D, E, F, G, H, I, K, L, M, N, O, P, Q, R, s, T, U, V, W, X, Y, Z) Do attrib-s-a-r-H % I: \ autorun. INF attrib-s-a-r-H % I: \ virus .exe del % I: \ autorun. INF
Kill. vbsCopy codeThe Code is as follows: on error res
Situation
All the keys on the right run, and the 8-bit xxxxxx.exe and autorun. inf files appear under each disk.
Virus attacks such as viruses and Trojans are disabled on the Internet, and nod32 and other antivirus methods cannot be enabled.
Software
You cannot view hidden files. solution:
Method 1: Modify the Registry File (Save the following file in OK. reg) and run it.
Copy codeThe Code is as follows:
messy and consists of digital subtitles)
2. Restore anti-virus software
Anti-virus software cannot be started mainly because
HKLM/software/Microsoft/Windows NT/CurrentVersion/Image File Execution
This registry key is hijacked.
Switch to the Registry Editor in the ice edge window, browse HKEY_LOCAL_MACHINE/software/Microsoft/Windows NT/CurrentVersion/Image File Execution options, and view the corresponding
Release files
Copy codeThe Code is as follows: % Program Files % \ Internet Explorer \ PLUGINS \ Autorun. inf
% Program Files % \ Internet Explorer \ PLUGINS \ pagefile. pif
% Program Files % \ Internet Explorer \ PLUGINS \ WinNice. dll
X: \ Autorun. inf (X is a non-system disk with other drive letters)
X: \ pagef
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.