TIP: Click on subject to list as thread! ANSI
echo: nthelp
to: Gary Britt
from: Gary Britt
date: 2006-08-06 16:34:26
subject: Re: Gotcha

From: "Gary Britt" 

This is a multi-part message in MIME format.

------=_NextPart_000_0074_01C6B976.2EA62E00
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

Oh and I forgot this one specific to CD-Roms but also a good reminder =
that the NoDriveTypeAutoRun and NoDriveAutoRun registry keys have to be =
set in both the HKLM branch and the HKCU branch of the registry.

AutoRun and AutoRunAlwaysDisable are found in the reg key =
HKLM\SYSTEM\CurrentControlSet\Services\Cdrom and can be manipulated to =
help make sure CD-ROM's don't autoplay. Description

Suppresses the Media Change Notification (MCN) message for particular =
CD-ROM drives.

By default, the system sends an MCN message when a CD-ROM is inserted in =
a CD-ROM drive. The MCN message triggers media features, such as =
Autoplay. When the MCN message is suppressed, these media features do = not
operate.

This entry identifies devices that do not support media features. =
Typically, this list consists of CD-ROM changers that do not support =
Autoplay because they must load the media physically to verify that it = is
a compact disc before playing.

The entries in this list need not be complete device identifiers. The =
system suppresses the MCN message for all devices that begin with the =
characters of an entry in the list. This method makes it easier to =
disable media features for all products of a certain vendor or product =
line.

Note
If the value of this entry is not blank, it takes precedence over a = value
of 1 in AutoRun for the particular devices identified.

If a device is identified in this list, Autoplay does not operate on the =
device, regardless of the value of the NoDriveAutoRun entry (in HKLM and =
HKCU) and the NoDriveTypeAutoRun entry (in HKLM and HKCU).

The identifiers listed in this value are those reported to the system by =
the device. These identifiers might differ from those listed on the = drive
housing.

The default value for this entry consists of products and product groups =
that have been identified through testing as being unable to support =
Autoplay. This list might change as testing progresses and products are =
updated.

To disable Autoplay on particular drives, use the NoDriveAutoRun entry =
(HKLM or HKCU) or the NoDriveTypeAutoRun entry (HKLM or HKCU). Do not =
disable the MCN message unless you have no alternative.

Related Entries
Autorun
NoDriveAutoRun (in HKLM)
NoDriveAutoRun (in HKCU)
NoDriveTypeAutoRun (in HKLM)
NoDriveTypeAutoRun (in HKCU)

Gary

  "Gary Britt"  wrote in message =
news:44d64b6f{at}w3.nls.net...

  What if you change the default action for Drive, Folder, and File =
Folder to=20
  "Explore" from "Open" using either PC Mag's Context Edit or =
tools-folder=20
  options-file types. Given Rich's post maybe that would keep it from =
auto=20
  running?

  I've done the following three things (In addition to changing the =
default action for Drives, Folders, and File Folders to Explore from =
Open) to disable Autoplay on my laptop, but I don't have a=20
  USB drive to test with.  I believe doing all of this should work for a =
USB drive.

  1.  Use Tweak UI powertoy - my computer - autoplay and turn off =
autoplay and manually deselect every possible drive letter for autoplay. =
 I did not edit the autoplay handler programs.

  2.  In order to keep shell media change notification from triggering =
an autoplay event when media is changed or inserted I have disabled the =
"Shell Hardware Detection Service" which provides notifications
for = AutoPlay hardware events.

  3.  To Disable CD autoplay, completely, in Windows XP Home (And =
Probably XP Pro)
  Click Start, Run and enter REGEDIT Then go to:
  =
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Expl=
orer

  Create a new value called: NoDriveTypeAutoRun
  Type is: DWORD
  Value is: 0x0000007C (124)
  This value should turn off autoplay for the 5 types of drives =
(Removable, Fixed, Remote, CDRom, and Ramdisk)

  Create a new value called: NoDriveAutoRun
  Type is: DWORD or 4-byte BINARY
  Value is: 0x03FFFFFF DWORD or FF FF FF 03 Binary (My Computer is using =
the Binary value and resulted from using TweakUI and turning off =
(deselecting) all drive letters.  This then should turn off autoplay for =
all drive letters A thru Z.

  To Disable CD autoplay, completely, in Windows XP Pro
  1) Click Start, Run and enter GPEDIT.MSC
  2) Go to Computer Configuration, Administrative Templates, System.
  3) Locate the entry for Turn autoplay off and modify it as you desire.



  The above values were deduced by me using the following information:

  From =
http://msdn.microsoft.com/library/en-us/shellcc/platform/shell/programmer=
sguide/shell_basics/shell_basics_extending/autorun/autoplay_reg.asp?frame=
=3Dtrue

  Using the Registry to Disable AutoRun
  There are two registry values that can be used to persistently disable =
AutoRun: NoDriveAutoRun and NoDriveTypeAutoRun. The first value disables =
AutoRun for specified drive letters and the second disables AutoRun for = a
class of drives. If either of these values is set to disable AutoRun = for
a particular device, it will be disabled.=20

  Note The NoDriveAutoRun and NoDriveTypeAutoRun values should only be =
modified by system administrators to change the value for the entire =
system for testing or administrative purposes. Applications should not =
modify these values, as there is no way to reliably restore them to = their
original values.=20

  The NoDriveAutoRun value disables AutoRun for specified drive letters. =
It is a REG_DWORD data value, found under the following key:=20

    HKEY_CURRENT_USER=20
    Software=20
    Microsoft=20
    Windows=20
    CurrentVersion=20
    Policies=20
    Explorer
  The first bit of the value corresponds to drive A:, the second to B:, =
and so on. To disable AutoRun for one or more drive letters, set the =
corresponding bits. For example, to disable the A: and C: drives, set =
NoDriveAutoRun to 0x00000005.=20

  The NoDriveTypeAutoRun value disables AutoRun for a class of drives. =
It is a REG_DWORD or 4-byte REG_BINARY data value, found under the same = key.=20

    HKEY_CURRENT_USER=20
    Software=20
    Microsoft=20
    Windows=20
    CurrentVersion=20
    Policies=20
    Explorer
  By setting the bits of this value's first byte, different drives can =
be excluded from working with AutoRun.=20

  The following table gives the bits and bitmask constants, that can be =
set in the first byte of NoDriveTypeAutoRun to disable AutoRun for a =
particular drive type. For Microsoft Windows NT and later systems, you =
must restart Windows Explorer before the changes take effect.=20

        Bit Number=20
       Bitmask Constant=20
       Description=20
      =20
        0x04=20
       DRIVE_REMOVEABLE=20
       Disk can be removed from drive (such as a floppy disk).=20
      =20
        0x08=20
       DRIVE_FIXED=20
       Disk cannot be removed from drive (a hard disk).=20
      =20
        0x10
       DRIVE_REMOTE=20
       Network drive.=20
      =20
        0x20
       DRIVE_CDROM=20
       CD-ROM drive.=20
      =20
        0x40
       DRIVE_RAMDISK=20
       RAM disk.=20
      =20


  AutoRun for Other Types of Storage Media
  AutoRun is primarily intended for public distribution of applications =
on CD-ROM and DVD-ROM. However, it is often useful to enable AutoRun on =
other types of removable storage media. This feature is typically used =
simplify the debugging of AutoRun.inf files. AutoRun only works on =
removable storage devices when the following criteria are met:=20

  The device must have AutoRun-compatible drivers. To be =
AutoRun-compatible, a driver must notify the system that a disk has been =
inserted by sending a WM_DEVICECHANGE message.=20

  The root directory of the inserted media must contain an Autorun.inf =
file.=20

  The device must not have AutoRun disabled through the registry.=20

  The foreground application has not suppressed AutoRun.=20

  Note This feature should not be used to distribute applications on =
floppy disks. Because implementing AutoRun on a floppy disk provides an =
easy way to spread computer viruses, users should be suspicious of any =
publicly distributed floppy disk that contains an Autorun.inf file.=20

  Normally, AutoRun starts automatically, but it can also be started =
manually. If the device meets the criteria listed above, the drive =
letter's shortcut menu will include an AutoPlay command. To run AutoRun =
manually, either right-click the drive icon and select AutoPlay from the =
shortcut menu or double-click the drive icon. If the drivers are not =
AutoRun-compatible, the shortcut menu will not have an AutoPlay item and =
AutoRun cannot be started.=20

  AutoRun-compatible drivers are provided with some floppy disk drives, =
as well as some other types of removable media such as CompactFlash =
cards. AutoRun also works with network drives that are mapped to a drive =
letter with Windows Explorer or mounted with the Microsoft Management =
Console (MMC). As with mounted hardware, a mounted network drive must =
have an Autorun.inf file in its root directory, and must not be disabled =
through the registry.=20





  And also From:  http://support.microsoft.com/?kbid=3D185590

  REGISTRY ENTRIES NOT INCLUDED IN THE SYSTEM POLICY EDITOR
  The following section describes the locations and values for useful =
registry entries that are available in the operating system, but not =
available in the System Policy Editor.

  Autorun:
  Category: Windows NT Shell
  Subcategory: Removable media
  Description: Determines whether the Autorun feature is enabled on each =
drive connected to the system. When Autorun is enabled, media is started =
automatically when it is inserted in the drive. This value is comprised =
of 32 bits. The lower 26 bits each represent a drive, with the lowest =
(right- most) bit representing drive A and the 26th bit from the right =
representing drive Z. If a bit is set to 0, the autorun feature is =
enabled on that drive. If a bit is set to 1, the autorun feature is =
disabled on that drive.

  For example, if the value of this entry is 0x8 (1000 binary), autorun =
is disabled on drive D. Note that a value of 1 in the bit representing =
the CD- ROM drive takes precedence over the value of Autorun.
  Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion =
\Policies\Explorer

  Registry Value Registry Data Description
  NoDriveAutoRun REG_DWORD 0x0 - 0x3FFFFFF


  Note From Gary:

  In Binary the bits look like this: 000000011111111111111111111111111

  Setting 1 (True) on each bit from the right most bit to the 26th right =
most bit turns off AutoRun on all 26 drive letters and =
000000011111111111111111111111111 =3D 0x3FFFFFF


  See if doing all of the above works for you.

  Gary




  "John Beckett" 
wrote in message =

  news:dfdbd219opk3rrnpnhbsfojdola86n8c4g{at}4ax.com...
  > Mike N.  wrote in message
  > news::
  >>   Is there a way to turn off the autorun property for USB sticks?
  >
  > Yes, but you must be aware of this issue:
  > 1. You disable autorun.
  > 2. Double-clicking the USB in My Computer *will* autorun!!!
  >
  > What I described runs code AFTER you have disabled autorun.
  >
  > I have seen so much junk documentation on autorun that my head is
  > spinning. I think the key point for most users is what they click =
when
  > they insert a USB disk the first time. Of course I don't remember =
exactly
  > what happens, but I recall a window where you got various options.
  >
  > Following are some clues, but I have not got to the bottom of this =
issue
  > or found the "best" article:
  > http://support.microsoft.com/kb/126025
  > http://www.microsoft.com/whdc/device/storage/usbfaq.mspx
  >
  > Registry:
  > HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  > HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer
  > HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
  >
  > John
  >=20


------=_NextPart_000_0074_01C6B976.2EA62E00
Content-Type: text/html;
        charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable








Oh and I forgot this one specific to
CD-Roms but =
also a=20
good reminder that the NoDriveTypeAutoRun and NoDriveAutoRun registry = keys have=20
to be set in both the HKLM branch and the HKCU branch of the=20
registry.
AutoRun and=20
AutoRunAlwaysDisable are found in = the reg key=20
HKLM\SYSTEM\CurrentControlSet\Services\Cdrom and can be manipulated to = help make=20
sure CD-ROM's don't autoplay.

DescriptionSuppresses the Media Change Notification (MCN) message for =
particular=20
CD-ROM drives.
By default, the system sends an MCN =
message when a=20
CD-ROM is inserted in a CD-ROM drive. The MCN message triggers media = features,=20
such as Autoplay. When the MCN message is suppressed, these media = features do=20
not operate.
This entry identifies devices
that do not =
support=20
media features. Typically, this list consists of CD-ROM changers that do = not=20
support Autoplay because they must load the media physically to verify = that it=20
is a compact disc before playing.
The entries in this list need not be =
complete device=20
identifiers. The system suppresses the MCN message for all devices that = begin=20
with the characters of an entry in the list. This method makes it easier = to=20
disable media features for all products of a certain vendor or product=20
line.
NoteIf the value of this entry is not blank, it takes =
precedence over a=20
value of 1 in AutoRun=20
for the particular devices=20
identified.
If a device is identified in this list, Autoplay =
does not=20
operate on the device, regardless of the value of the =
NoDriveAutoRun=20
entry (in HKLM and HKCU) and the NoDriveTypeAutoRun
entry (in = HKLM and=20
HKCU).
The identifiers listed in this value are those =
reported to=20
the system by the device. These identifiers might differ from those = listed on=20
the drive housing.
The default value for this entry consists of =
products and=20
product groups that have been identified through testing as being unable = to=20
support Autoplay. This list might change as testing progresses and = products are=20
updated.
To disable Autoplay on particular drives,
use the=20
NoDriveAutoRun entry (HKLM or HKCU) or the =
NoDriveTypeAutoRun=20
entry (HKLM or HKCU). Do not disable the MCN message unless you have no=20
alternative.
Related
EntriesAutorunNoDriveAutoRun (in =

HKLM)NoDriveAutoRun (in =

HKCU)NoDriveTypeAutoRun = (in=20
HKLM)NoDriveTypeAutoRun = (in=20
HKCU)
Gary
"Gary Britt" <glb{at}gencog.com>=20">mailto:glb{at}gencog.com">glb{at}gencog.com>=20 wrote in message news:44d64b6f{at}w3.nls.net... What if you change the default action for = Drive, Folder,=20 and File Folder to "Explore" from "Open" using either PC Mag's = Context=20 Edit or tools-folder options-file types. Given Rich's post maybe = that=20 would keep it from auto running?I've done the = following=20 three things (In addition to changing the default action for Drives, = Folders,=20 and File Folders to Explore from Open) to disable Autoplay = on my=20 laptop, but I don't have a USB drive to test with. I believe = doing=20 all of this should work for a USB drive.1. Use = Tweak UI=20 powertoy - my computer - autoplay and turn off autoplay and manually = deselect=20 every possible drive letter for autoplay. I did not edit the = autoplay=20 handler programs. 2. In order to keep shell media change=20 notification from triggering an autoplay event when media is changed=20 or inserted I have disabled the "Shell Hardware Detection = Service" which=20 provides notifications for AutoPlay hardware events. 3. To Disable CD autoplay, completely, = in Windows=20 XP Home (And Probably XP Pro) Click Start, Run and enter REGEDIT Then go=20 = to:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Polici= es\ExplorerCreate=20 a new value called: NoDriveTypeAutoRunType is: DWORDValue is:=20 0x0000007C (124)This value should turn off autoplay for the 5 = types of=20 drives (Removable, Fixed, Remote, CDRom, and Ramdisk)Create a = new=20 value called: NoDriveAutoRunType is: DWORD or 4-byte = BINARYValue is:=20 0x03FFFFFF DWORD or FF FF FF 03 Binary (My Computer is using the = Binary value=20 and resulted from using TweakUI and turning off (deselecting) all = drive=20 letters. This then should turn off autoplay for all drive = letters A thru=20 Z. To Disable CD autoplay, completely, in Windows = XP=20 Pro1) Click Start, Run and enter GPEDIT.MSC2) Go to Computer=20 Configuration, Administrative Templates, System.3) Locate the = entry for=20 Turn autoplay off and modify it as you desire. The above values were deduced by me using the = following=20 information: From http://msdn.microsoft.com/library/en-us/shellcc/platform/shell/pr= ogrammersguide/shell_basics/shell_basics_extending/autorun/autoplay_reg.a= sp?frame=3Dtrue">http://msdn.microsoft.com/library/en-us/shellcc/platform= /shell/programmersguide/shell_basics/shell_basics_extending/autorun/autop= lay_reg.asp?frame=3Dtrue Using the Registry to Disable = AutoRun There are two registry values that can be used = to=20 persistently disable AutoRun: NoDriveAutoRun and NoDriveTypeAutoRun. = The first=20 value disables AutoRun for specified drive letters and the second = disables=20 AutoRun for a class of drives. If either of these values is set to = disable=20 AutoRun for a particular device, it will be disabled. Note The NoDriveAutoRun and NoDriveTypeAutoRun = values=20 should only be modified by system administrators to change the value = for the=20 entire system for testing or administrative purposes. Applications = should not=20 modify these values, as there is no way to reliably restore them to = their=20 original values. The NoDriveAutoRun value disables AutoRun for = specified=20 drive letters. It is a REG_DWORD data value, found under the following = key:=20 HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Policies Explorer The first bit of the value corresponds to drive = A:, the=20 second to B:, and so on. To disable AutoRun for one or more drive = letters, set=20 the corresponding bits. For example, to disable the A: and C: drives, = set=20 NoDriveAutoRun to 0x00000005. The NoDriveTypeAutoRun value disables AutoRun = for a class=20 of drives. It is a REG_DWORD or 4-byte REG_BINARY data value, found = under the=20 same key. HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Policies Explorer By setting the bits of this value's first byte, = different=20 drives can be excluded from working with AutoRun. The following table gives the bits and bitmask = constants,=20 that can be set in the first byte of NoDriveTypeAutoRun to disable = AutoRun for=20 a particular drive type. For Microsoft Windows NT and later systems, = you must=20 restart Windows Explorer before the changes take effect. Bit Number Bitmask Constant = Description = 0x04 DRIVE_REMOVEABLE Disk can be removed from drive (such as a = floppy=20 disk). 0x08 DRIVE_FIXED Disk cannot be removed from drive (a hard = disk).=20 0x10 DRIVE_REMOTE Network drive. 0x20 DRIVE_CDROM CD-ROM drive. 0x40 DRIVE_RAMDISK RAM disk. = AutoRun for Other Types of = Storage=20 Media AutoRun is primarily intended for public = distribution of=20 applications on CD-ROM and DVD-ROM. However, it is often useful to = enable=20 AutoRun on other types of removable storage media. This feature is = typically=20 used simplify the debugging of AutoRun.inf files. AutoRun only works = on=20 removable storage devices when the following criteria are met: = The device must have AutoRun-compatible drivers. = To be=20 AutoRun-compatible, a driver must notify the system that a disk has = been=20 inserted by sending a WM_DEVICECHANGE message. = The root directory of the inserted media must = contain an=20 Autorun.inf file. The device must not have AutoRun disabled = through the=20 registry. The foreground application has not suppressed=20 AutoRun. Note This feature should not be used to = distribute=20 applications on floppy disks. Because implementing AutoRun on a floppy = disk=20 provides an easy way to spread computer viruses, users should be = suspicious of=20 any publicly distributed floppy disk that contains an Autorun.inf = file.=20 Normally, AutoRun starts automatically, but it = can also be=20 started manually. If the device meets the criteria listed above, the = drive=20 letter's shortcut menu will include an AutoPlay command. To run = AutoRun=20 manually, either right-click the drive icon and select AutoPlay from = the=20 shortcut menu or double-click the drive icon. If the drivers are not=20 AutoRun-compatible, the shortcut menu will not have an AutoPlay item = and=20 AutoRun cannot be started. AutoRun-compatible drivers are provided with = some floppy=20 disk drives, as well as some other types of removable media such as=20 CompactFlash cards. AutoRun also works with network drives that are = mapped to=20 a drive letter with Windows Explorer or mounted with the Microsoft Management Console (MMC). As=20 with mounted hardware, a mounted network drive must have an = Autorun.inf file=20 in its root directory, and must not be disabled through the registry.=20 And also From: http://support.micro" target="new">http://support.micro=">http://support.microsoft.com/?kbid=3D185590">http://support.micro= soft.com/?kbid=3D185590 REGISTRY ENTRIES NOT INCLUDED IN THE SYSTEM POLICY EDITOR The following section describes the locations and values for useful = registry entries that are available in the operating system, but not = available=20 in the System Policy Editor.Autorun:Category: Windows NT=20 ShellSubcategory: Removable mediaDescription: Determines = whether the=20 Autorun feature is enabled on each drive connected to the system. When = Autorun=20 is enabled, media is started automatically when it is inserted in the = drive.=20 This value is comprised of 32 bits. The lower 26 bits each represent a = drive,=20 with the lowest (right- most) bit representing drive A and the 26th = bit from=20 the right representing drive Z. If a bit is set to 0, the autorun = feature is=20 enabled on that drive. If a bit is set to 1, the autorun feature is = disabled=20 on that drive.For example, if the value of this entry is 0x8 = (1000=20 binary), autorun is disabled on drive D. Note that a value of 1 in the = bit=20 representing the CD- ROM drive takes precedence over the value of=20 Autorun.Key: = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion=20 \Policies\ExplorerRegistry Value Registry Data=20 DescriptionNoDriveAutoRun REG_DWORD 0x0 - 0x3FFFFFF Note From Gary: In Binary the bits look like this:=20 000000011111111111111111111111111Setting 1 (True) on each bit = from the=20 right most bit to the 26th right most bit turns off AutoRun on all 26 = drive=20 letters and 000000011111111111111111111111111 =3D = 0x3FFFFFF See if doing all of the above works for=20 you. Gary "John = Beckett"=20 <mailto:FirstnameSurname{at}compuserve.com.omit"> face=3DArial>FirstnameSurname{at}compuserve.com.omit> wrote in message news:dfdbd219opk3rrnpnhbsfojdola86n8c4g{at}4ax.com...> Mike N. <mailto:mike{at}u-spam-u-die.net"> face=3DArial>mike{at}u-spam-u-die.net> = wrote in=20 message> news:<lrg9d2d28kpb7l31bafbqiq005mti7tip9{at}4ax.com>:>> Is there a way to turn off = the=20 autorun property for USB sticks?>> Yes, but you must be = aware of=20 this issue:> 1. You disable autorun.> 2. Double-clicking = the USB=20 in My Computer *will* autorun!!!>> What I described runs = code=20 AFTER you have disabled autorun.>> I have seen so much = junk=20 documentation on autorun that my head is> spinning. I think the = key=20 point for most users is what they click when> they insert a USB = disk=20 the first time. Of course I don't remember exactly> what = happens, but I=20 recall a window where you got various options.>> = Following are=20 some clues, but I have not got to the bottom of this issue> or = found=20 the "best" article:> ">http://support.microsoft.com/kb/126025"> = face=3DArial>http://support.microsoft.com/kb/126025 face=3DArial>> ">http://www.microsoft.com/whdc/device/storage/usbfaq.mspx"> = face=3DArial>http://www.microsoft.com/whdc/device/storage/usbfaq.mspx= NT>>> Registry:>=20 = HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer> = = HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer> = = HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2&= gt;>=20 John> ------=_NextPart_000_0074_01C6B976.2EA62E00-- --- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
SEEN-BY: 633/267 270 5030/786
@PATH: 379/45 1 106/2000 633/267

SOURCE: echomail via fidonet.ozzmosis.com

Email questions or comments to sysop@ipingthereforeiam.com
All parts of this website painstakingly hand-crafted in the U.S.A.!
IPTIA BBS/MUD/Terminal/Game Server List, © 2025 IPTIA Consulting™.