company ESET, which lists abuse of autorun.inf as first among the top ten threats in 2011. Attack mitigation In addition to basic security precautions, which include following the principle of least privilege by not habitually running with Administrator privileges and applying all relevant security patches and updates, exposure to these attacks can be minimised through the appropriate use of Group Policy and Registry settings. The following security policies are a summary of those described within this article: Disable AutoRun (but see the AutoRun disable bug) Use the "Default behavior for AutoRun" Group Policy under Vista (see above) to disable autorun.inf commands Use initialization file mapping to nullify autorun.inf sections Under Windows 7, only CD and DVD drives may specify applications like the AutoRun task in the autorun.inf file. Windows XP and later can be patched to behave in the same way with update . In February 2011, this patch was added to the official Windows Update channel. The Windows 7 AutoRun task behaviour now becomes the default for all current versions of the Windows OS. In addition, the following actions have been recommended by Microsoft, primarily during the Conficker worm attacks: Prevent autorun.inf invocation from network shares by: Deleting any existing autorun.inf file from the root of a mapped network drive Denying Create rights to the root of a mapped network drive Prevent the use of USB storage devices by means of: USB settings within the System BIOS Appropriate Registry settings as described in Knowledge Base article Setting USB devices to read only to prevent propagation of unknown worms (and theft of proprietary data) See also AutoPlay autorun.inf References External links AutoRun and AutoPlay Reference, Microsoft, MSDN Library Memory stick worms, Nick Brown's blog Autorun Protector, A standalone software that prevents PC from autorun worms and protects the removable device from being infected from other sources. Dan McCloy's Autorun Reference Guide Security Watch Island Hopping: The Infectious Allure of Vendor Swag, TechNet Magazine Figure 4: querycancelautoplay example code, Microsoft Systems Journal, September 1998 AutoPlay Repair Wizard, Microsoft Download Center Test your defenses against malicious USB flash drives, Computerworld blog, January 24, 2009 The best way to disable Autorun for protection from infected USB flash drives, Computerworld blog, January 30, 2009 How To Remove AutoRun Virus Microsoft PowerToys, Microsoft, Tweak UI Online Information Resource on the autorun/autostart feature of Microsoft Windows AutoRunConf simple configuration tool for Autorun settings. How to Enable