AutoRun

AutoRun activation

The AutoRun process kicks off when Windows first detects a new device or piece of media. Once that happens, the system notifies any interested parties, most importantly the Windows Explorer shell. Before anything else, Windows checks certain Registry settings to confirm AutoRun is allowed. If it is, the system may look for an optional autorun.inf file, parse it, and carry out any actions it specifies.

This initial detection and notification sequence has stayed largely the same since Windows 95. However, how the autorun.inf file is read and used, along with how AutoRun integrates with AutoPlay, has shifted significantly from when AutoPlay first appeared in Windows XP through to the way things work in Windows 7. In Windows 10, Microsoft added a setting to turn AutoRun on, and users can also pick which specific external devices should trigger autoplay.

When a device with AutoRun-compatible drivers gets new media, a Media Change Notification event fires. Windows then tells any interested applications that a device change happened.

The method of notification depends on the type of device. If the device is a volume, like a CD, or a port, like a serial port, Windows sends a basic notification to all top-level windows—those that are descendants of the desktop. For other device types, an application must register separately to receive device notifications.

Non-volume devices are those that don’t show up as drive letters in My Computer. AutoRun doesn’t handle these at all; any actions for them come from device-specific software or from AutoPlay.

When Explorer gets a volume change notification, it first checks the Registry to see if AutoRun is disabled for that drive or drive type. If it is, Explorer stops. If not, it checks whether the root directory of the inserted media contains an autorun.inf file.

Registry settings

AutoRun determines whether to take action for a given drive or drive type by checking values in the Windows Registry. These values can be altered through various methods, including Group Policy. The Registry is a hierarchical database that holds configuration settings for the operating system.

A Registry key works like a folder: it can contain subkeys, which themselves may hold further subkeys, and so on. A Registry value is a name-data pair, and Microsoft documentation often calls this pair an "entry," sometimes using "value" to mean "data" when the context is clear. To avoid confusion, this entry always uses "entry" for the name-data pair.

Two commonly referenced Registry keys are the one for per-machine settings and the one for the currently logged-on user, usually abbreviated as HKLM and HKCU. A machine may have many users; their individual settings are stored under HKCU, which is actually a link to the appropriate location within the user's profile hive. Registry settings can be changed directly using the GUI tool or the command-line utility.

They can also be placed in a text file with a .reg extension; double-clicking that file enters the settings into the Registry, provided permissions allow. Indirect changes come through Group Policy, applied locally with one tool or to a domain with another. Logging out or restarting the computer may be needed for changes to take effect.

The relevant Registry entries for AutoRun exist in two places: a per-user setting under HKEY_CURRENT_USER and a per-machine setting under HKEY_LOCAL_MACHINE. If an entry exists under HKEY_LOCAL_MACHINE, any matching entry under HKEY_CURRENT_USER is completely ignored; the data values are never merged. When deciding whether to activate AutoRun, both entries are consulted. If either value indicates a drive should be disabled, AutoRun is disabled for that drive.

Altering AutoRun behaviour

Holding down the left Shift key at a specific moment during the execution sequence will cause Windows Vista to show the AutoPlay dialog, even if the user's AutoPlay settings would normally prevent it. In earlier Windows versions, this action does not trigger the AutoRun task. It is important to use the left Shift key, because pressing the right Shift key for eight seconds activates FilterKeys instead.

The Shift key must be held down until the operating system checks for it, which can take a noticeable amount of time. How long it takes depends mainly on how quickly the new hardware is recognized and how long a CD-ROM drive needs to spin up. This method is not reliable and should not be depended upon.

Auto Insert Notification

Certain Media Change Notification events can be suppressed by modifying specific Registry entries. Media Change Notification is the general term; for CD-ROM drives, the specific term is Auto Insert Notification. For CD-ROM drives, setting the value of this Registry entry to 0 will disable Auto Insert Notification for those drives only, and a Windows restart is required afterward. On Windows 95, 98, and ME, this setting can be adjusted through Device Manager, which is accessed from the System icon in Control Panel.

Even though the Registry entry is named AutoRun, it actually only suppresses the Media Change Notification (MCN) message. The MCN message is what triggers AutoRun to start, but it also tells the Explorer shell to refresh its views and contents. As a side effect, disabling the MCN message does turn off AutoRun for CD-ROM drives. However, Explorer will no longer update its display when a new CD is inserted; it will continue to show the contents of the previous disc until the user presses F5 or selects View/Refresh from the Explorer menu.

This can cause significant confusion for users. For this reason, the Media Change Notification message should not be disabled unless there is absolutely no other option. AutoRun can be disabled for individual drives using Group Policy or the Registry.

Issues and security

Microsoft acknowledged that AutoRun could execute code without a user's knowledge or consent, and offered a Fixit tool for those who wanted to disable it without editing the registry manually. A security flaw existed in Windows 2000 through Windows Server 2008, where AutoRun-related registry entries were not correctly processed, though Windows 95 and 98 were unaffected. Even when AutoRun is turned off, Windows still reads any autorun.inf file it finds and performs all steps except the final one that launches AutoPlay or runs an application.

This partial processing leaves a vulnerability: malware can use the autorun.inf to hijack double-click and context menu actions. Simply double-clicking the drive icon can infect the system, and right-clicking to choose "Explore" or "Open" is not safe, as those menu options can also be redirected by the same file. Microsoft addressed this bug in several security updates, documented in Knowledge Base article 967715.

AutoRun has long been exploited as a malware delivery method. Before Windows Vista, inserting a CD-ROM would automatically follow any autorun.inf instructions without any prompt or warning, making rogue discs a straightforward infection path. Mixed-content audio CDs, which users would not expect to contain software, could hide a data section with an autorun.inf. Sony BMG, for instance, used this technique to install copy-protection malware.

U3-enabled flash drives mimic a CD-ROM, allowing Windows to execute commands from the autorun.inf on the emulated drive. Some legitimate devices, like the Huawei E220 HSDPA modem, use this method to auto-install drivers. However, plugging in an unknown flash drive is risky. Tools like USB Switchblade make attacks with U3 drives trivial, and because script-based attacks are easy to write, antivirus software may not reliably prevent data or password theft.

Did You Know?

• AutoPlay, introduced in Windows XP, examines removable media and devices and, based on content such as pictures, music or video files, launches an appropriate application to play or display the content.