Autorun.inf 與注冊表NoDriveTypeAutoRun鍵值的一些說明
二進制位數 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
Type | 1 | RAMDISK | CDROM | REMOTE | FIXED | REMOVABLE | NO_ROOT_DIR | UNKNOWN |
名稱 | 內存 | 光驅 | 網絡映射 | 硬盤 | 移動存儲器 | 沒有盤符 | 不能識別 | |
十進制值 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
91(默認145) | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 1 |
95(默認149) | 1 | 0 | 0 | 1 | 0 | 1 | 0 | 1 |
F5(硬盤245) | 1 | 1 | 1 | 1 | 0 | 1 | 0 | 1 |
DD(光驅221) | 1 | 1 | 0 | 1 | 1 | 1 | 0 | 1 |
FF(推薦255) | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 |
1代表不可自動運行,0代表可自動運行。
我設置成FF也就是255,360幫我改成DD,安全性得到提升……
NoDriveTypeAutoRun 子項值重置為以下原始默認值之一:
操作系統 | 默認值 |
Microsoft Windows Server 2003 | 0x95 |
Microsoft Windows 2000 | 0x95 |
MicrosoftWindowsXP | 0x91 |
通過以上信息可判斷,XP與2000在默認設置情況下,XP開啟了U盤自動運行,所以默認設置下XP比2000要易感染U盤病毒。
注冊表代碼如下:
[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDrives"=dword:00000000
"NoViewOnDrive"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000004
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDrives"=dword:00000000
"NoViewOnDrive"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000004
;以下是在組策略中設置的鍵值,默認沒有設置時“本地User”下為空
;[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Group Policy Objects/本地User/Software/Microsoft/Windows/CurrentVersion/Policies /Explorer]
;"NoDriveTypeAutoRun"=dword:000000ff
;[HKEY_USERS/.DEFAULT/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer]
;"NoDriveTypeAutoRun"=dword:000000FF