Autorun.inf

Last updated

An autorun.inf file is a text file that can be used by the AutoRun and AutoPlay components of Microsoft Windows operating systems. For the file to be discovered and used by these component, it must be located in the root directory of a volume. As Windows has a case-insensitive view of filenames, the autorun.inf file can be stored as AutoRun.inf or Autorun.INF or any other case combination.

Contents

The AutoRun component was introduced in Windows 95 as a way of reducing support costs. AutoRun enabled application CD-ROMs to automatically launch a program which could then guide the user through the installation process. By placing settings in an autorun.inf file, manufacturers could decide what actions were taken when their CD-ROM was inserted. The simplest autorun.inf files have just two settings: one specifying an icon to represent the CD in Windows Explorer (or "My Computer") and one specifying which application to run.

Extra settings have been added in successive versions of Windows to support AutoPlay and other new features.

The autorun.inf file

autorun.inf is an ASCII text file located in the root folder of a CD-ROM or other volume device medium (See AutoPlay device types). The structure is that of a classic Windows .ini file, containing information and commands as "key=value" pairs, grouped into sections. [1] These keys specify:

Abuse

Autorun.inf has been used to execute a malicious program automatically, without the user knowing. [2] [3] [4] [5] This functionality was removed in Windows 7 and a patch for Windows XP and Vista was released on August 25, 2009 and included in Microsoft Automatic Updates on February 8, 2011. [3] [5] [6] [7]

Inf handling

The mere existence of an autorun.inf file on a medium does not mean that Windows will automatically read it or use its settings. How an inf file is handled depends on the version of Windows in use, the volume drive type and certain Registry settings.

Assuming Registry settings allow, the following autorun.inf handling takes place:

On any drive type, the autorun.inf is read, parsed and instructions followed immediately and silently. [8]
The "AutoRun task" is the application specified by the open or shellexecute keys. If an AutoRun task is specified it is executed immediately without user interaction.
Introduction of AutoPlay.
Drives of type DRIVE_CDROM invoke AutoPlay if no autorun.inf file is found.
Drives of type DRIVE_REMOVABLE do not use the autorun.inf file. [1] Any discovered removable media are handled by AutoPlay.
All other handling is as before.
Drives of type DRIVE_FIXED are now handled by AutoPlay. Any specified AutoRun task appears as an option within the AutoPlay dialog together with any text specified by the optional action key. [9]
Drives of type DRIVE_REMOVABLE now use autorun.inf but continue to be handled by AutoPlay. Any specified AutoRun task needs to be paired with the mandatory action key to appear as an option within the AutoPlay dialog. Otherwise the AutoRun task is omitted. [9]
All other handling is as before.
The AutoRun task is no longer automatically and silently executed on any drive type. All volumes are handled by AutoPlay which, by default, will present an appropriate dialog to the user.
For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored. Thus only CD and DVD media types can specify an AutoRun task or affect double-click and right-click behaviour. [9] [10]
There is a patch available, KB971029 for Windows XP and later, that will change AutoRun functionality to this behaviour. [11]

A simple example

This simple autorun.inf file specifies setup.exe as the application to run when AutoRun is activated. The first icon stored within setup.exe itself will represent the drive in Explorer:

[autorun]open=setup.exeicon=setup.exe,0label=My install CD

Sections

Following are the sections and keys allowed in a valid autorun.inf. [9] There also exist architecture specific section types for systems such as Windows NT 4 running on RISC. However these are long outdated and not described here.

[autorun]

The autorun section contains the default AutoRun commands. An autorun.inf file must contain this section to be valid. Keys allowed are:

action=text
action=@[filepath\]filename,-resourceID
Windows XP SP2 or later; drives of type DRIVE_REMOVABLE and DRIVE_FIXED
Specifies text used in the AutoPlay dialog to represent the program specified in the open or shellexecute keys. The text is expressed as either text or as a resource reference. The icon is displayed next to the text. This item is always first in the AutoPlay dialog and is always selected by default.
If the (action) key does not appear on drives of type:
DRIVE_REMOVABLE
the AutoPlay dialog appears but without additional menu items. Essentially, the AutoRun task is omitted. This makes the action key mandatory for drives of this type.
DRIVE_FIXED
default text is created and used in the AutoPlay dialog.
On all other drive types the key is ignored.
icon=iconfilename[,index]
The name of a file resource containing an icon. This icon replaces the standard drive icon in Windows Explorer. This file must be in the same directory as the file specified by the open key.
label=text
Specifies a text label representing the drive in Windows Explorer.
open=[exepath\]exefile [param1 [param2 ...]]
Specifies the path, file name and optional parameters to the application that AutoRun launches when a user inserts a disc in the drive. It is the CreateProcess function that is called by AutoRun. Note that if the application name includes spaces the path should be enclosed in double quote, e.g. open=""spread sheets.exe""
shellexecute=[filepath\]filename [param1 [param2 ...]]
Windows 2000, Windows ME or later
Similar to open, but using file association information to run the application. The file name can therefore be an executable or a data file. It is the ShellExecuteEx function that is called by AutoRun.
UseAutoPlay=1
Windows XP or later; drives of type DRIVE_CDROM
Use AutoPlay rather than AutoRun with CD-ROMs. The action taken on CD-ROM insertion will depend on the version of Windows being used.
On versions of Windows earlier than XP, this key has no effect and actions specified by open or shellexecute are performed.
On Windows XP and later, the user will be presented with the AutoPlay dialog and any actions specified by open or shellexecute are ignored.
shell\verb\command=[exepath\]exefile [param1 [param2 ...]]
Adds a custom command to the drive's shortcut menu. verb is a string with no embedded spaces. verb is also the text that will appear in the shortcut menu unless specifically altered to some other text. See below for an example.
shell\verb=menu text
Optionally specify the text displayed in the shortcut menu for the verb above. Use an ampersand (&) to select a hotkey for the menu. See below for an example.
shell=verb
Defines the menu command referred to by shell\verb as the default command in the shortcut menu. The default command is the command executed when the drive icon is double-clicked. If missing, the default menu item will be "AutoPlay", which launches the application specified by the open entry.
Example:
shell\readme\command=notepad readme.txtshell\readme=Read & Meshell=readme

[Content]

The Content section allows authors to communicate the type and intent of content to AutoPlay without AutoPlay having to examine the media.

Valid keys are: MusicFiles, PictureFiles, VideoFiles. Each key can be set to indicate true or false values and values are not case sensitive.

true or (1, y, yes, t)
display the handlers associated with that content type
false or (0, n, no, f)
do not display the handlers associated with that content type

Example:

[Content]MusicFiles=YPictureFiles=0VideoFiles=false

[ExclusiveContentPaths]

Limits AutoPlay's content search to only those folders listed, and their subfolders. The folder names are always taken as absolute paths (a path from the root directory of the media) whether or not a leading slash is used.

Example:

[ExclusiveContentPaths]\pictures\musicmore music\special

[IgnoreContentPaths]

AutoPlay's content search system will not scan the folders listed, nor their subfolders. IgnoreContentPaths takes precedence over ExclusiveContentPaths so if a path given in a [IgnoreContentPaths] section is a subfolder of a path given in an [ExclusiveContentPaths] section it is still ignored.

Example:

[IgnoreContentPaths]pictures\musicmore music\special

[DeviceInstall]

Only Windows XP [9]

This section is used to indicate where driver files may be located. This prevents a lengthy search through the entire contents of a CD-ROM. Windows XP will fully search:

without this section present. All other media should include this section to have Windows XP autodetect any drivers stored on that media.

The section is not used with AutoRun or AutoPlay and is only referred to during a driver installation phase. The only valid key is:

DriverPath=directorypath

which lists a path Windows will search for driver files. All subdirectories of that path are also searched. Multiple key entries are allowed.

If no DriverPath entry is provided in the [DeviceInstall] section or the DriverPath entry has no value, then that drive is skipped during a search for driver files.

Example:

[DeviceInstall]DriverPath=drivers\video DriverPath=drivers\audio[autorun]open=setup.exeicon=setup.exe,0label=My install CD

Related Research Articles

NTLDR is the boot loader for all releases of Windows NT operating system from 1993 with the release of Windows NT 3.1 until 2001 and 2003 with its final appearance in Windows XP and Windows Server 2003, respectively. NTLDR is typically run from the primary storage device, but it can also run from portable storage devices such as a CD-ROM, USB flash drive, or floppy disk. NTLDR can also load a non NT-based operating system given the appropriate boot sector in a file.

Windows File Explorer File manager application that is included with releases of the Microsoft Windows operating system

Windows File Explorer, previously known as Windows Explorer, is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface for accessing the file systems. It is also the component of the operating system that presents many user interface items on the screen such as the taskbar and desktop. Controlling the computer is possible without Windows Explorer running.

AUTOEXEC.BAT is a system file that was originally on DOS-type operating systems. It is a plain-text batch file in the root directory of the boot device. The name of the file is an abbreviation of "automatic execution", which describes its function in automatically executing commands on system startup; the filename was coined in response to the 8.3 filename limitations of the FAT file system family.

Program Manager Graphical shell for early Windows systems

Program Manager is the shell of Windows 3.x and Windows NT 3.x operating systems. This shell exposed a task-oriented graphical user interface (GUI), consisting of icons arranged into program groups. It replaced MS-DOS Executive, a file manager, as the default Windows shell.

Microsoft Project Project management software

Microsoft Project is a project management software product, developed and sold by Microsoft. It is designed to assist a project manager in developing a schedule, assigning resources to tasks, tracking progress, managing the budget, and analyzing workloads.

Windows Registry Database for Microsoft Windows

The Windows Registry is a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for applications that opt to use the registry. The kernel, device drivers, services, Security Accounts Manager, and user interfaces can all use the registry. The registry also allows access to counters for profiling system performance.

AutoRun and the companion feature AutoPlay are components of the Microsoft Windows operating system that dictate what actions the system takes when a drive is mounted.

AutoPlay, a feature introduced in Windows 98, examines newly discovered removable media and devices and, based on content such as pictures, music or video files, launches an appropriate application to play or display the content. It is closely related to the AutoRun operating system feature. AutoPlay was created in order to simplify the use of peripheral devices – MP3 players, memory cards, USB storage devices and others – by automatically starting the software needed to access and view the content on these devices. AutoPlay can be enhanced by AutoPlay-compatible software and hardware. It can be configured by the user to associate favourite applications with AutoPlay events and actions.

In computing, SUBST is a command on the DOS, IBM OS/2, Microsoft Windows and ReactOS operating systems used for substituting paths on physical and logical drives as virtual drives.

As the next version of Windows NT after Windows 2000, as well as the successor to Windows Me, Windows XP introduced many new features but it also removed some others.

The Windows NT booting process is the process by which Windows NT 4.0, Windows 2000, Windows XP and Windows Server 2003 operating systems initialize. In Windows Vista and later, this process has changed significantly; see Windows NT 6 startup process for information about what has changed.

Compared with previous versions of Microsoft Windows, there are numerous features new to Windows Vista, covering most aspects of the operating system, which include additional management features, new aspects of security and safety, new I/O technologies, new networking features, and new technical features. Windows Vista also removed some others.

The Windows shell is the graphical user interface for the Microsoft Windows operating system. Its readily identifiable elements consist of the desktop, the taskbar, the Start menu, the task switcher and the AutoPlay feature. On some versions of Windows, it also includes Flip 3D and the charms. In Windows 10, the Windows Shell Experience Host interface drives visuals like the Start Menu, Action Center, Taskbar, and Task View/Timeline. However, the Windows shell also implements a shell namespace that enables computer programs running on Windows to access the computer's resources via the hierarchy of shell objects. "Desktop" is the top object of the hierarchy; below it there are a number of files and folders stored on the disk, as well as a number of special folders whose contents are either virtual or dynamically created. Recycle Bin, Libraries, Control Panel, This PC and Network are examples of such shell objects.

In Windows NT operating systems, a Windows service is a computer program that operates in the background. It is similar in concept to a Unix daemon. A Windows service must conform to the interface rules and protocols of the Service Control Manager, the component responsible for managing Windows services. It is the Services and Controller app, services.exe, that launches all the services and manages their actions, such as start, end, etc.

In computing, an INF file or Setup Information file is a plain-text file used by Microsoft Windows for the installation of software and drivers. INF files are most commonly used for installing device drivers for hardware components. Windows includes the IExpress tool for the creation of INF-based installations. INF files form part of the Windows Setup API and of its successor, Windows Installer.

Microsoft PowerToys Set of freeware system utilities developed by Microsoft

Microsoft PowerToys is a set of freeware system utilities designed for power users developed by Microsoft for use on the Windows operating system. These programs add or change features to maximize productivity or add more customization. PowerToys are available for Windows 95, Windows XP, Windows 10 and Windows 11. The PowerToys for Windows 10 and Windows 11 are free and open-source software licensed under the MIT License and hosted on GitHub.

A batch file is a script file in DOS, OS/2 and Microsoft Windows. It consists of a series of commands to be executed by the command-line interpreter, stored in a plain text file. A batch file may contain any command the interpreter accepts interactively and use constructs that enable conditional branching and looping within the batch file, such as IF, FOR, and GOTO labels. The term "batch" is from batch processing, meaning "non-interactive execution", though a batch file might not process a batch of multiple data.

References

  1. 1 2 "Creating an AutoRun-Enabled Application". MSDN Library. Microsoft.
  2. ↑ Conficker § Operation
  3. 1 2 Bureau), Robert McMillan and IDG News Service (San Francisco. "After CERT Warning, Microsoft Delivers AutoRun Fix".
  4. ↑ Constantin, Lucian. "Security researchers discover link between Stuxnet and Flame".
  5. 1 2 "AutoPlay Windows 7 behavior backported".
  6. ↑ Gonsalves, Antone. "Security firms warn of spreading Windows AutoRun malware".
  7. ↑ "Microsoft finally says adios to Autorun". The Register .
  8. ↑ "How to Test autorun.inf Files". Knowledge Base. Microsoft.
  9. 1 2 3 4 5 "Autorun.inf Entries". MSDN Library. Microsoft.
  10. ↑ "Improvements to AutoPlay". Engineering Windows 7 blog. Microsoft.
  11. ↑ "Update to the AutoPlay functionality in Windows". Knowledge Base. Microsoft.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.