On Tuesday, Microsoft began to distribute a
critical update for Windows Server 2008 and earlier versions of Windows, which changes the way the OS responds to connecting a flash drive or other portable media. Until yesterday, the default behavior was to run the autorun.inf file without notifying the user. Such default installations led to the spread of a number of viruses, including Conficker.
Microsoft representatives
have reported that they could have released the patch before, but they met with resistance from some of their partners, for whom this feature was very important.
Until now, users of earlier versions of Windows needed to search for a
patch , download and install it themselves, but now they have included it in the official Windows Update mechanism. For Windows 7, similar changes were made in April 2009 with the release of Release Candidate 1.
It is necessary to add that at the recent hacker Shmoocon conference it was shown how to attack a computer through Autorun under Linux (
presentation ).
')
Under Windows, the autorun is still saved by default for CDs and DVDs. Generally speaking, it is strange to whom it even occurred to me to introduce such a default function for flash drives. Perhaps it was lobbied by the very same major Microsoft partners.