You are here

Version 11.1 - Disable Autorun

17 posts / 0 new
Last post
grissey
Offline
Last seen: 1 year 1 day ago
Joined: 2012-10-08 15:57
Version 11.1 - Disable Autorun

I've just installed version 11.1 on my 'c' drive and 2 USB drives.
With autorun=true in the [Protection] section no warning message is displayed on launching PortableApps on my 'c' drive, as it should be.
But after setting autorun=false in the [Protection] section on both USB drives the warning message about autorun.inf is still being displayed.

John T. Haller
John T. Haller's picture
Offline
Last seen: 7 hours 37 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
On Startup Only

It's showing on startup only, correct? Currently it only disables realtime detection but not between run detection due to a bug.

UPDATE: I've added it to the list of known issues and already implemented a fix for the next release: https://portableapps.com/node/28593

Sometimes, the impossible can become possible, if you're awesome!

grissey
Offline
Last seen: 1 year 1 day ago
Joined: 2012-10-08 15:57
Yes, it displays on startup

Yes, it displays on startup only.

mgagnonlv
Offline
Last seen: 11 months 1 week ago
Joined: 2008-04-04 21:51
Why? And why not delete it?

I saw that "new feature" and wonders why it exists. Maybe there is something I don't understand here.

Hasen't Autorun been disabled in Windows 7, Vista and recent updates of XP, including SP3? If so, what is the added benefit of it?

And in the same token, why not get rid of the Autorun file altogether?

Thanks.

Michel Gagnon
Montréal (Québec, Canada)

John T. Haller
John T. Haller's picture
Offline
Last seen: 7 hours 37 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Reasons

Even though autorun isn't used to run things in Windows 7 and patched Windows XP/Vista, malware still uses it for all the Windows 2000 and unpatched Windows XP/Vista machines out there that still do. So, when the malware is copied onto the drive, it also modifies the autorun, making it a very good indication of when a drive has gotten infected. Essentially, we use it against them as a telltale sign of bad things.

Autorun.inf is still used for setting a custom icon for your drive and setting a name longer than 11 all-caps characters with a FAT32 device. So, it serves a purpose. Having an autorun doesn't somehow increase your chances of being infected. And even if it doesn't exist, malware creates it as it is copied onto your drive. We monitor for that, too.

Sometimes, the impossible can become possible, if you're awesome!

mgagnonlv
Offline
Last seen: 11 months 1 week ago
Joined: 2008-04-04 21:51
Thanks

Thanks for the clear explanation.

Michel Gagnon
Montréal (Québec, Canada)

shookmon
Offline
Last seen: 6 years 9 months ago
Joined: 2007-02-21 16:26
reset Autorun.inf?

Ok, so I've been using PA for a reaaaaly long time. Somewhere along the way I added some shortcuts and other 'stuff' to the autorun.inf. I like the idea of this check PA is now doing and I don't use the bits I added back whenever, but I can't figure out how to 'reset' my autorun so PA is happy.

I tried installing a fresh PA on a new stick and copying the autorun over from there, but it didn't work.

Any ideas?

Thanks!!

Michael D. Shook

John T. Haller
John T. Haller's picture
Offline
Last seen: 7 hours 37 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Happy?

Happy how? It shouldn't alert unless there is a change. And, even then, it's just to let you know there is a change.

Sometimes, the impossible can become possible, if you're awesome!

shookmon
Offline
Last seen: 6 years 9 months ago
Joined: 2007-02-21 16:26
Happy Happy!!

Well, by happy I guess I mean, I want to stop the alert by 'resetting' the autorun.inf to what PA thinks is a legitimate file.

Thanks!!

Michael D. Shook

John T. Haller
John T. Haller's picture
Offline
Last seen: 7 hours 37 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Once

It will only alert you once per change. Then it makes a backup of the changed file and will only alert if you change it again. The alert is designed to let you know it changed... that way if you changed it, you know you're fine, but if you didn't, you know something may be up. It alerts no matter how it changed and is not a judge of good change vs bad change.

Sometimes, the impossible can become possible, if you're awesome!

shookmon
Offline
Last seen: 6 years 9 months ago
Joined: 2007-02-21 16:26
Oh.

Hmmmm, I know I saw it several times before I decided to undo my changes. Then I saw it twice again today.

I'll keep an eye on it and see if it continues to happen.

Thanks!!

Michael D. Shook

shookmon
Offline
Last seen: 6 years 9 months ago
Joined: 2007-02-21 16:26
More info

Ok, so I don't know exactly how the autorun.inf check works, but my work antivirus doesn't like it. I think that's the root source of the issue. So here's a timeline:

1) Wake up
2) get out of bed
3) drag comb through my head

Smile

4) insert stick into work laptop, start PA via batch file.
5) unnamed (?) window pops up saying something like "file access is denied"
6) another window pops up from TrendMicro OfficeScan saying that it detected unauthorized access, with the 'target' being the USB stick's autorun.inf file. (http://snarkybox.com/images/autorun_error.png)
7) error message from PA saying that autorun has been changed.

I hope this helps!

Thanks!!

Michael D. Shook

sawjew
Offline
Last seen: 9 months 3 days ago
Joined: 2006-01-28 07:19
Much the same

I have almost the same issue with my work computer also using Trend Micro. Trend Micro locks the usb autorun file and changes its permissions so there is a change each time it is plugged in.

I just want to disable this warning as it is a bit annoying. The problem is I use Portableapps at work and on my home computer so it detects a change each time I use it.

John T. Haller
John T. Haller's picture
Offline
Last seen: 7 hours 37 min ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Disable It

You can disable it following the directions here:
https://portableapps.com/support/portable_apps_suite#advanced

Realtime is disabled and only start of session detection is enabled by default in 11.2 and higher.

You should probably report the bug to Trend Micro. Messing with your autorun.inf on every run is a bad idea for any piece of software, antivirus or not. We have Trend Micro workarounds in the platform installer because it's the only antivirus buggy enough to complain about innocuous edits to the autorun.inf (like setting a custom drive icon or naming your drive something longer than the 11 uppercase characters FAT32 supports).

Sometimes, the impossible can become possible, if you're awesome!

shookmon
Offline
Last seen: 6 years 9 months ago
Joined: 2007-02-21 16:26
Thanks

John, I've disabled the autorun as suggested, all errors seem to be quiet.

Thanks!!

Michael D. Shook

Mideaa
Offline
Last seen: 11 years 5 months ago
Joined: 2012-10-17 03:12
Thanks!

Thanks! I had the same problem with the pop-up on each start-up. This fixed it for me. Smile

hdelien
Offline
Last seen: 1 year 3 months ago
Joined: 2013-06-19 10:20
I had the same problem

I had an autorun.inf that told me every time I started it, that the file was modified. The reason, it turned out, was that I have to make the file "read only" because, at work, every time I plugged it in, they overwrote it. Portable apps, made a copy that maintained the same, read only, permission. So when I later modified the file, Portable apps notified me of the change, but when it attempted to make it's backup of it, it was unable to overwrite it because the backup was read only. I simply deleted X:\PortableApps\PortableApps.com\Data\autorun.inf.bak, got the message one more time and not again.

-Harry

Log in or register to post comments