I've just installed version 11.1 on my 'c' drive and 2 USB drives.
With autorun=true in the [Protection] section no warning message is displayed on launching PortableApps on my 'c' drive, as it should be.
But after setting autorun=false in the [Protection] section on both USB drives the warning message about autorun.inf is still being displayed.
You are here
Version 11.1 - Disable Autorun
October 8, 2012 - 4:14pm
#1
Version 11.1 - Disable Autorun
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
It's showing on startup only, correct? Currently it only disables realtime detection but not between run detection due to a bug.
UPDATE: I've added it to the list of known issues and already implemented a fix for the next release: https://portableapps.com/node/28593
Sometimes, the impossible can become possible, if you're awesome!
Yes, it displays on startup only.
I saw that "new feature" and wonders why it exists. Maybe there is something I don't understand here.
Hasen't Autorun been disabled in Windows 7, Vista and recent updates of XP, including SP3? If so, what is the added benefit of it?
And in the same token, why not get rid of the Autorun file altogether?
Thanks.
Michel Gagnon
Montréal (Québec, Canada)
Even though autorun isn't used to run things in Windows 7 and patched Windows XP/Vista, malware still uses it for all the Windows 2000 and unpatched Windows XP/Vista machines out there that still do. So, when the malware is copied onto the drive, it also modifies the autorun, making it a very good indication of when a drive has gotten infected. Essentially, we use it against them as a telltale sign of bad things.
Autorun.inf is still used for setting a custom icon for your drive and setting a name longer than 11 all-caps characters with a FAT32 device. So, it serves a purpose. Having an autorun doesn't somehow increase your chances of being infected. And even if it doesn't exist, malware creates it as it is copied onto your drive. We monitor for that, too.
Sometimes, the impossible can become possible, if you're awesome!
Thanks for the clear explanation.
Michel Gagnon
Montréal (Québec, Canada)
Ok, so I've been using PA for a reaaaaly long time. Somewhere along the way I added some shortcuts and other 'stuff' to the autorun.inf. I like the idea of this check PA is now doing and I don't use the bits I added back whenever, but I can't figure out how to 'reset' my autorun so PA is happy.
I tried installing a fresh PA on a new stick and copying the autorun over from there, but it didn't work.
Any ideas?
Thanks!!
Michael D. Shook
Happy how? It shouldn't alert unless there is a change. And, even then, it's just to let you know there is a change.
Sometimes, the impossible can become possible, if you're awesome!
Well, by happy I guess I mean, I want to stop the alert by 'resetting' the autorun.inf to what PA thinks is a legitimate file.
Thanks!!
Michael D. Shook
It will only alert you once per change. Then it makes a backup of the changed file and will only alert if you change it again. The alert is designed to let you know it changed... that way if you changed it, you know you're fine, but if you didn't, you know something may be up. It alerts no matter how it changed and is not a judge of good change vs bad change.
Sometimes, the impossible can become possible, if you're awesome!
Hmmmm, I know I saw it several times before I decided to undo my changes. Then I saw it twice again today.
I'll keep an eye on it and see if it continues to happen.
Thanks!!
Michael D. Shook
Ok, so I don't know exactly how the autorun.inf check works, but my work antivirus doesn't like it. I think that's the root source of the issue. So here's a timeline:
1) Wake up
2) get out of bed
3) drag comb through my head
4) insert stick into work laptop, start PA via batch file.
5) unnamed (?) window pops up saying something like "file access is denied"
6) another window pops up from TrendMicro OfficeScan saying that it detected unauthorized access, with the 'target' being the USB stick's autorun.inf file. (http://snarkybox.com/images/autorun_error.png)
7) error message from PA saying that autorun has been changed.
I hope this helps!
Thanks!!
Michael D. Shook
I have almost the same issue with my work computer also using Trend Micro. Trend Micro locks the usb autorun file and changes its permissions so there is a change each time it is plugged in.
I just want to disable this warning as it is a bit annoying. The problem is I use Portableapps at work and on my home computer so it detects a change each time I use it.
You can disable it following the directions here:
https://portableapps.com/support/portable_apps_suite#advanced
Realtime is disabled and only start of session detection is enabled by default in 11.2 and higher.
You should probably report the bug to Trend Micro. Messing with your autorun.inf on every run is a bad idea for any piece of software, antivirus or not. We have Trend Micro workarounds in the platform installer because it's the only antivirus buggy enough to complain about innocuous edits to the autorun.inf (like setting a custom drive icon or naming your drive something longer than the 11 uppercase characters FAT32 supports).
Sometimes, the impossible can become possible, if you're awesome!
John, I've disabled the autorun as suggested, all errors seem to be quiet.
Thanks!!
Michael D. Shook
Thanks! I had the same problem with the pop-up on each start-up. This fixed it for me.
I had an autorun.inf that told me every time I started it, that the file was modified. The reason, it turned out, was that I have to make the file "read only" because, at work, every time I plugged it in, they overwrote it. Portable apps, made a copy that maintained the same, read only, permission. So when I later modified the file, Portable apps notified me of the change, but when it attempted to make it's backup of it, it was unable to overwrite it because the backup was read only. I simply deleted X:\PortableApps\PortableApps.com\Data\autorun.inf.bak, got the message one more time and not again.
-Harry