Autorun.inf 與注冊(cè)表NoDriveTypeAutoRun鍵值的一些說明
二進(jìn)制位數(shù) | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 |
Type | 1 | RAMDISK | CDROM | REMOTE | FIXED | REMOVABLE | NO_ROOT_DIR | UNKNOWN |
名稱 | 內(nèi)存 | 光驅(qū) | 網(wǎng)絡(luò)映射 | 硬盤 | 移動(dòng)存儲(chǔ)器 | 沒有盤符 | 不能識(shí)別 | |
十進(jìn)制值 | 128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
91(默認(rèn)145) | 1 | 0 | 0 | 1 | 0 | 0 | 0 | 1 |
95(默認(rèn)149) | 1 | 0 | 0 | 1 | 0 | 1 | 0 | 1 |
F5(硬盤245) | 1 | 1 | 1 | 1 | 0 | 1 | 0 | 1 |
DD(光驅(qū)221) | 1 | 1 | 0 | 1 | 1 | 1 | 0 | 1 |
FF(推薦255) | 1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 |
1代表不可自動(dòng)運(yùn)行,0代表可自動(dòng)運(yùn)行。
我設(shè)置成FF也就是255,360幫我改成DD,安全性得到提升……
NoDriveTypeAutoRun 子項(xiàng)值重置為以下原始默認(rèn)值之一:
操作系統(tǒng) | 默認(rèn)值 |
Microsoft Windows Server 2003 | 0x95 |
Microsoft Windows 2000 | 0x95 |
MicrosoftWindowsXP | 0x91 |
通過以上信息可判斷,XP與2000在默認(rèn)設(shè)置情況下,XP開啟了U盤自動(dòng)運(yùn)行,所以默認(rèn)設(shè)置下XP比2000要易感染U盤病毒。
注冊(cè)表代碼如下:
[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDrives"=dword:00000000
"NoViewOnDrive"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000004
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/policies/Explorer]
"NoDriveAutoRun"=dword:00000000
"NoDrives"=dword:00000000
"NoViewOnDrive"=dword:00000000
"NoDriveTypeAutoRun"=dword:00000004
;以下是在組策略中設(shè)置的鍵值,默認(rèn)沒有設(shè)置時(shí)“本地User”下為空
;[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Group Policy Objects/本地User/Software/Microsoft/Windows/CurrentVersion/Policies /Explorer]
;"NoDriveTypeAutoRun"=dword:000000ff
;[HKEY_USERS/.DEFAULT/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer]
;"NoDriveTypeAutoRun"=dword:000000FF