Removing features is the best defense

When I’ve read the news that Microsoft is disabling Autorun for removable media other than CD/DVD in Windows 7 (and maybe HD-DVD/BlueRay) I said: cool! This will slow down the spreading of malware using this feature (on a very long timeframe of course, because Windows 7 isn’t even final yet – and far away from wide adoption).

Then again the evil voices in my head ;-) said: ok, maybe they eliminated the automatic way, but I should be able to find a one-click method which makes social engineering malware easy to deploy. My line of thinking was: make something run when the “Open folder” AutoPlay option is selected using the desktop.ini (also, the MSDN link) file. After toying around and not having too much success I came upon a KB article from MS which states:

To help prevent potentially unsafe content from running when you open a folder on your local computer or on your local area network, by default, Windows XP SP1,Windows Server 2003, Windows Vista, and Windows Server 2008 do not support HTML for Web view in Windows Explorer.

What can I say? Very cool. This again demonstrates the value of the agile practice “just add the features the customer is asking for, nothing more”. So, no cookie for me this time :-).

Picture taken from drumecho's photostream with permission.