Comments on: Don’t let this happen to you… http://www.tnpcnewsletter.com/blog/2009/01/24/dont-let-this-happen-to-you/ Asking better questions Tue, 07 Feb 2012 13:09:45 +0000 http://wordpress.org/?v=2.9.1 hourly 1 By: Willard A Minns http://www.tnpcnewsletter.com/blog/2009/01/24/dont-let-this-happen-to-you/comment-page-1/#comment-21818 Willard A Minns Sun, 25 Jan 2009 03:47:54 +0000 http://www.tnpcnewsletter.com/blog/2009/01/24/dont-let-this-happen-to-you/#comment-21818 I confirm the statement by Joshua Proschan! I also had a problem with both Drives and Folders, when doubled clicked they would try to open in the first program listed in my "open with" list. They could only be opened by right clicking and selecting "open". Then my printers disappeared when the print spooler service was inhibited from starting. It took almost 2 weeks from first noticing the problems to final cleaning of of the residual problems. I confirm the statement by Joshua Proschan! I also had a problem with both Drives and Folders, when doubled clicked they would try to open in the first program listed in my “open with” list. They could only be opened by right clicking and selecting “open”. Then my printers disappeared when the print spooler service was inhibited from starting. It took almost 2 weeks from first noticing the problems to final cleaning of of the residual problems.

]]> By: Joshua Proschan http://www.tnpcnewsletter.com/blog/2009/01/24/dont-let-this-happen-to-you/comment-page-1/#comment-21817 Joshua Proschan Sun, 25 Jan 2009 02:04:42 +0000 http://www.tnpcnewsletter.com/blog/2009/01/24/dont-let-this-happen-to-you/#comment-21817 Microsoft's advice is not adequate. See: http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9126478&source=rss_news Also the US-CERT advisory: http://www.us-cert.gov/cas/techalerts/TA09-020A.html According to US-CERT you must also apply a little-known MS update (KB953252) that Microsoft does not mention on the page you mention. Without this update, Windows ignores the registry settings for NoDriveAutoRun and NoDriveTypeAutoRun. Once this patch is installed, Windows will enforce the NoDriveAutoRun and NoDriveTypeAutoRun settings. I can confirm from my own experience (two XP Pro PCs) that, at least for USB drives, the No...AutoRun settings are ineffective without the KB953252 update. The update is version-specific; the link to these is in the last paragraph ("update") of the US-CERT advisory. After applying the update, the No...AutoRun values must be added to the registry as described by CERT. One thing hinted at in the advisory: the registry changes should be made to HKLM, and not HKCU. HKLM over-rides any HKCU settings, and need only be changed once on each PC (from an admin login). HKCU changes must be made user-by-user, which must be promoted to administrator to make the changes. For almost all PCs, having the same settings for all users is the best way to protect the system as well as the simplest. Thanks for the great newsletter; I look forward to the next issue. Microsoft’s advice is not adequate. See:

http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9126478&source=rss_news

Also the US-CERT advisory:

http://www.us-cert.gov/cas/techalerts/TA09-020A.html

According to US-CERT you must also apply a little-known MS update (KB953252) that Microsoft does not mention on the page you mention. Without this update, Windows ignores the registry settings for NoDriveAutoRun and NoDriveTypeAutoRun. Once this patch is installed, Windows will enforce the NoDriveAutoRun and NoDriveTypeAutoRun settings.

I can confirm from my own experience (two XP Pro PCs) that, at least for USB drives, the No…AutoRun settings are ineffective without the KB953252 update. The update is version-specific; the link to these is in the last paragraph (“update”) of the US-CERT advisory. After applying the update, the No…AutoRun values must be added to the registry as described by CERT.

One thing hinted at in the advisory: the registry changes should be made to HKLM, and not HKCU. HKLM over-rides any HKCU settings, and need only be changed once on each PC (from an admin login). HKCU changes must be made user-by-user, which must be promoted to administrator to make the changes. For almost all PCs, having the same settings for all users is the best way to protect the system as well as the simplest.

Thanks for the great newsletter; I look forward to the next issue.

]]>