Windows 10: Questions about AutoRuns and the security of my PC

I have recently ran into some alarming alerts relating to the “Occamy.C” trojan and Nanocore. I am in dire need of help here and i need some answers.

1. 
   Is it safe to disable all RED and YELLOW AutoRuns entries?
   
   
2. 
   Is it possible that my antimalware service can be completely blinded by the malware on my pc?
   
   
3. 
   I am told that my PC could also be hosting a “USB infector”, a trojan that infects usb devices upon being inserted into my PC with malware. Is this even possible?
   
   
4. 
   Can malware hide itself from appearing on AutoRuns?
   
   
5. 
   Any recommendations on an Antimalware service i could use to solve any/all of these problems?
   

I’m sure you can tell, but i’m fairly new to the Malware game as i’ve never really had an infected device.

submitted by /u/th3n3wm3m3
[link] [comments]

:)

 

Windows 10 Autorun?

Hello,

As you are asking whether the security of disabling Autorun/Autoplay option from system settings is the same as disabling from the registry and will take affect in the same way. There is no need to worry about virus threats which usually attack from autorun/autoplay.
If you want to disable autorun/autoplay from registry, follow the steps provided below:

• Type regedit in the search box and press Enter.
• Navigate to the following location: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
• In the right pane of the window create a new DWORD value "NoDriveTypeAutorun".
• Set the value based on the following requirements:
  • FF – To disable AutoRun on all drives
  • 20 – To disable AutoRun on CD-ROM drives
  • 4 – To disable AutoRun on removable drives
  • 8 – To disable AutoRun on fixed drives
  • 10 – To disable AutoRun on network drives
  • 40 – To disable AutoRun on RAM disks
  • 1 – To disable AutoRun on unknown drives
• If you want to disable AutoRun on a certain combination of drives, you’ll have to combine their values. For example, if you want to disable AutoRun on CD-ROM and removable drives, set the value of DWORD to 28.
• If you want to return AutoRun functionality, just delete the NoDriveTypeAutorun DWORD value.

Note: This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore,
make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following
article number to view the article in the Microsoft Knowledge Base:

322756 (http://support.microsoft.com/kb/322756/ )

How to back up and restore the registry in Windows


Hope this helps. Keep us posted on the status for further assistance.

 

How can I remove this virus remnant?

I was also going to suggest Autoruns.

Check to make sure it isn't attaching itself to explorer. It should be the 3rd thing listed in Autoruns, the listing for the Shell. It should just be Explorer.exe. If it is anything else, that might be your problem.

 

Just when you think MS is getting a little Smarter/Microsoft kills off autorun

I really don't understand how some are complaining about autorun being disabled. For USB drives, it will pop up a dialog asking you whether you want to view the folder or not. Is that seriously not good enough?

For CDs however, microsoft stated that they would still allow the autorun function to be listed as an option in the dialog.

Autorun is a pretty big security risk, and Microsoft is saving a lot of headaches from the IT crowd for this.