Disabling autorun for mapped network drives

[Johnny Wong <johnnywkm () gmail com>]

Hello all,

Over the past few months, we have faced situations where user PCs 
were infected with virus when they connect to network mapped drives. 
What happened was that the virus creates "autorun.inf" in the root of 
the shared network drive, so users who double-click the drive in 
Explorer, the autorun.inf executes the linked virus-infected 
executable. Evem though the user PCs have anti-virus installed, the 
incidents we faced so far, the virus was not detectable. It was 
realised later that the virus was a new strain.

We have tried to disable the mapped-drives autorun feature (based on 
registry key settings); however, it was not foolproof because the 
autorun.inf was still able to execute in some cases. We found later 
from Microsoft's KB (http://support.microsoft.com/kb/933008) that 
this registry setting may not work. So we did not roll out this 
registry settings to the users.

Anyone of you facing the same situation as me? I can only think of 
the following solutions:

- keep AV signatures updated - this is not foolproof because most of 
the time, the virus writers are leading the game. So we can only try 
to send the first specimen we find ASAP to the AV vendors so that 
they could develop signatures for them. Guessed by that time, a 
number of users would have been infected.

- run a task on the file server that regularly checks for presence of 
autorun.inf in the root of the shared folders, and if found, rename 
or delete them. Implementation of this task will impact the 
performance of the server when it hosts a lot of shared folders.

Please share your workarounds if you have any.

Thank you,

JW