As handy as USB keys are, they're a perfect way for virus writers to try and spread malicious software. This is made especially easy thanks to the AutoRun feature built into Windows, that would do pretty much whatever an 'autorun.ini' file told it as soon as the storage device was plugged in. Perhaps the most well-known example of this was the Conficker worm, which infected millions of PCs in 2008.
After some years of telling users to disable the feature - but providing no easy way to do it - Microsoft re-engineered AutoRun in Windows 7, preventing viruses from making use of it for USB keys and other removable media. And now, an update is being pushed to users of older versions of the OS through Windows Update which should close the loophole for good.
This patch - which essentially back-ports the Windows 7 changes to Server 2008 and earlier operating systems - was originally released in November 2009, but it was made an optional download to satisfy the needs of business users. Only now is it being pushed out to everyone automatically.
The feature hasn't been completely disabled, though. AutoRun will still work normally on so called 'shiny media' - that's CDs and DVDs to the rest of us - since it's very unlikely that viruses will be distributed in this way on optical media. In fact, that sort of malware has never been spotted in the wild according to Microsoft.
According to the announcement, "changing behavior for a running system is never a trivial thing, and we take it incredibly seriously. It would be a bad outcome for people to think they have to make a tradeoff between security and anything else. Updates to protect against vulnerabilities are an important part of keeping a system secure. We had to be very confident that this change was the right balance for most people."
Update 967940 should have been made available on Tuesday as a part of Microsoft's monthly updates as an 'important non-security update'. For anyone not happy with the changes, there is a 'Fix It' available that should put everything back to normal here.
