Protection features within the Symantec Endpoint Protection product can be used to block the AutoRun functionality. Use a Symantec Endpoint Protection Application and Device Control policy.This Microsoft KB article explains how to disable AutoRun using the NoDriveTypeAutoRun registry key. Disable the AutoRun functionality using the registry.Disable AutoPlay in your environment using a Group Policy Object (GPO)įollow the instructions in the following Microsoft TechNet Security Watch article under Managing AutoPlay in Your Network.Click on the AutoPlay option in the list to the left. On Windows start menu, click on the Settings menu item. To permanently prevent threats from using the AutoRun feature the following options are available: To turn on the AutoPlay function for USB sticks, follow the steps below: 1. Submit suspicious files to Symantec Security ResponseĮven when SEP detects and deletes the threat, the autorun.inf text file may not always be deleted since both benign and malicious files can use autorun.inf.If you suspect that an infection is using AutoRun but the file pointed to by autorun.inf is not detected by Symantec Endpoint Protection (SEP), please submit the file to Symantec Security Response using the instructions in the following article:

The autorun.inf file when viewed in a text editor typically contains lines similar to the following: Note: To check if the computer in question is configured according to this best practice, download and run a 'scan for common issues' in SymDiag.

Autorun exe from usb windows 10