Protection features within the Symantec Endpoint Protection product can be used to block the AutoRun functionality. Use a Symantec Endpoint Protection Application and Device Control policy.This Microsoft KB article explains how to disable AutoRun using the NoDriveTypeAutoRun registry key. Disable the AutoRun functionality using the registry.Disable AutoPlay in your environment using a Group Policy Object (GPO)įollow the instructions in the following Microsoft TechNet Security Watch article under Managing AutoPlay in Your Network.To permanently prevent threats from using the AutoRun feature the following options are available: Submit suspicious files to Symantec Security ResponseĮven when SEP detects and deletes the threat, the autorun.inf text file may not always be deleted since both benign and malicious files can use autorun.inf.If you suspect that an infection is using AutoRun but the file pointed to by autorun.inf is not detected by Symantec Endpoint Protection (SEP), please submit the file to Symantec Security Response using the instructions in the following article: The autorun.inf file when viewed in a text editor typically contains lines similar to the following: To run AutoRun manually, either right-click the drive icon and select AutoPlay from the shortcut menu or double-click the drive icon. Note: To check if the computer in question is configured according to this best practice, download and run a 'scan for common issues' in SymDiag.

Autorun exe from usb windows 10