Valid HTML 4.01 Transitional Valid CSS Valid SVG 1.0

Me, myself & IT

AutoPlay handler

Purpose

Create a custom AutoPlay handler for starting a virus scan with Microsoft Security Essentials on Microsoft® Windows® XP and newer versions of Windows NT when you insert a CD, DVD etc. or plug an USB storage device, an SD card etc. into your computer.

Implementation

  1. Define the custom AutoPlay device event handler eSKamation.MSE.Scan with the following Registry entries:

    REGEDIT4
    
    ; Copyright © 2009-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\Handlers\eSKamation.MSE.Scan]
    "Action"="Scan for Viruses and Malware"
    "DefaultIcon"="%ProgramFiles%\\Microsoft Security Client\\EPPManifest.dll,-100"
    "InvokeProgID"="Applications\\WScript.exe"
    "InvokeVerb"="AutoPlay"
    ;"Provider"="Microsoft Security Client"
    "Provider"="@%ProgramFiles%\\Microsoft Security Client\\EPPManifest.dll,-1000"
    This definition refers to the verb AutoPlay of the programmatic identifier Applications\WScript.exe.

    Note: see the MSKB article Using Registry String Redirection for the meaning of the last registry entry.

  2. Define the verb AutoPlay for the programmatic identifier Applications\WScript.exe and the associated command line with the following Registry entries:

    REGEDIT4
    
    ; Copyright © 2009-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
    
    [HKEY_CLASSES_ROOT\Applications\WScript.exe\Shell\AutoPlay]
    "Extended"=""
    
    [HKEY_CLASSES_ROOT\Applications\WScript.exe\Shell\AutoPlay\Command]
    ;@=expand:"\"%SystemRoot%\\System32\\WScript.exe\" \"%SystemRoot%\\Scripts\\AutoPlay.vbs\" \"%L\" %*"
    @=hex(2):22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,57,53,63,72,69,70,74,2e,65,78,65,22,20,22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,63,72,69,70,74,73,5c,41,75,74,6f,50,6c,61,79,2e,76,62,73,22,20,22,25,4c,22,20,25,2a,00
    This command line is called when the user chooses to run the device event handler eSKamation.MSE.Scan defined in step 1.

    Note: upon invocation the standard placeholder %L is replaced with the drive letter.

  3. Save the following VBScript as file %SystemRoot%\Scripts\AutoPlay.vbs:

    ' Copyright © 2009-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
    
    Option Explicit
    
    If WScript.Arguments.Count <> 1 Then WScript.Quit
    
    With WScript.CreateObject("Shell.Application").NameSpace(WScript.Arguments.Item(0)).Self
    	Dim objVerb
    	For Each objVerb In .Verbs
    		If InStr(1, objVerb.Name, " Microsoft Security Essentials...", vbTextCompare) <> 0 Then
    			objVerb.DoIt
    			WScript.Quit
    		End If
    	Next
    
    	WScript.CreateObject("WScript.Shell").PopUp "Microsoft Security Essentials can't be started on '" & .Name & "'!", 0, WScript.ScriptName, 16
    End With
    This VBScript searches the context menu of the drive, directory or file given as first and only argument for an entry containing  Microsoft Security Essentials... and calls this entries' verb if present.

    Note: create the directory %SystemRoot%\Scripts\ if it does not exist.

  4. Associate the device event handler eSKamation.MSE.Scan defined in step 1. with the following Registry entries to (some of) the standard device arrival events:

    REGEDIT4
    
    ; Copyright © 2009-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\AutoRunINFLegacyArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\GenericVolumeArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\MixedContentOnArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\PlayMusicFilesOnArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\PlayVideoFilesOnArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\ShowPicturesOnArrival]
    "eSKamation.MSE.Scan"=""
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\UnknownContentOnArrival]
    "eSKamation.MSE.Scan"=""
  5. Optionally set the device event handler eSKamation.MSE.Scan defined in step 1. with the following Registry entries as default handler for its associated device arrival events:

    REGEDIT4
    
    ; Copyright © 2009-2017, Stefan Kanthak <‍skanthak‍@‍nexgo‍.‍de‍>
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\AutoRunINFLegacyArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\GenericVolumeArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\MixedContentOnArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\PlayMusicFilesOnArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\PlayVideoFilesOnArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\ShowPicturesOnArrival]
    @="eSKamation.MSE.Scan"
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\UnknownContentOnArrival]
    @="eSKamation.MSE.Scan"

Operation

Insert a CD, DVD etc. or plug an USB storage device, an SD card etc. into your computer, then select the entry Scan for Viruses and Malware with Microsoft Security Essentials from the AutoPlay menu and confirm with OK.

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, errors, inaccuracies, omissions, vulnerabilities or weaknesses, …:
don't hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Notes: I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see a full (real) name as sender, not a nickname!
Emails in weird formats and without a proper sender name are likely to be discarded.
I abhor top posts and expect inline quotes in replies.

Terms and conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!
Copyright © 1995-2017 • Stefan Kanthak • <‍skanthak‍@‍nexgo‍.‍de‍>