Me, myself & IT

Custom AutoPlay Handler

Purpose
Implementation
Operation

Purpose

Create a custom AutoPlay handler for starting a virus scan with Microsoft Security Essentials or Windows^™ Defender on Microsoft^® Windows^™ XP and newer versions of Windows NT when you insert a CD, DVD etc. or plug an USB storage device, an SD card etc. into your computer.

Note: the procedure shown here allows to implement arbitrary custom AutoPlay handlers.

Implementation

Perform the following 4 (optionally 5) steps to implement the custom AutoPlay handler.

Define the custom AutoPlay device event handler eSKamation.MSE.Scan with the following Registry entries:

REGEDIT4

; Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

; NOTE: on Windows 8 and later versions replace 'Microsoft Security Client' with 'Windows Defender'!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\Handlers\eSKamation.MSE.Scan]
"Action"="Scan for Viruses and Malware"
"DefaultIcon"="%ProgramFiles%\\Microsoft Security Client\\EPPManifest.dll,-100"
"InvokeProgID"="Applications\\WScript.exe"
"InvokeVerb"="AutoPlay"
;"Provider"="Microsoft Security Client"
"Provider"="@%ProgramFiles%\\Microsoft Security Client\\EPPManifest.dll,-1000"

This definition refers to the Verb AutoPlay of the Programmatic Identifier Applications\WScript.exe.

Note: see the MSDN article Using Registry String Redirection for the function of the last registry entry.

Define the verb AutoPlay for the Programmatic Identifier Applications\WScript.exe and the associated command line "%SystemRoot%\System32\WScript.exe" "%SystemRoot%\Scripts\AutoPlay.vbs" "%L" %* with the following Registry entries:

REGEDIT4

; Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_CLASSES_ROOT\Applications\WScript.exe\Shell\AutoPlay]
"ProgrammaticAccessOnly"=""

[HKEY_CLASSES_ROOT\Applications\WScript.exe\Shell\AutoPlay\Command]
;@=expand:"\"%SystemRoot%\\System32\\WScript.exe\" \"%SystemRoot%\\Scripts\\AutoPlay.vbs\" \"%L\" %*"
@=hex(2):22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,79,73,74,65,6d,33,32,5c,57,53,63,72,69,70,74,2e,65,78,65,22,20,22,25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,53,63,72,69,70,74,73,5c,41,75,74,6f,50,6c,61,79,2e,76,62,73,22,20,22,25,4c,22,20,25,2a,00

This command line is called when the user chooses to run the device event handler eSKamation.MSE.Scan defined in step 1.

Note: upon invocation the standard placeholder %L is replaced with the drive letter.

Save the following VBScript as file %SystemRoot%\Scripts\AutoPlay.vbs:

Rem Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

Rem NOTE: on Windows 8 and later versions replace 'Microsoft Security Essentials' with 'Windows Defender'!

Option Explicit

If WScript.Arguments.Count <> 1 Then WScript.Quit

With WScript.CreateObject("Shell.Application").NameSpace(WScript.Arguments.Item(0)).Self
	Dim objVerb
	For Each objVerb In .Verbs
		If InStr(1, objVerb.Name, " Microsoft Security Essentials...", vbTextCompare) <> 0 Then
			objVerb.DoIt
			WScript.Quit
		End If
	Next

	MsgBox "Microsoft Security Essentials can't be started on '" & .Name & "'!", vbCritical, WScript.ScriptName
End With

This VBScript searches the context menu of the drive, directory or file given as first and only argument for an entry containing Microsoft Security Essentials... and calls this entries’ verb if present.

Note: create the directory %SystemRoot%\Scripts\ if it does not exist.

Associate the device event handler eSKamation.MSE.Scan defined in step 1. with the following Registry entries to (some of) the standard device arrival events:

REGEDIT4

; Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\AutoRunINFLegacyArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\GenericVolumeArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\MixedContentOnArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\PlayMusicFilesOnArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\PlayVideoFilesOnArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\ShowPicturesOnArrival]
"eSKamation.MSE.Scan"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlers\UnknownContentOnArrival]
"eSKamation.MSE.Scan"=""

Optionally set the device event handler eSKamation.MSE.Scan defined in step 1. with the following Registry entries as default handler for its associated device arrival events:

REGEDIT4

; Copyright © 2009-2024, Stefan Kanthak <‍stefan‍.‍kanthak‍@‍nexgo‍.‍de‍>

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\AutoRunINFLegacyArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\GenericVolumeArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\MixedContentOnArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\PlayMusicFilesOnArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\PlayVideoFilesOnArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\ShowPicturesOnArrival]
@="eSKamation.MSE.Scan"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoPlayHandlers\EventHandlersDefaultSelection\UnknownContentOnArrival]
@="eSKamation.MSE.Scan"

Operation

Insert a CD, DVD etc. or plug an USB storage device, an SD card etc. into your computer, then select the entry Scan for Viruses and Malware with Microsoft Security Essentials from the AutoPlay menu and confirm with OK.

Contact and Feedback

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, deficiencies, errors, inaccuracies, misrepresentations, omissions, shortcomings, vulnerabilities or weaknesses, …: don’t hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Note: email in weird format and without a proper sender name is likely to be discarded!

I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see your full (real) name as sender, not your nickname.
I abhor top posts and expect inline quotes in replies.

Terms and Conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!

The software and the documentation on this site are provided as is without any warranty, neither express nor implied.
In no event will the author be held liable for any damage(s) arising from the use of the software or the documentation.
Permission is granted to use the current version of the software and the current version of the documentation solely for personal private and non-commercial purposes.
An individuals use of the software or the documentation in his or her capacity or function as an agent, (independent) contractor, employee, member or officer of a business, corporation or organisation (commercial or non-commercial) does not qualify as personal private and non-commercial purpose.
Without written approval from the author the software or the documentation must not be used for a business, for commercial, corporate, governmental, military or organisational purposes of any kind, or in a commercial, corporate, governmental, military or organisational environment of any kind.
Redistribution of the software and the documentation is allowed only in unmodified form of its current version and free of charge.

Data Protection Declaration

This web page records no (personal) data and stores no cookies in the web browser.

The web service is operated and provided by

Telekom Deutschland GmbH
Business Center
D-64306 Darmstadt
Germany
<‍hosting‍@‍telekom‍.‍de‍>
+49 800 5252033

The web service provider stores a session cookie in the web browser and records every visit of this web site with the following data in an access log on their server(s):

the (pseudonymised) IP address;
the date and time of the request;
the URL of the requested web page or file;
the Referer and User-Agent HTTP headers sent by the web browser;
the result (success or failure) of the request;
the amount of data received and sent.