I have a few external WD disks. On all disks, except for one, when I plug in the USB cable, the windows explorer shows the folders, which contain MP4 files. But on one disk as soon as it is connected it starts to play one of the MP4 files that are on it.
Why does this happen and how do I change this?
It sounds like you have autoplay turned on. And by turned on I mean via group policy. If you have Windows 7 Pro and above (I think it is) you can edit the group policy to completely turn off autoplay functionality (see bottom of this long post). Now, this of course may make things a bit more cumbersome to those that are not used to finding the right file to double click on to launch what ever is on a disk manullly instead of relying on autoplay execution. Be it HDD, USB drive or optical. BUT! Turning off autoplay would be in your best interest for security sake since if autoplay is turned on, possible malware (think form a USB drive, etc) can auto execute behind your back.
What's probably going on with that one drive is there must be some kind of auto run file on the drive. It may be hidden. Which brings me to another point. You should always turn on show file extensions in the Folder Options in the Windows Control Panel. This too is for your security should a file masquerade as something it's not. Just a basic example. Say you download a PDF. Looks like a PDF, icon even says it's a PDF. Proably even smells like PDF (perhpas like ink or something...) But icons can be what ever the creator of the file wants them to be. So when you double click on this PDF called something like manual.pdf it's actually manual.exe. In which case you just launched an executable to do God only knows what. With the show file extensions hidden you would have never caught it was an .exe from the jump. The file would just say "manual" without the added .exe file extension. There's also correct MIME types for files and whatnot, but that's beyond the scope of this post.
Just a quick a quick explanation on what MIME is.. Website's like this (a bulletin board forum) detect the correct MIME type allowed to be uploaded. So, zips, PDF, batch files, JPGs, esetra may be allowed, but others like a JS file or exe file aren't since that would compromise the server and the users. If you install Notepad++ (you can probably use the built-in Windows Notepad as well) and use that to view a small zip file, you should see something like this:
That PK means it's a zip.
From Wikipedia:
PKZIP is a file archiving computer program, notable for introducing the popular ZIP file format. PKZIP was first introduced for MS-DOS on the IBM-PC compatible platform in 1989. Since then versions have been released for a number of other architectures and operating systems.
Now here's what that same file says in CyberChef using the Detect File Type recipe.
A JPG
From Wikipedia:
The JPEG File Interchange Format (JFIF) is an image file format standard published as ITU-T Recommendation T.871 and ISO/IEC 10918-5. It defines supplementary specifications for the container format that contains the image data encoded with the JPEG algorithm. The base specifications for a JPEG container format are defined in Annex B of the JPEG standard, known as JPEG Interchange Format (JIF). JFIF builds over JIF to solve some of JIF's limitations, including unnecessary complexity, component sample registration, resolution, aspect ratio, and color space. Because JFIF is not the original JPG standard, one might expect another mime-type. However, it's still registered as "image/jpeg" (indicating its primary data format rather than the amended information).
JFIF is mutually incompatible with the newer Exchangeable image file format (Exif).
In CyberChef.
Back on topic. Your hard drive probably has an autorun.inf file on it. https://en.wikipedia.org/wiki/Autorun.inf
Now, unaware to me, but it appears Microsoft got rid of that functionality. (DId I just make a ryme)? However, my parents computer uses Windows 7 Home and it's there and I've been meaning to turn it off in some fashion. I can't use Group Policy since it's the Home version of Windows 7. Of course the update would be what I should use, but I don't use updates unless absolutely necessary as unbelievably weird that may sound to some. I'm very unorthodox in my computing. I have my computers as well as my parent's computer use Sandboxie for the browser. While it can be cumbersome and takes getting used to, it is the front door to all would-be shenanigans. My parent's computer - despite being scanned with everything out there and stuff most people never heard of before let alone use, is cleaner than Mr. Clean's bald head. I also periodicaly clone the computer just in case. In addition to that, I block malware domains at the DNS level and in the uBlock browser add-on. I don't even use an active, over bloated anti-virus software. Not on my parent's computers or my computer's. I used to, not anymore becasue it's all absolute garbage now-a-days. Really, it is. I'd have to type a couple pages to describe why which I won't right now. So I just manually scan ALL downloads at VirusTotal. (Note even images can be laced witgh malware)! General consensus is four hits and you toss, but it depends on what it is, and the relations and behaviors. I actually don't upload anything to VirusTotal. I use the SHA256 hash of the file I want a verdict on using a program called HashTools by Binary Fortress. Rare do I have to submit a file to VirusTotal that's not already been scanned. Fun fact. I uploaded a harmless canary token to VirusTotal and saw tons of IP hits mostly from China and Russia with some other countries sprinkled throughout. What these IP hits were are the virus researchers opening the file. LOL! https://support.virustotal.com/hc/en...emium-Services
Anyway, to turn off autoplay in group policy type ingpedit.mscin the run box. Navigate to Computer Configuration | Windows Componets | AutoPlay Polices. Double click 'Turn off AutoPlay' and ENABLE.
Quote
