Media Auto run

https://community.bitdefender.com/en/discussion/102371/media-auto-run

I cannot reproduce the issue.

The Media Auto Run is turning on automatically
It is off in Control Panel>Autoplay or Windows Settings>Devices>Autoplay? Or it is the event that appears in the Bitdefender Notifications?

Disabling it does not work more than few days , why?

How did you disabled it? Directly from the Settings or Control Panel, or by clicking Fix issue in Bitdefender Notifications? If clicked Fix Issue the Media autorun is enabled should have been turned green and another event Media autorun is disabled should have been appear, so I suppose it is from Windows settings? (Unless you hit a bug, this is why I would like to know exactly what steps you did).

@camarie thx for your kind attention , the media auto run was switched off in the windows settings

Afterwards in the bitdefender , there are no alerts in the notification panel about that , i find switching media auto run to off recommendation right inside the settings:

i just fixed it few days ago and the recommendation is here again.

You might hit a some sort of bug, although I am unable to reproduce it yet. We have an issue filed for now and we will continue hunting it, although I tried various scenarios and I am yet unable to repro.

I will probably need some more details as the investigation continues, if that is ok for you.

https://community.bitdefender.com/en/discussion/comment/347194#Comment_347194

i would be glad to help you plz let me know what sort of favor do u want ?

At this time just to confirm me (or not) if these are the steps:

installed/updated the product
a vulnerability scan (manual? automatic?) was executed and generated a Media autorun is enabled notification event in Notifications
disabled Autoplay from Windows > Settings
was there another manual vulnerability scan executed?

The reason I am asking in so much detail is this: the notification that results from a previous scan remain. The fact that the setting was changed in Windows does not make the notification dissapear, since it is needed another scan to update the status of autorun (we are not actively monitoring the status of this setting, just scan and taking a snapshot of the situation at a given point in time).

It might be like this. The current logic is that either an automatic scan or the user invokes a manual scan, the scanner detects the issue (Media autoplay enabled), the user sees in the scan result the issue and press Fix Issue (the same thing can be done also directly from the generated notification if clicked on it to expand). What happens in this moment is another scan - but this time only for the issue to fix - executes, and the scanner 1. generates another notification about the fixed issue and 2. mark the previous issue (the one you are seeing) as Fixed and it becomes green. In both cases, the previous notification does not dissapear, it will only be marked as Fixed.

So I would like you to try (I will do this as well) to go in Notifications, expand the Media auto notification, and click Fix Issue (or rerun the Vulnerability Scan in its entirety if you so choose, but is simpler to just click on fix issue). The expected result is that another notification about the issue been fixed (Media autorun disabled) to appear and also mark the previous one as green (fixed). Even if the current status of Autoplay is already disabled, a rerun of the scan will force re-detection.

I did reproduced this scenario - if this is indeed how it behaves also on your particular setup and it is not something else happening. If that is the case, I suppose some improvement can be done here (in no particular order):

monitor the autoplay status (it will not impose performance penalties) either by monitoring the setting or simply just polling it every now and then
if a Media autorun is enabled issue exists and the setting was changed externally, mark the issue as fixed (while still letting the event exists since that was generated at that time) or just rerun the scanner only for that issue as if Fix Issue was invoked (to avoid doing the same code in multiple places and have a consistent way of scanning, changing only the necessity to invoke it not only periodically or at user request, but from detection the fact the setting changed since the time when the issue has been detected).

That would work for a simple setting like Autoplay; doing this for the entire range of scanners would prove too costly - although this would be the correct way of doing it (do scan 1 at moment T1, then another scan 2 at moment T2 and compare the snapshots) - this is the main reason the automatic scans are run at most daily (some of them weekly) and prefer to let the user just be aware of potential issues, while letting the manual scan to display and let the greater control to the user. I hope this makes sense and not being too convolute (something I am prone to do, I admit).

@camarie bro all of this should be fixed by the devs, when media auto run is clicked to make it disable , all of the rest should be done by the software. i am not in position to follow the extremely detailed procedure.

Got it. We'll continue from here.

@camarie obliged😀

I have the same issue as follows: -

I installed BDTS on 28th January 2025 and, up until early May 2025 a File Explorer window would launch whenever I inserted a USB stick or external USB drive. In early May 2025 I remember seeing a Bit Defender alert regarding AutoPlay or Media play and since then FE no longer launches when USB devices are plugged in. It is easy enough to launch FE myself to view and manage files on the devices but I shouldn't have to do this.
Windows AutoPlay is still enabled in Settings and should ‘Open folder to view files (file explorer) but it doesn’t.
Also, BD scans USB connected devices every time they are plugged in so AutoPlay launching FE to view files should not be a problem. It seems that BD is blocking AutoPlay from launching FE, which is an unnecessary inconvenience.
Is this a BD bug? If so is there a Windows registry hack?

I asked a colleague to try to reproduce the issue on this scenario

initially Autoplay ON
install BDTS
disable Autoplay (this is where I need your help: did you disabled it from Notifications using Fix issue ?)
check if the registry controlling this changes and if Windows setting changes as well.

We'll get back with more details.

You ask "did you disabled it from Notifications using Fix issue ?" and the answer is yes, I did and it toggled AutoPlay off in the Settings window so I toggled it back on again because I want it on.

You ask "check if the registry controlling this changes and if Windows setting changes as well". I am not sure if you mean the registry Name NoDriveTypeAutoRun but if you do mean this then the Value is 0 and it does not change from 0 to another value.

I meant HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, specifically the value of NoDriveTypeAutoRun. I tested already on Windows 11 and it seems to be something else, but I won't say no to any type of detail you might find significant, no matter how speculative might be.

See photo re the status of NoDriveTypeAutoRun

Strange. Value 0 should mean "nothing to do", since this can be one of the values as documented here:
https://www.samlogic.net/articles/autorun-enable-disable-nodrivetypeautorun.htm

So, for example, 0x91 means "Enabled for CD/DVD and USB drives" (i.e. removable media), 0x95 "Disabled for USB flash drives". NoDriveTypeAutoRun is not read or set by the vulnerability scan, only by USB Immunizer. Maybe it is worth trying to delete (or rename) the value, and check also in the legacy Control Panel > Autoplay as well.

https://www.lifewire.com/disable-autorun-on-a-pc-153344

The following article says to delete the DWORD NoDriveTypeAutoRun

This worked and AutoRun (AutoPlay) now works again for both USB flash drives and my external USB SSDs.

I can only imagine that a Bit Defender bug created the DWORD NoDriveTypeAutoRun sometime early May 2025 because it was working before but not for the last 2 1/2 weeks or so.

Incidentally there are two locations where the DWORD appears. The second location is: -

Issue fixed. Thanks for pointing me in the right direction but that BD bug needs fixing.

Correct, only the HKEY_LOCAL_MACHINE affects all users.

About if there is a bug or not: I will open an issue on Immunizer (it's the only place where I found this value set, although it should not be set to 0). Can you tell me if USB Immunizer was involved in your interaction with the product?

I can't see anything called Immunizer anywhere in Bit Defender TS?

It's not on the main interface, just on the contextual menu in Explorer, if you right click an USB drive.

So that is a 3-step deliberate action, which I would remember doing so I can definitely say that I have never used Immunizer. Never had to use it and I didn't even know it existed. Maybe Immunizer did something in the background that I wasn't aware of. i.e. A bug.

1. Right-click on the USB drive

2. Scroll up to BitDefender

3. Select Immunize this drive

No, immunizer needs to interact with, either via the contextual menu, or via an alert (I don't remember if one still exists now). I would assume there is a very low change you interacted with the USB immunizer, so we will continue to investigate the vulnerability scan mainly. (I would not exclude also a Windows alert or notification, but at this time I cannot come up with a specific one).