According to Wikipedia:
For all drive types, except DRIVE_CDROM, the only keys available in the [autorun] section are label and icon. Any other keys in this section will be ignored. Thus only CD and DVD media types can specify an AutoRun task or affect double-click and right-click behaviour.
There is a patch available, KB971029 for Windows XP and later, that will change AutoRun functionality to this behaviour.
So, this would indicate that some parts of
autorun.inf are still indeed processed by Windows 7 upon insertion of any removable media. How much of it gets processed is dependent upon whether the media in question is in the optical drive.
I'm not aware of any current vulnerabilities specifically connected to the
icon keys, but that doesn't mean there won't ever be any. There's also the possibility that you may encounter an infected CD/DVD/BD or other optical media where more of
autorun.inf would get processed. So, to protect yourself properly, I would still recommend disabling processing of
autorun.inf in its entirety.
Michael Horowitz wrote a great blog article about how Autorun and Autoplay work some time ago. Echoing work done by Nick Brown and Emin Atac, the article included a registry hack to disable all processing of
autorun.inf. I'll paste the registry hack details below. Check out the article link for more information.
The suggested solution involves updating the Windows Registry. So, as always, it's best to make a backup. The solution was written for Windows XP/Vista, but it should work in 7 as well.
Zapping the registry is simple, all you need is the three lines shown below in a .reg file. Then double click on the file.
You can either copy the three lines below from this web page or download the file using the link at the bottom of this posting. The file name is not important, other than it should end with ".reg". Computerworld does not allow attaching files ending with ".reg" to a blog posting, so the file type is ".txt" and you'll have to rename it to end with ".reg".
Note that there are three lines in the file, the middle line may wrap when displayed by a web browser, but it needs to be a single line in the .reg file.
Nick Brown explains what this does:
This hack tells Windows to treat AUTORUN.INF as if it were a configuration file from a pre-Windows 95 application ... it says "whenever you have to handle a file called AUTORUN.INF, don't use the values from the file. You'll find alternative values at HKEY_LOCAL_MACHINE\SOFTWARE\DoesNotExist." And since that key, er, does not exist, it's as if AUTORUN.INF is completely empty, and so nothing autoruns, and nothing is added to the Explorer double-click action. Result: worms cannot get in - unless you start double-clicking executables to see what they do ...
The text "DoesNotExist" in the third line is meant to be a place in the registry that does not exist. If this zap gets very popular, malware may look for it, so it can't hurt to change it just a bit. For example, I might use something like
on my computers. To be clear, this is not at all required. The zap as shown above works fine.
Of course, this doesn't really do much against USB sticks that present themselves to the system as something other than what they actually are. The best solution is to just not plug in any device that you don't trust. And, don't plug any devices that you do trust into systems that you don't.
For additional info about Autorun/Autoplay and how they work, see the websites already referenced. Also, check out these Wikipedia links: