Embarrassing to admit, but I came in and started to apply updates to my Windows 7 VMs that I am running on Fusion 5. I do incident response, and the VM that I was doing it with was my documentation VM. I keep all my VMs locked down, generally. Specifically, I found that my A/V has a "Maximum Protection" mode that does things like banning executables from running from temporary directories, banning installations into Windows systems folders, banning changes to IE and Firefox settings, etc. It works pretty well for windows. Except during software updates, so I unlock the A/V and disable "Access Protection".
Someone had supplied me with a CD that they suspected of having malware on it, and labelled it with a moderately descriptive label. Someone else wanted to look at it, so they stopped by, weeks after I had gotten it. And I had misplaced it. Since it didn't have a great description, and after I looked in all of the normal places, I looked in a binder of CDs and DVDs and found a CD labelled "BadStuff". Thinking that was it, but not being sure, I put it in my Mac. When I went to it with finder, it wasn't there. So I went over to the VM that I was applying updates to, and voila, it had mounted it there. No question like I normally have with USB sticks regarding do I want to view it from Windows or the Mac. Ugh. So I go back to the internet, look up the registry entry that normally governs autorun (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom), and open regedit, and if it is 1 then autorun is enabled. Oops, it was 1. I eject the CD, and shutdown the VM.
Then I look at the contents from the Mac side, and there is an autorun.inf file which directs execution to a batch files, which creates a VBS script and executes it. But I don't see the evidence of it.
So I put in another CD with an autorun.exe file, and it doesn't execute.
I am wondering if my Lord Jesus has been merciful to me (well actually that is not in doubt, it is just that I am hoping for mercy in this too), and if VMware Fusion 5 might automatically mount CDs to running VMs, but override any automatic execution.
Jim