The bug fix, delivered through Microsoft's standard automatic update systems, comes one month after the U.S. Computer Emergency Readiness Team (US-CERT) issued a warning that Windows did not properly disable AutoRun on Windows 2000, XP and Server 2003.

"Disabling AutoRun on Microsoft Windows systems can help prevent the spread of malicious code," CERT said in its advisory. "However, Microsoft's guidelines for disabling AutoRun are not fully effective, which could be considered a vulnerability."

Microsoft had said that technical users could disable AutoRun by setting a Windows Registry value called NoDriveTypeAutoRun to 0xFF. The problem was that, even with this value set, some versions of Windows would launch AutoRun programs whenever the user clicked on a device's icon using Windows Explorer.

That could mean big trouble for some users, as the widespread Conficker worm uses AutoRun to spread from USB devices to PCs.

There has been some internal debate within Microsoft as to whether Windows should enable AutoRun by default, since the software can be misused. AutoRun helped install the notorious Sony rootkit copy-protection software on users' PCs four years ago.