How to fix Image File Execution Options issue
What is Image File Execution Options (IFEO)
Image File Execution Options refers to a new technology adopted by OSO virus for anti-virus software. Its effect is similar to file association. Through this technology, anti-virus software can also be put to death. It usually manifests as a normal program placed anywhere or after the system is repaired, there will be redirection or inoperability problems.
Let's assume a scenario to better understand Image File Execution Options. Suppose your child is addicted to games and leads to a decline in academic performance. You might think that if the game program does not run, it will be great. Then, we can use Image File Execution Options technology to disable game software.
How Image File Execution Options Works
Before performing the following test, please make sure that your computer does not have antivirus software installed, because this technology is usually used by Trojan, so antivirus software will prohibit such operations.
Let’s take the Notepad program as an example.
1. Open the Registry Editor
Using the combine keys Win+R to open the Run window, enter regedit, and click OK to open the Registry Editor.
2. Locate IFEO in Registry Editor
On the left side of the Registry Editor, navigate to the following registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
3. Create a new registry key for Notepad
Right-click on the Image File Execution Options and select New -> Key, create a New Key#1.
Rename the newly created file New Key#1 to notepad.exe.
4. Set the debugger value for Notepad
Selected the newly key notepad.exe, right-click on the right window and select New -> String value, create a New Value#1. Change the name of New Value#1 to Debugger.
Double-click Debugger to pop up a dialog box, enter ntsd -d in the Value Data text box, and click OK. Then the Image File Execution Options is done.
5. Check and confirm the test
Now, let's try to open a text document and you will see this error message.
In fact, ntsd -d can also be replaced with other executable programs name, for example, WiseCare365.exe. Then Wise Care 365 will be opened when you try to open a text file.
6. Some notes for Image File Execution Options
If you do not have anti-virus software, but still cannot create a new key, then you need to set the permissions of the Image File Execution Options.
This method is more powerful. If you use this method on someone else's computer, it may cause someone to reinstall the system. So, be careful when using it!
How to fix Image File Execution Options issue
As mentioned before, Trojan program usually uses image file execution options (IFEO) to change system settings. There is a problem: How to remove the incorrect Image File Execution Options?
The answer is to delete the “Debugger” or fix the wrong associated program. If you can open the Registry Editor, navigate to the following registry key, then delete the Debugger in the incorrect registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
Of course, the registry cleaner in Wise Care 365and Wise Registry Cleaner can also remove image file execution options. The specific operations are as follows:
[Reference]
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/xperf/image-file-execution-options
Comments
Post a Comment