My regedit keys in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* have a lot of keys with the name of applications that I am sure that I have earlier removed as virus or malware, for example AppthgildeM.exe has two things
- A default value of type 'REG_SZ'
- A GlobalFlag of 'REG_DWORD' with a value 200 (I deleted this entry)
The rest of the keys with names of the malicious files only have the default value. I don't know the exact names of all the malicious entries so is there a way I can remove those?
The genuine entries have 'DisableExceptionChainValidation' set to 0 (thankfully) however explorer.exe has a value of 3. Should I change that back to 0?
Also for all the entries that I saw, they didn't have a debugger or any other key except for MitigationOptions set to 100 and a few specific ones like CFGOptions.