2

My regedit keys in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options* have a lot of keys with the name of applications that I am sure that I have earlier removed as virus or malware, for example AppthgildeM.exe has two things

  1. A default value of type 'REG_SZ'
  2. A GlobalFlag of 'REG_DWORD' with a value 200 (I deleted this entry)

The rest of the keys with names of the malicious files only have the default value. I don't know the exact names of all the malicious entries so is there a way I can remove those?

The genuine entries have 'DisableExceptionChainValidation' set to 0 (thankfully) however explorer.exe has a value of 3. Should I change that back to 0?

Also for all the entries that I saw, they didn't have a debugger or any other key except for MitigationOptions set to 100 and a few specific ones like CFGOptions.

Thanks!

1 Answer 1

2

Registry keys always have a "default" value of REG_SZ type – this is a leftover from Windows 3.x era, when this was literally the only data format the registry had. (Hence the odd key/value/data terminology.)

As far as I know, "Image File Execution Options" places no significance on the subkey merely being present (which some other places of the registry do), so only non-default values are important here.

DisableExceptionChainValidation is always set to 3 for Explorer.exe, even on brand new installations. I can only guess this has something to do with third-party shell extensions, which load tons of (garbage) code into the Explorer.exe process.

GlobalFlag is a bit mask; each bit has its own meaning. It seems having the bit 0x200 set enables some sort of silent exit monitoring, and I suspect it might be used as a way to automatically restart the malware process whenever it's killed (e.g. by having a Scheduled Task that's triggered by the event log entry).

1
  • Ah so I can just let them be without any problems. Is there any way to identify if the key was generated by a malware apart from some with obvious names or do I have to manually google for every key? Jun 4, 2020 at 11:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.