Tonight I have come across a strange phenomenon on win7 (64bit pro). When I copy regedit.exe to for example c:\ I am no longer able to run it. It simply doesn't start any more. When I try to debug it whit olly db, olly says it's no valid 32bit pe file any more. A closer look reveals that the file is somehow scrambled/realigned. The PE-Header is moved 8 bytes back. The sections rdata and pdata appear from nowhere.
What the hack is going on here?
Cheers, Jan
regedit.exe
in the first place? How did you try to move it?