Registry probing traces the hazards of virus image hijacking

Definition of image hijacking
 
The so-called Image hijacking (IFEO) is the Image File Execution Options, which is located in the Registry
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options
This item is mainly used for program debugging and is of little significance to general users. By default, only Administrators and local systems have the permission to read and write modifications.
 
Similarly, if I want to run qq.exe, the result is flashget.exe. That is to say, in this case, the QQ program is hijacked by FLASHGET, that is, the program you want to run is replaced by another program.

Image hijacking Virus

Although image hijacking is a built-in function of the system, it is not necessary for general users, but there are some viruses that use image hijacking to make a fuss. On the surface, it seems that a program is running, in fact, the virus is already running in the background.
 
Most viruses and Trojans are run by loading the system startup item, and some are registered as system services for startup. They mainly achieve this by modifying the registry, it mainly includes the following aspects:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_DLLs
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows ntcurrentversionwinlogonpolicy
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesOnce

However, unlike general Trojans and viruses, some viruses do not load themselves, but do not run as the system starts, but when you run a specific program, it also captures the psychology of some users. For average users, as long as they find that their machines are infected with viruses, the first thing to check is the system's add-ons. Few people think of image hijacking, which is also a good place for this virus.

The image hijacking virus is mainly used to hijack a normal program by modifying the HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution options item in the registry. For example, if a virus vires.exe needs to hijack the qq program, a new qq.exe item will be created on its, the key value of the new string under this item is: C: WINDOWSSYSTEM32VIRES. EXE (here is the directory where the virus hides. Of course, if you change the string value to any other value, the system will prompt that the file cannot be found.

Basic Principles of image hold

When a windows nt system tries to execute an executable file running request called from a command line, it first checks whether the running program is an executable file. If yes, it then checks the format, then, the system checks whether there is a vulnerability. If it does not exist, it will prompt that the system cannot find the file or "the specified path is incorrect. After deleting these keys, the program can run!
 
Application of Image hijacking

★Disable the running of some programs

First look at a piece of code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File
Execution Optionsqq.exe]
"Debugger" = "123.exe"

Save it as norun_qq.reg and double-click it to import the Registry. Open your QQ and check the effect!

The purpose of this Code is to prohibit QQ running. Every time you double-click to run QQ, a box will pop up saying that QQ cannot be found because QQ is redirected. If you want to continue running QQ, you can change 123.exe to its installation directory.

★Prank

Every time we press CTRL + ALT + DEL, the task manager will pop up. Do you want to bring up a command prompt window when we press these keys? Here is how to play:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File
Execution Optionsaskmgr.exe]
"Debugger" = "C: \ WINDOWS \ pchealth \ helpctr \ binaries \ msconfig.exe"

Save the above Code as task_).reg and double-click to import the registry. Press those three keys to see what the results are. Don't let me talk about it. Aren't you surprised! What is wonderful?

★Get the virus lost

Like the above, if we redirect the virus program, the virus will not run. The answer is yes! Let's try it on our own!

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File
Execution Optionssppoolsv.exe]
"Debugger" = "123.exe"
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File
Execution Optionslogo_1.exe]
"Debugger" = "123.exe"

). Isn't it fun? I can't think of a virus today!

Of course, you can also redirect the virus program to the program you want to start. If you want to enable the QQ program, you can change your 123.exe to your QQ installation path, provided that these viruses must be started with the system.
I have talked a lot about image hijacking. Next I will introduce how to prevent image hijacking!

Image hijacking prevention

★Permission Restriction

If you do not have permission to access this registry key, it cannot modify these items. Open Registry Editor and go
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options, select this option, right-click --> permission --> advanced, and lower the permissions of the administrator and system users (here you only need to cancel the write operation ).

★Cutting your teeth

Open the Registry Editor and enter the HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options
To solve the problem.