Windows Security Tutorials - Herong's Tutorial Examples - v3.01, by Dr. Herong Yang
Image File Execution Options - Registry Key
This section provides a tutorial example on how to run Spybot 1.6 to scan Windows system. Many new Trojan entries were found in the registry key, Image File Execution Options.
In order to make sure that the PWS Trojan infection was fully removed, I did a full scan with Spybot - Search & Destroy 1.6. The result was very surprising:
Hupigon13 25 entries Trojans
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\wuauclt.exe
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\regedit.exe
...
Wind32.Delf.uv 14 entries Trojans
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\360rpt.EXE\Debug
...
Win32.VB.PW 1 entries Trojans
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\nod32kui.exe
I am not sure what the "Image File Execution Options" registry key is used for, But trusted Spybot and used its "Fix selected problems" button to remove all these Trojan entries.
As you can see, Spybot was doing a good job on detecting and removing Trojan infected registry keys that were not detected by McAfee VirusScan.
Table of Contents
About This Windows Security Book
Windows 8: System Security Review
Windows 8: System Security Protection
Windows 8 Defender for Real-Time Protection
Windows 7: System Security Review
Windows 7: System Security Protection
Windows 7 Forefront Client Security
Norton Power Eraser - Anti-Virus Scan Tool
McAfee Virus and Malware Protection Tools
Spybot - Spyware Blocker, Detection and Removal
Keeping IE (Internet Explorer) Secure
Malware (Adware, Spyware, Trojan, Worm, and Virus)
HijackThis - Browser Hijacker Diagnosis Tool
IE Add-on Program Listing and Removal
"Conduit Search" - Malware Detection and Removal
"Tube Dimmer", "Scorpion Saver" or "Adpeak" Malware
Malware Manual Removal Experience
Vundo (VirtuMonde/VirtuMundo) - vtsts.dll Removal
Trojan and Malware "Puper" Description and Removal
VSToolbar (VSAdd-in.dll) - Description and Removal
►PWS (Password Stealer) Trojan Infection Removal
What Is PWS (Password Stealer) Trojan?
JS/Downloader.gen - JavaScript Downloader Malware
PWS-Mmorpg.gen - A Password Stealer Trojan
heb.exe - The Trojan Installer Program
.exe and .dll Files Installed by the Trojan
my.exe - A Second PWS Trojan Infection
.exe and .dll Files of the Second Trojan
Explorer.EXE Trying to Install a Trojan
AccessProtectionLog.txt Log File Records
ATF-Cleaner.exe - Temporary File Remover
Trajon Files Left in the System Folder
Removing PWS Trojan Startup Entries
Command Processor AutoRun - Registry Value
UserInit - Winlogon Registry Key
js.users.51.la - hosts File Entries
►Image File Execution Options - Registry Key