Comments on: Image File Execution Options

By: johnny

johnny — Wed, 06 Jul 2011 11:52:10 +0000

Thanks for your detail explanation.
It is so fantastic with screenshot.

Thanks again.

By: Ankur

Ankur — Sun, 26 Sep 2010 08:20:42 +0000

Thanks Lokesh..very well explained…
@ken most end users run their machine logged in as admin.

By: MySpace Comments

MySpace Comments — Wed, 10 Dec 2008 20:25:07 +0000

Thanks for explaining image file execution stuff.

By: Tyler

Tyler — Wed, 10 Dec 2008 17:04:31 +0000

Um, Ken/suc – most users run with admin privs. Thats how malware gets a hold in the first place.

Thanks Lokesh – informative post.

By: Bruce

Bruce — Wed, 10 Dec 2008 16:10:23 +0000

Ken – the author never said this was a hole. This is just bringing attention to another technique to autorun something malicious. Malware authors take advantage of it seems like a dozen or more methods to autorun their programs, and many do require admin rights. Malware authors also take advantage of uncountable attack vectors that will get at your users PC’s. And guess what? most shops run with users as admins as do most home users. but more importantly, IT administrators need to know about these techniques so we can intelligently fight new malware ourselves when our AV vendor’s product does not have an update yet.

By: suc

suc — Wed, 10 Dec 2008 13:21:01 +0000

writing in HKey_Local_Machine requires administrative privileges.

By: Ken Hagan

Ken Hagan — Wed, 10 Dec 2008 13:14:50 +0000

This has been in NT since the outset. Yes, it’s intended as a debugging aid, but it is hardly a malware hole. You need admin rights to tweak it.