Home > Think Tank > How to fix Image File Execution Options issue
February 23, 2021

How to fix Image File Execution Options issue

What is Image File Execution Options (IFEO)


Image File Execution Options refers to a new technology adopted by OSO virus for anti-virus software. Its effect is similar to file association. Through this technology, anti-virus software can also be put to death. It usually manifests as a normal program placed anywhere or after the system is repaired, there will be redirection or inoperability problems.
Let's assume a scenario to better understand Image File Execution Options. Suppose your child is addicted to games and leads to a decline in academic performance. You might think that if the game program does not run, it will be great. Then, we can use Image File Execution Options technology to disable game software.


How Image File Execution Options Works


Before performing the following test, please make sure that your computer does not have antivirus software installed, because this technology is usually used by Trojan, so antivirus software will prohibit such operations.
Let’s take the Notepad program as an example.

1. Open the Registry Editor


Using the combine keys Win+R to open the Run window, enter regedit, and click OK to open the Registry Editor.
WiseCleaner Run window

2. Locate IFEO in Registry Editor


On the left side of the Registry Editor, navigate to the following registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options


3. Create a new registry key for Notepad


Right-click on the Image File Execution Options and select New -> Key, create a New Key#1.
Rename the newly created file New Key#1 to notepad.exe.
WiseCleaner IFEO Registry Editor

WiseCleaner IFEO New Registry Key

4. Set the debugger value for Notepad


Selected the newly key notepad.exe, right-click on the right window and select New -> String value, create a New Value#1. Change the name of New Value#1 to Debugger.
Double-click Debugger to pop up a dialog box, enter ntsd -d in the Value Data text box, and click OK. Then the Image File Execution Options is done.
WiseCleaner IFEO New String

WiseCleaner IFEO New String Value

5. Check and confirm the test


Now, let's try to open a text document and you will see this error message.
WiseCleaner IFEO Test

In fact, ntsd -d can also be replaced with other executable programs name, for example, WiseCare365.exe. Then Wise Care 365 will be opened when you try to open a text file.

6. Some notes for Image File Execution Options


If you do not have anti-virus software, but still cannot create a new key, then you need to set the permissions of the Image File Execution Options.
This method is more powerful. If you use this method on someone else's computer, it may cause someone to reinstall the system. So, be careful when using it!

How to fix Image File Execution Options issue


As mentioned before, Trojan program usually uses image file execution options (IFEO) to change system settings. There is a problem: How to remove the incorrect Image File Execution Options?
The answer is to delete the “Debugger” or fix the wrong associated program. If you can open the Registry Editor, navigate to the following registry key, then delete the Debugger in the incorrect registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options


Of course, the registry cleaner in Wise Care 365and Wise Registry Cleaner can also remove image file execution options. The specific operations are as follows:
WiseCare365 Fix IFEO

[Reference]
https://docs.microsoft.com/en-us/previous-versions/windows/desktop/xperf/image-file-execution-options








6 0

WHY CHOOSE WISECLEANER?

60-Day Money-Back Guarantee

Try before you buy with a free trial – and even after your purchase, you're still covered by our 60-day, no-risk guarantee.

Secure Online Payment

We value your privacy and protect your financial and personal data, support several safe methods of payment.

7 X 24 SUPPORT SERVICE

Knowledgeable representatives available to assist you through email response within 24 hours.