What are "image file execution options" ?

Callender said:

DavidW7ncus said:

Callender said:

I have software installed that prevents certain executable files from running if the file names are manually added to the block list. I'm actually struggling to understand how this works. I've done some digging about and I see entries listed as shown in the screenshot:

What are "Image Executions Debugger" and "Kernel Autoboot" ?

The software has no running process and doesn't appear in Task Manager so I'm trying to understand how it works. How does it block processes when it doesn't appear to have it's own running process?

Example usage:

I often install free software and then either keep it if I find it of use or remove it otherwise. It seems that a few times per year I'll end up installing some unwanted toolbar or PUP that has been bundled with a program's installer. So I've tried a few methods to block installation of unwanted toolbars when installing such software.

An example might be Photofiltre - it installs Ask Toolbar with no chance to opt out of the installation (last time I checked anyway) but using the software that I'm trying out results in the program installing cleanly without the toolbar.

What software (program) are you using for this?

I'm using Image Hijacker but I don't really recommend other users to download it as a lot of the published download links are dodgy

I use it to block toolbar installation and the like and display a message on screen when installation is blocked.

Thanks for the reply and info!
I've never used the Image Hijacker program ...
Maybe someone else that uses it will see see this thread and be able to help.

I'd be concerned with virus/malware ...

Got it! Forget everything about the kernel-mode driver I told before, it's probably wrong. That registry keys are the real thing that do the work.

That registry path is a Windows special entry. It's designed to help programmers to run programs under debuggers before they launch, so you can monitor your program in the early phases of its startup. What those keys do is, when the executable pointed there is run, Windows does NOT run it, but instead it runs the thing specified in the "Debugger"" entry, passing the whole original command line to it. The real intention is to put a debugger there that can monitor the target program, but it can really be used for anything, effectively replacing any program with another one. That behavior is built-in in Windows itself, your program has nothing to do with that, just sets those entries and provides a nice "alternative" program to run instead.

Look here:
Launching the Debugger Automatically
registry - set "Image File Execution Options" will always open the named exe file as default - Stack Overflow

A practical usage (discussed in the StackOverflow thread) is replacing Notepad with Notepad2. There is done manually, but as far as I remember, the official Notepad2 installer does exactly the same, effectively running Notepad2 everywhere instead of the real built-in Notepad.

BTW, may I suggest to use a more "innocent" program as a test piggy? Why not try this blocker with the calculator instead of a real virus?