Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Registry "Image File Execution Options" problems after running ComboFix


  • Please log in to reply
1 reply to this topic

#1 Guest_PetiteCharat_*

Guest_PetiteCharat_*

  • Guests
  • OFFLINE
  •  

Posted 09 December 2011 - 07:10 PM

Hi guys,
I recently ran ComboFix at the behest of an expert (nothing was found), however I've ran into a little problem since then. I am an avid user of the notepad replacement Programmers Notepad 2 (http://code.google.com/p/pnotepad/) and use a neat little trick with the "Image File Execution Options" registry key to launch Programmers Notepad 2 in the place of regular notepad, without doing any dodgy replacement of system files. The creator of PN2, Simon Steel, details this method on his blog (http://untidy.net/blog/2009/11/03/replacing-notepad-with-pn-via-image-file-execution-options/) but the gist of it is I make the following addition:

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe]
"Debugger"="F:\\Programs\\x86\\pn\\pn.exe --allowmulti -z"

This no longer seems to work. Regular notepad starts up, no matter what I do. I'm using 64bit windows, so the above change is correct - but I've tried regular SOFTWARE\Microsoft\Windows NT\etc.. to be sure

Edit:
Well, not one but two restarts later and everything is happy again. Not exactly sure why two restarts were required, but I'm not going to complain! Can a moderator please lock/delete/archive this thread or whatever you folks tend to do on Bleeping Computer. Thanks <3

Edited by PetiteCharat, 09 December 2011 - 07:24 PM.


BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,484 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA

Posted 09 December 2011 - 09:38 PM

Generally changes in the registry require a reboot in order for them to take place. I'm surprised the expert who was helping did not advise you to do that. Working with the registry can be tricky, dangerous and at times even quirky so the two restarts does not surprise me as the first one most likely did not result in the change to take affect.

Anyway, I'm glad you were able to sort it out.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users