The dual role of XP registry keys

  
Windows XP uses a registry key called "Graphic File Execution Options" to let you set the performance of a particular operation.
With this key value, most of the options are valid, including core level features that programmers often use to detect storage vulnerabilities and a host of problems. This does not require much creative work, however, it can be a fairly advanced approach to fundamentally prevent certain programs from running.
This registry key is: HKEY_LOCAL_MacHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\.
Open the registry and take a look. You may see that there are many replacement key values ​​that already exist, and each replacement key value contains a name that can execute the graphic. Each replacement key value also contains one or more values ​​that govern how the program behaves. Among these values, we are most interested in a string of values ​​called debuggers that allow a particular debugger to terminate the application when it starts. The built-in debugger with command line in Windows XP is called ntsd. If someone is running, ntsd can be used as a way to immediately terminate the application's operation.
To block an application, first add the new replacement key value to the image file execution option and name it after you run the executable. This includes the extension of the file, but does not include the path - just the name and the executable itself. (Other alternative key values ​​listed there can be used as an example to guide you through this work.) In the new key value, create a string of values ​​and name it Debugger; set the debugger value to: ntsd – (ntsd --, consists of a space, two dashes.)
This will cause the debugger to attach to the application and be able to exit immediately.
Please remember that ordinary users are not allowed to modify the registry, otherwise they will easily mess up the registry. This trick can also be used to log in to web scripts, a strategy, or part of a system image to block some "famous unwanted programs" in advance. (In theory, the normal way to prevent normal programs from running, so it can also be used to make attacking virus programs.)
The JSI FAQ site has interesting features for this technology
skill. They set up a way to use it to block the user's Windows operating system update -- that is, to prevent the wupdmgr.exe application from running. (This method can be found in the 9017 Tips on its website.)
Copyright © Windows knowledge All Rights Reserved