Does this Riskware need to remain quarantined?

[JoshuaWillman]

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 8/17/18
Scan Time: 9:15 AM
Log File: 8b72adc6-a21f-11e8-952d-64006a82bab7.json
Administrator: Yes

-Software Information-
Version: 3.5.1.2522
Components Version: 1.0.391
Update Package Version: 1.0.6387
License: Premium

-System Information-
OS: Windows 10 (Build 17134.228)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 321346
Threats Detected: 8
Threats Quarantined: 8
Time Elapsed: 7 min, 52 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 4
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNSAS.EXE, Quarantined, [6508], [249733],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNSAS.EXE, Quarantined, [6508], [249733],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SUPERANTISPYWARE.EXE, Quarantined, [6508], [249843],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SUPERANTISPYWARE.EXE, Quarantined, [6508], [249843],1.0.6387

Registry Value: 4
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNSAS.EXE|DEBUGGER, Quarantined, [6508], [249733],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNSAS.EXE|DEBUGGER, Quarantined, [6508], [249733],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SUPERANTISPYWARE.EXE|DEBUGGER, Quarantined, [6508], [249843],1.0.6387
RiskWare.IFEOHijack, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SUPERANTISPYWARE.EXE|DEBUGGER, Quarantined, [6508], [249843],1.0.6387

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[miekiemoes]

Hi,

Yes, I suggest you keep this quarantined, this because this key isn't by default in Windows anyway and a lot of malware abuse these.

To elaborate some more, the IMAGE FILE EXECUTION OPTIONS - key is by default ONLY designed to debug certain programs, where they run a debugger under it.

So that means, instead of the actual exe it is running, it runs something else instead, as it has a debugger set for it. Malware has exploited this, so it can run anything instead of the program you are trying to launch (malware instead). However, some legitimate programs can set a debugger as well for other programs, in order to "control" the program you want to launch. Problem is, when you remove the program that has set a debugger for other applications, and the debugger key isn't removed along, you won't be able to run these applications anymore.

On top, using the IMAGE FILE EXECUTION OPTIONS key with as goal to run something else instead is bad practice and should ONLY being used for actual debugging as explained by Microsoft here: https://blogs.msdn.microsoft.com/oldnewthing/20051219-11/?p=32923/

Any other approach/use is not recommended and often abused, hence why we detect and quarantine this. It won't affect anything at all, we aren't detecting critical keys that need to be there, as these aren't created in the first place.

TuneUp Utilities often creates such keys, (which we don't recommend), but if you have TuneUp Utilities installed, or anything similar, you can ignore this detection, or leave it quarantined.

[JoshuaWillman]

Thank you for the quick response!