RiskWare.IFEOHijack: what it is and how to remove it
RiskWare.IFEOHijack detects malware that modifies Windows registry to hijack application execution. The technique can cause application errors and grant malware control over what programs actually run.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like RiskWare.IFEOHijack usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove RiskWare.IFEOHijack yourself 4 steps, about 12 minutes, no software needed.
Start the steps
RiskWare.IFEOHijack: summary
| Name | RiskWare.IFEOHijack |
|---|---|
| Type | Riskware, malware |
| Possible related malware | There are many malware families that may be marked as RiskWare.IFEOHijack, including a variety of potentially unwanted programs and malware, such as banking trojan TrickBot |
| Related Registry modification | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ |
| Infiltration | Malware may be installed on the host system in various different ways, including spam emails, exploits, web injects, drive-by downloads, software cracks, adware bundles, etc. |
| Potential risks | Users infected with malware may be victims of money theft and identity fraud; some other infections may be less threatening and not engage in data harvesting but rather induce a variety of pop-up ads and other commercial content |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Symptoms | An unknown program in Installed apps |
| Evidence | 5 write-ups by security sites; details still limited |
| Program | RiskWare.IFEOHijack |
| First seen | 22 October 2019 |
| Facts checked | 5 October 2026 |
Is RiskWare.IFEOHijack safe? Why it is flagged
From our report of Oct 2019 · not reviewed since
Protect your machine from online threats by being attentive online
As mentioned above, it is highly likely that malware that triggered the alarm of the security application was installed by the computer owned due to a lack of knowledge when it comes to safe online behavior or simple negligence.
Regardless of what the reason is, it is vital to make sure that optimal precautionary measures are applied in order to prevent malware from entering the machine and stealing sensitive data, installing other threats, or performing other malicious actions before the damage can be caused.
Security researchers from novirus.uk warn users that they should always be careful when it comes to online behavior. Here are some general security tips you could follow to prevent malware infections in the future:
- Never allow email attachments to execute macro commands unless you are completely sure that the email is genuine and you were supposed to receive such an email;
- Update your operating system along with all the installed programs as soon as security patches are released;
- Protect all your accounts with strong passwords that are never reused (or use a password managing program);
- Never download pirated software or hacking tools/cracks/keygens from torrent/warez sites;
- Avoid using default Remote Desktop TCP port 3389 and disconnect the connection as soon as it is not needed;
- Be aware that adware bundles may include applications that can compromise your online security and computer safety - proceed with each freeware app installation carefully, always picking Advanced/Custom settings and removing all optional programs on the way;
- Scan all unknown executables and other files with tools like Virus Total;
- Install reputable ant-malware software that can protect you from malicious online content as well.
From our report of Oct 2019 · not reviewed since
More from our earlier report on RiskWare.IFEOHijack
- RiskWare.IFEOHijack is a generic detection name used by Malwarebytes in order to indicate behavior which is typical to malware on Windows operating systems.
- While such behavior may be an indication of a false positive (for example, it is known that Avast's Cleanup - Background & startup programs feature alters the key to put applications to sleep), many viruses may engage in these actions, and Malwarebytes flags them as RiskWare.IFEOHijack.
- Some legitimate applications, such as Avast anti-virus or AVG TuneUP, might be using Image File Execution options registry for genuine processes on the machine
- Once you are sure that RiskWare.IFEOHijack is malicious, you should take action and delete it with security applications like , , or another reputable anti-malware.
- If the detection is a false-positive, you should add it to Malwarebytes exception list
- Evil can be done with the Image File Execution Options key.
- Malware can install themselves as the "debugger" for a frequently-run program (such as Explorer) and thereby inject themselves into the execution sequence.
- Note that the ability to use the Image File Execution Options key for evil purposes is not a security hole.
- To modify the key in the first place requires administrator permissions.
- If you are sure that the file is safe (for example, an element from Avast anti-malware suite may be causing the false-positive detection due to the modification of the precisely same registry key), you should add it to Malwarebyte's exception list as follows:
From our report of Oct 2019 · not reviewed since
RiskWare.IFEOHijack is a detection for malware which makes Windows launch alternative executable instead of the original one
A debugger is set under the Image File Execution Options registry key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\) which is related to a particular application, for example, Google Chrome or Mozilla Firefox. Due to the set debugger, when users try to launch a relevant app, they will launch an alternative executable instead and, if the security software is installed, RiskWare.IFEOHijack detection will follow.
Therefore, if you encountered such detection by your security software, it should be investigated further to make sure no malware like banking trojan TrickBot is involved.
The usage of the debugger may cause several issues after RiskWare.IFEOHijack removal. It was reported by Microsoft researchers that users might get ERROR_FILE_NOT_FOUND error when trying to run the target application the registry of which was modified. As a result, the target app will no longer work correctly until the path to the debugger is corrected, or debugger uninstalled.
Additionally, when the File Execution Options key is modified by malware, it can be set to do multiple malicious tasks:
This immediately points to the conclusion that those that are infected with RiskWare.IFEOHijack virus most likely installed a malicious application themselves without knowing it, and the required permissions were granted for malware to cause the changes in the first place.
For a full RiskWare.IFEOHijack removal, you should immediately access Safe Mode with Networking and scan the machine with anti-malware software, such as , , or . The security application should be able to eliminate the core malware files, and all the installed components/modules automatically and also fix the Windows registry issues. For further instructions, please check our removal guide below.
How to uninstall RiskWare.IFEOHijack
How to remove RiskWare.IFEOHijack
Uninstall the bundle first, then everything it added:
- programs
- extensions
- changed browser settings
Step 1: Uninstall RiskWare.IFEOHijack
Open Settings > Apps > Installed apps in Windows 11, or Settings > Apps > Apps & features in Windows 10. Sort the list by install date and find RiskWare.IFEOHijack, then choose Uninstall from the three-dot menu next to it (in Windows 10, click the entry and then Uninstall).
Remove anything else installed on the same day that you do not recognise, because such programs usually arrive together in one installer. If the uninstaller opens a browser page with an offer or a survey, close it: the program is removed either way.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Remove it from startup
Whatever RiskWare.IFEOHijack installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
What the uninstaller leaves behind is usually in the user folders. Open File Explorer, switch on View > Show > Hidden items (in Windows 10 View > Hidden items), and go through
%LocalAppData%,%AppData%, %ProgramData% and the two Program Files folders.Sort by Date modified and delete folders that appeared together with the problem and belong to no program you use. Folders with random names that hold
.exe,.dll, .js or .ps1 files are the strongest sign.Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
From our report of Oct 2019 · not reviewed since
Get rid of RiskWare.IFEOHijack virus if it is not a false-positive
While there is a chance that RiskWare.IFEOHijack is indeed a false-positive - its presence on the device always requires taking actions.
However, you need to remove RiskWare.IFEOHijack virus if it is connected to malware infection. To get a better indication for that, you should scan your machine with other security software in Safe Mode with Networking - we explain how to access it below. RiskWare.IFEOHijack removal should prevent personal information compromise or a complete takeover of your machine by malicious actors.
[GI=method-1]The best environment to delete the malware in is Safe Mode, as it only loads Windows with only basic drivers and processes, preventing malware from operating. Here is how to enter the mode and remove RiskWare.IFEOHijack by using anti-malware software:
- Click on Settings on the left pane and then Exclusions at the top
- Select Add Exclusion
- Pick Exclude a File or Folder and then Next
- Click on Select Files or Select Folder
- Locate the file/folder in question and then click OK
Questions about RiskWare.IFEOHijack
What is RiskWare.IFEOHijack?
RiskWare.IFEOHijack is a generic detection name used by Malwarebytes to indicate malware behavior typical to Windows operating systems. The detection flags when a debugger is set under the Image File Execution Options registry key (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\).
Due to the set debugger, when users try to launch a relevant application like Google Chrome or Firefox, they launch an alternative executable instead. This hijacking of application execution is suspicious behavior that security software flags as a potential threat. While legitimate applications like Avast might use this key for genuine processes, many viruses engage in these actions.
Is this a false positive?
RiskWare.IFEOHijack detection might be a false positive if legitimate applications like Avast anti-virus or AVG TuneUP are using Image File Execution options registry for genuine processes. Avast's Cleanup feature specifically alters this key to put applications to sleep. However, many viruses may also engage in these actions, and Malwarebytes flags them all.
The detection itself is not necessarily confirmation of malware but requires investigation. If you are sure that the file is safe, you should add it to Malwarebyte's exception list. Otherwise, proceed with caution and investigate further.
What malware uses this technique?
Many malware families mark themselves as RiskWare.IFEOHijack, including potentially unwanted programs and serious threats like banking trojan TrickBot. The Image File Execution Options key hijacking is a known technique used by various malware strains.
Some legitimate software also uses this key for genuine processes, making distinction difficult. Banking trojans use this technique to intercept application launches and steal credentials. Advanced security measures need to be taken if you suspect malware involvement rather than legitimate software usage.
How does this hijacking affect my PC?
When the File Execution Options key is modified by malware, several issues can occur after RiskWare.IFEOHijack removal. Microsoft researchers reported that users might get ERROR_FILE_NOT_FOUND error when trying to run the target application whose registry was modified.
As a result, the target app will no longer work correctly until the path to debugger is corrected or debugger uninstalled. Additionally, when the key is modified by malware, it can be set to do multiple malicious tasks including injecting itself into execution sequences of frequently-run programs. The registry modification essentially gives malware control over application launching.
How did this get on my computer?
Malware may be installed on your host system through spam emails, exploits, web injects, drive-by downloads, software cracks, and adware bundles. You likely installed a malicious application yourself without knowing it, and the required administrator permissions were granted for malware to cause the changes.
Those infected with RiskWare.IFEOHijack most likely granted malware the necessary permissions during installation. Remember that ability to use the Image File Execution Options key for malicious purposes requires administrator permissions. Anyone who can exploit this feature already owns your machine.
What should I do if this is detected?
If your security software flags RiskWare.IFEOHijack, first determine if it is malicious or a false positive. If you are sure the file is safe from a legitimate application, add it to Malwarebytes' exception list.
Click on Settings on the left pane, then Exclusions at the top, pick Exclude a File or Folder and then Next. Click on Select Files or Select Folder and locate the file/folder in question. However, you need to remove RiskWare.IFEOHijack if it is connected to malware infection.
How do I remove it if it is malicious?
For a full RiskWare.IFEOHijack removal, immediately access Safe Mode with Networking and scan the machine with anti-malware software. The security application should eliminate core malware files and installed components/modules automatically. It should also fix Windows registry issues caused by the modification.
If you are unable to delete the infection in normal mode, access Safe Mode with Networking and perform a full system scan from there. Try alternative security software if one vendor is unable to remove the threat completely. After removal, verify that your target applications launch correctly without errors.
How can I protect against this technique?
Never allow email attachments to execute macro commands unless you are completely sure the email is genuine and you were supposed to receive it. Update your operating system and all installed programs as soon as security patches are released.
Protect all your accounts with strong passwords that are never reused or use a password manager. Never download pirated software or hacking tools from torrent or warez sites.
Be aware that adware bundles may include applications that compromise online security. Scan all unknown executables with tools like Virus Total before running them. Install reputable anti-malware software that can protect you from malicious content.
Will Fortect remove RiskWare.IFEOHijack?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For RiskWare.IFEOHijack, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Avast: Avast Cleanup Premium software casue RISKWARE IFEO.HIJACK infection (read October 5, 2026)
- Sophos: IFEOHijack Trojan or False Positive (Debugger) (no longer online) (read October 5, 2026)
- Microsoft: Beware the Image File Execution Options key (read October 5, 2026)
- FTC: How to recognize, remove and avoid malware (read October 5, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 5, 2026)