Just ran across this today. New to me but apparently it's been around a long time.
 
Image File Execution Options” is an Evil Registry Key
 

Came across a variant of Antivirus XP today that uses a particularly nasty way to ensure reinfection. It adds new subkeys to the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options. The subkeys are the names of common programs such as notepad.exe or zonealarm.exe. It then adds a debugger value for each file, like so:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Image File Execution Options\zonealarm.exe\Debugger = "svchost.exe"

This means that everytime you try to launch ZoneAlarm.exe, svchost.exe will be launced instead – and in this case that is a trojan executable.

 
Malware Bytes (installed and run under Safe Mode) found and cleaned it up but it was a bugger as msconfig.exe was one of the programs redirected as was Microsoft Security Essentials so you couldn't use them.
 
Edit: A bit more info here: "Image File Execution Options” will always open the named exe file as default