Safe Mode Problem

[jkores]

Here's the problem.
A computer that I am repairing has a malware on it. I didn't want to run my utilities through normal windows, so I did the following.

Opened MSConfig, checked "Boot in Safe Mode"

Turns out, that the malware forces the Computer to Reboot when trying to boot into safe mode. I have attempted to make it boot from normal windows again, but can't seem to get it to work, even when i bring up the boot menu or advanced boot options.

Any suggestions?

 

[dbdawn]

My first guess with the information you provided, is that the malware deleted or modified the registry key which allows Windows to boot into safe mode.

HKLM\System\CurrentControlSet\Control\Safeboot

If you use a live cd you can mount the remote registry hive and take a look at those keys.

 

[jkores]

I am using Hirens For my live CD running on Mini Windows.
Where could i find this?

 

[dbdawn]

I am using Hirens For my live CD running on Mini Windows.
Where could i find this?

I am not familiar with Hirens but I did a quick Google search and it looks like Hirens has this program that should work, Registry Editor PE.

 

[gikstar]

You will need to fix that Safemode problem but after the spyware is removed you may find additional items to fix... in the meantime, I suggest that you remove the hard drive and attach it to your tech bench computer and run your cleaning programs from there.

 

[kevinjhaag]

You will need to fix that Safemode problem but after the spyware is removed you may find additional items to fix... in the meantime, I suggest that you remove the hard drive and attach it to your tech bench computer and run your cleaning programs from there.

I agree with gikstar. Connect the drive to your tech bench computer and clean it as much as you can from there. I would use a combination of D7 and Antivirus. You'd be surprised it may fix the the safemode problem too. Good Luck!

 

[Mr.Mike]

You will need to fix that Safemode problem but after the spyware is removed you may find additional items to fix... in the meantime, I suggest that you remove the hard drive and attach it to your tech bench computer and run your cleaning programs from there.

+1 for benching the HDD. You may also want to try TDSSKiller.

 

[OldSchoolPC]

Instead of Hirens, you can use UBCD4WIN. I use that for almost everything.

 

[phaZed]

Good suggestions from the others...

Not telling you how to do things, just interested, but why didn't you F8 into safe mode? That would avoid this issue.

 

[dbdawn]

Good suggestions from the others...

Not telling you how to do things, just interested, but why didn't you F8 into safe mode? That would avoid this issue.

Not saying this is the case here, but I have come across instances where the malware disables booting via safe mode.