Comments on: Save Safeboot? http://blog.didierstevens.com/2006/06/22/save-safeboot/ (blog 'DidierStevens) Fri, 21 Nov 2008 02:33:28 +0000 http://wordpress.org/?v=MU hourly 1 By: Didier Stevens http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-33467 Didier Stevens Tue, 16 Sep 2008 11:06:39 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-33467 That's an excellent idea Alfonso, thanks for sharing! That’s an excellent idea Alfonso, thanks for sharing!

]]> By: Alfonso http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-33441 Alfonso Tue, 09 Sep 2008 22:27:45 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-33441 Just one more thing... I realized that some malware / virus is not allowing me anymore to add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot . As soon as I add it, it's deleted. So I found a workaround for this. I searched and replaced your reg file from SafeBoot to SafeMood, then I started the PC from a disk using UBCD4WIN and renamed the registry entry. And now I'm in safe mode and I can try to run antivirus and antimalware software. Thank you for your help! Just one more thing…

I realized that some malware / virus is not allowing me anymore to add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot .

As soon as I add it, it’s deleted.

So I found a workaround for this. I searched and replaced your reg file from SafeBoot to SafeMood, then I started the PC from a disk using UBCD4WIN and renamed the registry entry. And now I’m in safe mode and I can try to run antivirus and antimalware software.

Thank you for your help!

]]> By: Alfonso http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-33420 Alfonso Tue, 02 Sep 2008 22:14:58 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-33420 Hi Didier. Thank you for your great work. I think my friend's PC got this virus (and many many more). I tried to run your .reg and reboot, but safemode is still not available. I'm sure you have better things to do in your life, but it would be cool to team up with this software to allow offline update: http://home.eunet.no/~pnordahl/ntpasswd/ I tried to run the .reg and immediately shut down windows (power off), and still I cannot run in safe mode. Thank you, alfonso Hi Didier.

Thank you for your great work.

I think my friend’s PC got this virus (and many many more). I tried to run your .reg and reboot, but safemode is still not available.

I’m sure you have better things to do in your life, but it would be cool to team up with this software to allow offline update:

http://home.eunet.no/~pnordahl/ntpasswd/

I tried to run the .reg and immediately shut down windows (power off), and still I cannot run in safe mode.

Thank you,

alfonso

]]> By: Spyware Remove Guide » Blog Archive » Removing Spyware http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-10090 Spyware Remove Guide » Blog Archive » Removing Spyware Mon, 25 Jun 2007 10:40:41 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-10090 [...] includes pictures: How to fully de-gunk a PC of CrapwareJune 22, 2006: According to Didier Stevens, some malware can disable Safe Mode. Ugh. February 9, 2007: Didier Stevens released a .REG file that can be used to restore Safe Mode. [...] [...] includes pictures: How to fully de-gunk a PC of CrapwareJune 22, 2006: According to Didier Stevens, some malware can disable Safe Mode. Ugh. February 9, 2007: Didier Stevens released a .REG file that can be used to restore Safe Mode. [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-704 Didier Stevens Wed, 07 Mar 2007 17:52:41 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-704 The best thing you can do is post your problem on a high-volume malware removal forum, like http://forums.spywareinfo.com/ The best thing you can do is post your problem on a high-volume
malware removal forum, like http://forums.spywareinfo.com/

]]> By: Nam Tran http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-694 Nam Tran Wed, 07 Mar 2007 04:46:51 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-694 I have a Trojan-Spy.Win32@mx virus. This virus has constantly been changing my home page and keeps suggesting that I buy a Malware Wiped program, what should I do? I have a Trojan-Spy.Win32@mx virus. This virus has constantly been changing my home page and keeps suggesting that I buy a Malware Wiped program, what should I do?

]]> By: Andrew http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-252 Andrew Mon, 13 Nov 2006 09:48:46 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-252 I recently got a anti-virus program on my computer, i forget the name of it but, after installing it, it frezzes all the time on me. I only just found out that amlware is a bad thing and i havnt a clue what to do, could you help me. thanks, regards Andrew I recently got a anti-virus program on my computer, i forget the name of it but, after installing it, it frezzes all the time on me. I only just found out that amlware is a bad thing and i havnt a clue what to do, could you help me. thanks,

regards Andrew

]]> By: Kindel http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-213 Kindel Sat, 04 Nov 2006 21:25:10 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-213 I have a weird problem.. I have the Look2Me Virus (guard.tmp) and my computer refuses to go into safe mode.. so I assume that my safeboot has been deleted. I tried system restore but it will only allow me to restore to points I've made today and will not allow me to go back any further. Do you have any suggestions? Thanks! I have a weird problem.. I have the Look2Me Virus (guard.tmp) and my computer refuses to go into safe mode.. so I assume that my safeboot has been deleted. I tried system restore but it will only allow me to restore to points I’ve made today and will not allow me to go back any further. Do you have any suggestions?
Thanks!

]]> By: Didier Stevens » Cleaning up after an infection, and then? http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-34 Didier Stevens » Cleaning up after an infection, and then? Sat, 12 Aug 2006 15:22:59 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-34 [...] Take the W32/Bagle.fb virus. It deletes the SafeBoot key, only a couple of assembly lines are needed to wipe your Safe Mode configuration: [...] [...] Take the W32/Bagle.fb virus. It deletes the SafeBoot key, only a couple of assembly lines are needed to wipe your Safe Mode configuration: [...]

]]> By: Didier Stevens » Blog Archive » Restoring Safeboot http://blog.didierstevens.com/2006/06/22/save-safeboot/#comment-3 Didier Stevens » Blog Archive » Restoring Safeboot Mon, 26 Jun 2006 20:02:42 +0000 https://didierstevens.wordpress.com/2006/06/22/save-safeboot/#comment-3 [...]   « Save Safeboot? [...] [...]   « Save Safeboot? [...]

]]>