Comments on: Save Safeboot?

By: Didier Stevens

Didier Stevens — Thu, 04 Feb 2010 23:38:14 +0000

@Roger Legaspi: What’s your OS version? And is this machine a domain member or stand-alone? Check also if it’s not a keyboard setting: type your password in the username field and check it.

By: Roger Legaspi

Roger Legaspi — Thu, 04 Feb 2010 23:04:35 +0000

Just did the merging of .reg, and booted on Safe Mode…But I cannot log in due to wrong password or wrong user name. What’s the problem ?? I am sure that my user name and password is correct…help!!!

By: Roy Firestein » Links

Roy Firestein » Links — Thu, 28 Jan 2010 09:20:31 +0000

[...] Stevens has posted about restoring SafeMode with a .reg file, adding a bit more to his info about a virus that deletes the SafeBoot key, tricks to restore SafeBoot, and protecting the SafeBoot key from being deleted. While not an [...]

By: Didier Stevens

Didier Stevens — Sun, 24 Jan 2010 19:58:21 +0000

Try with the F-Secure Rescue CD http://blog.didierstevens.com/2008/08/21/removing-malware-with-a-live-cd/

By: Stef

Stef — Sun, 24 Jan 2010 19:04:46 +0000

Hi…
My computr is in a terrible soup! It got infected wid sm nasty virus recently which all of a sudden disabled taskmgr, cnt access the registry, gpedit n doesn’t allow me 2 run ANY application .exe file. Each time givs error:”The operatn has been cancelld due to restriction in effect on this computr. Plz contact ur sys. admin.” Im workin in the admin only…n most importantly SAFE MODE IS DISABLED :’( on scanning wid NOD32 all viruses gt cleand except Win32 sality virus. tried all possibl advices by dwnloadin RRT, n many more n run ‘em…but dey all wnt run(.exe won’t)n hence cudn’t enable safemode. Any HELP wud be deeply appreciated!
P.S. im usin XP2. Surprisingly, in my GUEST account, taskmgr n registry cn be opend n i cn run .exe files…but cn’t edit registry ‘coz of permission restriction by admin. iM ‘tryin’ 2 solve this issue without formatting/reinstallin XP.

By: The Undeletable SafeBoot Key « Didier Stevens

The Undeletable SafeBoot Key « Didier Stevens — Fri, 01 Jan 2010 12:54:01 +0000

[...] malware deletes the SafeBoot registry key to prevent you from booting into Safe Mode. I provide a registry fix to restore these [...]

By: Update: Restoring Safe Mode with a .REG file, and a Live CD « Didier Stevens

Wed, 26 Nov 2008 19:39:51 +0000

[...] Live CD Filed under: Malware, Update — Didier Stevens @ 19:39 As more malware seems to delete the SafeBoot keys nowadays, and even prevents you from restoring these keys, I’m posting this “Enhanced [...]

By: Didier Stevens

Didier Stevens — Tue, 16 Sep 2008 11:06:39 +0000

That’s an excellent idea Alfonso, thanks for sharing!

By: Alfonso

Alfonso — Tue, 09 Sep 2008 22:27:45 +0000

Just one more thing…

I realized that some malware / virus is not allowing me anymore to add HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot .

As soon as I add it, it’s deleted.

So I found a workaround for this. I searched and replaced your reg file from SafeBoot to SafeMood, then I started the PC from a disk using UBCD4WIN and renamed the registry entry. And now I’m in safe mode and I can try to run antivirus and antimalware software.

Thank you for your help!

By: Alfonso

Alfonso — Tue, 02 Sep 2008 22:14:58 +0000

Hi Didier.

Thank you for your great work.

I think my friend’s PC got this virus (and many many more). I tried to run your .reg and reboot, but safemode is still not available.

I’m sure you have better things to do in your life, but it would be cool to team up with this software to allow offline update:

http://home.eunet.no/~pnordahl/ntpasswd/

I tried to run the .reg and immediately shut down windows (power off), and still I cannot run in safe mode.

Thank you,

alfonso