Comments on: Restoring Safe Mode with a .REG file http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/ (blog 'DidierStevens) Wed, 17 Mar 2010 18:58:11 +0000 http://wordpress.com/ hourly 1 By: Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37842 Didier Stevens Tue, 16 Mar 2010 07:37:33 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37842 @Duo Reinstalling is the best thing you can do. If you're not familiar doing a clean install, I recommend you buy an identical drive to the one in your machine. Swap it out and do the install on the new drive. If your install fails, or you're missing important files, license keys, software, account credentials, ... ; you can always go back to the original drive. And once you've installed your machines according to your requirements, make a clone of the new disk to the old disk. This way, you've a backup, ready to use when your machines gets infected. @Duo Reinstalling is the best thing you can do. If you’re not familiar doing a clean install, I recommend you buy an identical drive to the one in your machine. Swap it out and do the install on the new drive. If your install fails, or you’re missing important files, license keys, software, account credentials, … ; you can always go back to the original drive.
And once you’ve installed your machines according to your requirements, make a clone of the new disk to the old disk. This way, you’ve a backup, ready to use when your machines gets infected.

]]> By: Duo http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37839 Duo Mon, 15 Mar 2010 19:52:05 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37839 I guess i don't have much option now but to reinstall the system. After the reinstallation, what good antivirus/antimalware can you recommend ? I don't want to rely much on Mcafee now since I was infected with a virus while Mcafee is installed on my system. I guess i don’t have much option now but to reinstall the system. After the reinstallation, what good antivirus/antimalware can you recommend ? I don’t want to rely much on Mcafee now since I was infected with a virus while Mcafee is installed on my system.

]]> By: Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37832 Didier Stevens Sun, 14 Mar 2010 21:21:00 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37832 @Duo Your machine must be infected with malware that disables all types of programs to run. I recommend you go to a malware cleaning forum and get help there. I've a blogpost that explains how to use the F-Secure Rescue CD to clean your machine, but I believe you're better consult malware cleaning experts on a forum. @Duo Your machine must be infected with malware that disables all types of programs to run. I recommend you go to a malware cleaning forum and get help there. I’ve a blogpost that explains how to use the F-Secure Rescue CD to clean your machine, but I believe you’re better consult malware cleaning experts on a forum.

]]> By: Duo http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37826 Duo Sat, 13 Mar 2010 04:39:27 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37826 Hi. I downloaded the undeletable safeboot key. Copied it to the crippled PC. Hola ! The application can not be run. The system looks for the program to run the application. Too bad. What should I do next ? Thanks. Hi. I downloaded the undeletable safeboot key. Copied it to the crippled PC. Hola ! The application can not be run. The system looks for the program to run the application. Too bad. What should I do next ?
Thanks.

]]> By: Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37823 Didier Stevens Fri, 12 Mar 2010 08:07:51 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37823 @Duo It could be that the malware is actively monitoring the registry and deleting the Safeboot key as soon as you create it. I've another program to help with this, look for The Undeletable Safeboot key on my blog. @Duo It could be that the malware is actively monitoring the registry and deleting the Safeboot key as soon as you create it. I’ve another program to help with this, look for The Undeletable Safeboot key on my blog.

]]> By: Duo http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37817 Duo Thu, 11 Mar 2010 09:41:06 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37817 While I was desperately looking for a way for repairing my windows xp, I stumbled here into your website. I am not really a computer expert, so I tried doing the above instruction hoping that it will fix my problem. I have the same problem as the others: windows can boot, can not run IE, any .exe file like antivirus because it is looking for a program to run the file. When I try to run in safe mode so as to run the antivirus, the safe mode option can not be seen on the option. So I tried your instruction, but it didn't work. Kindly check if I did something wrong along the way. Here's what I have done : 1. Downloaded the safeboot.zip 2. Copied it into the crippled laptop. 3. Then double clicked on the safeboot - windows xp sp2 Then the system says that it has completed. 4. Restarted the crippled laptop, hit F8, i have been to the window where you have to choose normal or safe mode. but to my dismay i can not find the safe mode option. Where i have gone wrong ? Thank you for your reply. As long as I can, I don't want reinstall my system. Thank you in advance for the help. While I was desperately looking for a way for repairing my windows xp, I stumbled here into your website. I am not really a computer expert, so I tried doing the above instruction hoping that it will fix my problem. I have the same problem as the others: windows can boot, can not run IE, any .exe file like antivirus because it is looking for a program to run the file. When I try to run in safe mode so as to run the antivirus, the safe mode option can not be seen on the option. So I tried your instruction, but it didn’t work. Kindly check if I did something wrong along the way.

Here’s what I have done :
1. Downloaded the safeboot.zip
2. Copied it into the crippled laptop.
3. Then double clicked on the safeboot – windows xp sp2
Then the system says that it has completed.

4. Restarted the crippled laptop, hit F8, i have been to the window where you have to choose normal or safe mode. but to my dismay i can not find the safe mode option.

Where i have gone wrong ?

Thank you for your reply. As long as I can, I don’t want reinstall my system. Thank you in advance for the help.

]]> By: Swift http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37786 Swift Sat, 06 Mar 2010 21:53:38 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37786 This .reg really worked! When I couldn't boot into Safe Mode, the first thoughts in my mind were the days it would take to rebuild my XP install. At first I thought it had something to do with SPTD.SYS, because the Safe Mode crashed and rebooted just after SPTD.SYS, but I decided to look into the SafeBoot registry key as advised by Stevens. And, just like he said, the SafeBoot key was missing. But, I can't use System Restore (that function has not worked for me every time I need it to), however, so the .reg file was perfect! Thank you, Didier. This .reg really worked! When I couldn’t boot into Safe Mode, the first thoughts in my mind were the days it would take to rebuild my XP install. At first I thought it had something to do with SPTD.SYS, because the Safe Mode crashed and rebooted just after SPTD.SYS, but I decided to look into the SafeBoot registry key as advised by Stevens. And, just like he said, the SafeBoot key was missing. But, I can’t use System Restore (that function has not worked for me every time I need it to), however, so the .reg file was perfect! Thank you, Didier.

]]> By: Windows XP Stop 0×0000007B Error Booting into Safe Mode | Computer Tips - Tech Info and Internet Security, Windows, Linux, Mac and other Tech Info from Avery J. Parker http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37658 Windows XP Stop 0×0000007B Error Booting into Safe Mode | Computer Tips - Tech Info and Internet Security, Windows, Linux, Mac and other Tech Info from Avery J. Parker Mon, 08 Feb 2010 04:20:56 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37658 [...] Didier Stevens has spent a lot of time on this and has developed a registry patch file. There are patches for Xp sp2 and sp3 as well as 2003 server and Windows 2000 SP4 in his download zip. [...] [...] Didier Stevens has spent a lot of time on this and has developed a registry patch file. There are patches for Xp sp2 and sp3 as well as 2003 server and Windows 2000 SP4 in his download zip. [...]

]]> By: Didier Stevens http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37583 Didier Stevens Tue, 02 Feb 2010 10:00:01 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37583 @The Grog: yes, this means your Safe Boot problems are not caused by deleted SafeBoot registry keys, but by something else. Like a bad driver. @The Grog: yes, this means your Safe Boot problems are not caused by deleted SafeBoot registry keys, but by something else. Like a bad driver.

]]> By: The Grog http://blog.didierstevens.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37579 The Grog Tue, 02 Feb 2010 04:41:12 +0000 http://didierstevens.wordpress.com/2007/02/19/restoring-safe-mode-with-a-reg-file/#comment-37579 Hi Didier, Thanks for the quick response. I downloaded in Firefox and double-clicked on the one ending in .exe A black box came up in like 1 second that said SYSTEM\CurrentControlSet\Control\Safeboot exists I guess I have tu use a recovery disk? Hi Didier,

Thanks for the quick response. I downloaded in Firefox and double-clicked on the one ending in .exe A black box came up in like 1 second that said
SYSTEM\CurrentControlSet\Control\Safeboot exists

I guess I have tu use a recovery disk?

]]>