Comments on: Playing with Safe Mode http://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/ (blog 'DidierStevens) Thu, 29 Jul 2010 03:37:46 +0000 hourly 1 http://wordpress.com/ By: ddd http://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/#comment-2538 ddd Sun, 15 Apr 2007 10:50:56 +0000 http://didierstevens.wordpress.com/2007/03/26/playing-with-safe-mode/#comment-2538 mmmmmm mmmmmm

]]> By: keydet89 http://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/#comment-1960 keydet89 Tue, 03 Apr 2007 11:49:59 +0000 http://didierstevens.wordpress.com/2007/03/26/playing-with-safe-mode/#comment-1960 Didier, Great post! I've been working on something for parsing Registry keys (and other stuff) and your post reminded me of something important. Also, keep in mind that the contents of the Run and RunOnce keys are parsed but not launched during SafeMode boot, unless the entry in the RunOnce key has a "*" at the beginning. I mention this because (a) its in a KB article, and (b) I've actually seen it used, in the wild! Thanks, Harlan author of "Windows Forensic Analysis" Didier,

Great post! I’ve been working on something for parsing Registry keys (and other stuff) and your post reminded me of something important.

Also, keep in mind that the contents of the Run and RunOnce keys are parsed but not launched during SafeMode boot, unless the entry in the RunOnce key has a “*” at the beginning. I mention this because (a) its in a KB article, and (b) I’ve actually seen it used, in the wild!

Thanks,

Harlan
author of “Windows Forensic Analysis”

]]> By: Liquidmatrix Security Digest » SafeBoot And Safe Mode http://blog.didierstevens.com/2007/03/26/playing-with-safe-mode/#comment-1202 Liquidmatrix Security Digest » SafeBoot And Safe Mode Mon, 26 Mar 2007 22:09:29 +0000 http://didierstevens.wordpress.com/2007/03/26/playing-with-safe-mode/#comment-1202 [...] Article Link [...] [...] Article Link [...]

]]>