Comments on: Update: Restoring Safe Mode with a .REG file, and a Live CD

By: The Undeletable SafeBoot Key « Didier Stevens

The Undeletable SafeBoot Key « Didier Stevens — Fri, 01 Jan 2010 12:54:08 +0000

[...] to restore the keys by deleting them as soon as they are restored. Untill now, I recommended to use a Live CD to restore the keys in such a case (this is a complex procedure). This way, the malware is not running while you restore [...]

By: Roger

Roger — Thu, 31 Dec 2009 03:07:20 +0000

I stumbled upon your site just now and I must thank God for creating you. You are a Saint. Your willingness to help for free is a blessing for all of us, Thank you. Beside the safe mode error, my other problem is the system restore, which I turned off in order to delete the virus as instructed from a blog. After reboot, I can’t turn it back on. Any solution to this? Thanks in advance.

By: Didier Stevens

Didier Stevens — Fri, 25 Sep 2009 11:40:17 +0000

>It looks like it’s missing some .sys-files.
Can you provide more details. What .sys files are missing? And why do you link it with the SafeBoot keys?

By: Ed

Ed — Wed, 23 Sep 2009 20:59:59 +0000

Hello Didier,

Thank you for the many blogs you made about safeboot-problems with malwares.

But, what if Safeboot is not infected but dumpes every time, like i have.

It looks like it’s missing some .sys-files.
I didn’t know which one. But did you know as
an IT-specialist which files SAFEBOOT needs ?
And a way to repair it ?

Tnx.
[Sorry for my poor english]

By: restoring machines after malware infection have removed the safeboot option « shellprompt’s blog

Fri, 12 Dec 2008 09:11:34 +0000

[...] restoring machines after malware infection have removed the safeboot option By unixlabs Update: Restoring Safe Mode with a .REG file, and a Live CD « Didier Stevens [...]

By: Didier Stevens

Didier Stevens — Wed, 03 Dec 2008 15:22:48 +0000

You mean using Registry Restore Wizard from the UBCD4WIN Live CD?

That’s an option. But I was asked to show how to merge my reg file using a Live CD.

And yes, there is malware that deletes restore points.

By: dxg

dxg — Wed, 03 Dec 2008 13:50:05 +0000

How about restoring the registry from the boot cd?
Or is the malware known to nuke restore points also..