PDA

View Full Version : get out of "safe mode"



seraphodiabolus
04-17-2007, 01:22 PM
My laptop was heavily infected, so i tried to clean it up with a few softwares at hand. There were two programs that refused to be removed, so I switched to the safe mode (by running "msconfig", not by pressing F8) and re-ran the anti-spyware programs. One resistant program as of now is still in the system, and worse yet, i can NOT switch back to the normal mode. I guess I need to uncheck something in msconfig, but under my safe mode, the "run" function does not seem to be supported. Is there any way I can run the msconfig without the use of "Run" ??????????? :confused:

Paul Komski
04-17-2007, 02:08 PM
You should be able to find it and open it from:
C:\WINDOWS\PCHEALTH\HELPCTR\Binaries\msconfig.exe

But you should also be able to get into SafeMode Proper by using F8 during startup. Msconfig is nothing to do with SafeMode.

If you cant find msconfig.exe or otherwise run it try sfc /scannow from a command prompt and have your installation CD at hand.

PrntRhd
04-22-2007, 12:06 AM
I was just reading about this problem in another forum, there is malware http://www.f-secure.com/v-descs/agent_aum.shtml and some other Vundo malware that will erase the entire contents of the registry key for Safe mode. You may get into a position where when a user will force safe mode via msconfig and have no choices when the boot fails.
You may be able to repair via Recovery Console to create a new RCboot.ini
http://support.microsoft.com/kb/330184

If no OS disk, you may download a RCboot.ini from here:
http://www.atribune.org/downloads/rc.iso

BartPE may also help in getting a boot going again.

As Budfred has said before, IT IS CRITICAL that you diagnose the infection before starting to remove the malware.

Paul Komski
04-22-2007, 07:06 AM
Interesting links and useful to know about - but I had taken it that the problem here was getting the system to boot into normal mode - probably because the safeboot option had been checked in msconfig.

Msconfig just alters boot.ini so the other fix would be to remove the /safeboot:minimal text in boot.ini.