Running an antispyware software in safe mode will usually fix a spyware infection
because most malware do not auto start while in safe mode. Thus, you can safely
remove them before they start again automatically. However, many of the newer
spyware programs have found a way to combat this method of removal. They actually
prohibit you from opening in safe mode at all.
If you cannot enter in regular safe mode because of a computer infection, you should
first try to start the computer with the “safe mode with command prompt” option. This
will start Windows only with core drivers and then launch the command prompt.
You will then have to run an antispyware with the command prompt. Here are brief
instructions on how to do so:
1. First, use an uninfected computer to download MalwareBytes’s Anti-Malware. Then,
you will need to download the Malwarebytes’s Anti-Malware Malware definitions. You
can use different antispyware software as well but this one has been effective. Put both
of these downloaded files onto a removable disc.
2. Open Windows and, using the F8 key, boot in Safe Mode with Command Prompt.
3. You will receive a command prompt. Type in “explorer.exe” and then press Enter.
Windows Explorer will open. Then, use the “My Computer” area to find your removable
disc with the antispyware tools you downloaded.
4. You will need to install both files. Then, launch the Malwarebytes’s Anti-Malware.
Choose “Perform Full Scan” from the tab labeled Scanner. After the scan is finished,
click on the option “Show results.” Make sure that all of the spyware software is check
marked and click on the “Remove Selected” option. You may be prompted to restart
your computer in order to finish the spyware removal.
5. Restart your computer in normal mode. Then, scan again using Malwarebytes’s
Anti-Malware.
Can’t Get into “Safe Mode with Command Prompt”
Some particularly heinous spyware software won’t even let users get into safe mode
with command prompt. This happens when spyware deletes registry contents for the
key HKLMSystemCurrentControlSetControlSafeboot. If this is the case, you have
several options:
1. Use an anti-virus rescue disk to restore your computer.
2. You can use a program from Didier Stevens which is designed to defeat this sort of
spyware by recreating a “undeletable safeboot key.”
3. From sUBs, you can get a program to repair the Safe Mode
key: SafeBootKeyRepair.exe
4. ElPiedra makes a registry file which can be used for repairing safe mode. You can
find it here: SafeBootKeyRepair.
5. The antispyware program SuperAntiSpyware Free edition gives users an option that
allows them to restore a SafeBoot key. To do this, just open the antispyware program
and click on the Preferences tab. Then, click on Repairs and you will see an option for
“Repair Broken SafeBoot key.”
6. Depending on the type of PC you have, you may already have a restore CD which
can be used to recover the key.
7. The last couple of options are for users who are more advanced with combating
spyware. You may need to install the Recovery Console or try to Repair Install
Windows XP, Vista or Windows 7.
Alternative articles:
Malware prevents me from booting, even in Safe Mode. What do I do? – Ask Leo!
