commandline scan in Safe Mode?

[Guest]

Hi all -

In an attempt to remove a spyware infection, I downloaded Windows Defender
and, while it got rid of part of the infection some was left behind and
couldn't be removed because the .dlls were in use. I attempted to start a
scan from Safe Mode-Command Prompt but was unable to get the scan to run
using "MpCmdRun.exe Scan". The GUI wouldn't work either because critical
services weren't running and wouldn't start in Safe Mode. Am I missing
something?

I hope that this functionality (commandline scanning from Safe Mode) hasn't
been removed as it's oftentimes the only way to eliminate the infection.

Thanks in advance...

 

[Bill Sanderson MVP]

I have done GUI scanning in safe mode, but not command line. I'll see if I
can test this, and also re-test gui-mode scanning, since others have had
problems with this.

 

[Bill Sanderson MVP]

OK - tests in progress. I cheated and used VPC's. In XP Home SP2, I was
able to run a scan in safe mode with gui, and after restarting in safe mode
command prompt only, I did mpcmdrun -scan and that also worked--when I
restarted with a gui, the time of last scan was consistent with that run.

So--I got no error messages about services not started. I did log in as
"administrator" on my XP Home install.

I am also testing this on Windows 2000, but found that I still have
Microsoft Antispyware on the Windows 2000 VPC. It scanned just fine in safe
mode, however.


--

 

[Guest]

Bill -

the infected system was Win2K and (because MS AntiSpyware is no longer
available) I had to download WindowsDefender. I think that may be the
combination that causes the problem.

Let me know how your tests come out.

 

[Bill Sanderson MVP]

I'm installing Windows Defender in the VPC now. My recollection is that
this works, but I've also seen a spyware-infected machine in which it did
not work in safe mode. I think I'm inclined to blame the spyware. I've
since cleaned that machine so I could retest it.

In dire straits, Microsoft Antispyware is available from www.filehippo.com


--

 

[Guest]

Great info...I'd wondered if the spyware weren't the culprit but, in Safe
Mode - Command Prompt it hadn't loaded yet...

thanks Bill.

 

[Bill Sanderson MVP]

OK - so far no go, on Windows 2000. The Defender service won't stay
started, and apparently fails to succeed at starting WMI, which won't start
directly.



--

 

[Stuart]

In dire straits, Microsoft Antispyware is available from www.filehippo.com
I just looked for it and didn't find it...Where? Is it still there?
Stuart//

 

[Dave M]

yes
http://www.filehippo.com/download_microsoft_antispyware/?561