Don't Force Safe Mode on Infected PC

[Anonymous Bob]

One of the standard instructions when trying to clean an infected computer
has been to use safe mode to do the repairs.

More and more of today's new malware deletes or alters the safeboot key in
the registry rendering the user unable to reboot into safe mode. The
important notice here is that you do not want to use the System
Configuration Utility (msconfig) method to force safe mode when a user
reports problems booting into safe mode as it could bring about disasterous
results!

http://www.dslreports.com/forum/remark,18150258

Bob Vanderveen

 

[Melvin \(math\) Klassen]

One of the standard instructions when trying to clean an infected computer

has been to use safe mode to do the repairs.

Please read the following excerpts from:

http://www.microsoft.com/technet/community/columns/secmgmt/sm0504.mspx



Cleaning a Compromised System

.... it got hacked.
What to do?
Well, let's see:

* You can't clean a compromised system by patching it.

* You can't clean a compromised system by removing the back doors.

* You can't clean a compromised system by using some "vulnerability
remover".

* You can't clean a compromised system by using a virus scanner.

* You can't clean a compromised system by reinstalling the operating system
over the existing installation.

* You can't trust any data copied from a compromised system.

* You can't trust the event logs on a compromised system.

* You may not be able to trust your latest backup.

* The only way to clean a compromised system is to flatten and rebuild.
That's right.
If you have a system that has been completely compromised,
the only thing you can do is to flatten the system
(reformat the system disk) and rebuild it from scratch
(reinstall Windows and your applications).
Alternatively, you could of course work on your resume instead ...

The above article was written by:

Jesper M. Johansson, Ph.D., CISSP, MCSE, MCP+I
Security Program Manager
Microsoft Corporation

 

[Dave M]

Good quote... are you accepting applications?