Malware Scanning in Safe Mode - Yes or No?

G

Guest

In response to a question I posted in the XP MCE group (I meant to post in XP
General; darn CDO web interface) about whether one could run the normal video
driver in Safe Mode in order to see the Ad-Aware 2007 interface (which
requires 1040x768), one poster replied:

I would recommend against scanning in safe mode unless absolutely necessary.
My own testing indicated that spyware scanners will actually find fewer
items in safe mode due to some not loading.

Because that's contrary to most of the recommendations I've seen here (to
scan for malware in safe mode), I'd be interested in any comments on this
issue.
 
M

Malke

Curious said:
In response to a question I posted in the XP MCE group (I meant to post in XP
General; darn CDO web interface) about whether one could run the normal video
driver in Safe Mode in order to see the Ad-Aware 2007 interface (which
requires 1040x768), one poster replied:

I would recommend against scanning in safe mode unless absolutely necessary.
My own testing indicated that spyware scanners will actually find fewer
items in safe mode due to some not loading.

Because that's contrary to most of the recommendations I've seen here (to
scan for malware in safe mode), I'd be interested in any comments on this
issue.

I would have to say that the person who said that was completely wrong.
As for scanning with Ad-aware, you can do it in Safe Mode. Just ignore
the warning and continue on.

My malware removal recommendations (which are based on many years of
doing this work professionally):

http://www.elephantboycomputers.com/page2.html#Removing_Malware


Malke
 
R

R. McCarty

Even in Safe Mode, the infectors are still present on the drive. All the
Security scanners use some form of definition files to detect/remove
them. So if the program is updated, then Safe mode will work much
better for removing the contaminated files.

It's possible to modify Safe Mode so that additional drivers that
aren't by default loaded can be added. However doing that isn't easy
and not advisable.

Trust me it's no fun trying to load/run removal tools with pop-ups,
browser hijack pages and the like taking over the computer. Just a
day or so I did a Remote Session on a PC with 256 Megabytes of
physical RAM and the actually memory usage was over 460 Megs.
Even a click to start an Explorer was extremely slow to respond.
 
G

Guest

Malke said:
I would have to say that the person who said that was completely wrong.
As for scanning with Ad-aware, you can do it in Safe Mode. Just ignore
the warning and continue on.

My malware removal recommendations (which are based on many years of
doing this work professionally):

http://www.elephantboycomputers.com/page2.html#Removing_Malware


Malke
--
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic!"
MS-MVP Windows - Shell/User

Thanks, Malke. Your reply, and that of R. McCarty, is pretty much what I
thought.

As for Ad-Aware 2007, it's not a matter of ignoring the warning that
"1024x768 is recommended" but that I can't seem to re-size the A-A window.
In 640x480 some of the tabs and buttons needed to run the app are just barely
visible on the edge of the window. Moreover, the A-A window doesn't have any
scroll bars, either horiz or vert. It seems that the size of the window is
hard-coded in A-A, and unless the screen is at 1024x768, the contents don't
fit. AFAIK, there is no way to load a "normal" video driver in safe mode --
or am I wrong?
 
M

Malke

Curious said:
As for Ad-Aware 2007, it's not a matter of ignoring the warning that
"1024x768 is recommended" but that I can't seem to re-size the A-A window.
In 640x480 some of the tabs and buttons needed to run the app are just barely
visible on the edge of the window. Moreover, the A-A window doesn't have any
scroll bars, either horiz or vert. It seems that the size of the window is
hard-coded in A-A, and unless the screen is at 1024x768, the contents don't
fit. AFAIK, there is no way to load a "normal" video driver in safe mode --
or am I wrong?

No, you're not wrong. If Ad-aware 2007 doesn't work for you, there are
other good ones. Or clean things up using other tools and then go into
regular mode to run Ad-aware.


Malke
 
P

Patrick Keenan

Curious George said:
In response to a question I posted in the XP MCE group (I meant to post in
XP
General; darn CDO web interface) about whether one could run the normal
video
driver in Safe Mode in order to see the Ad-Aware 2007 interface (which
requires 1040x768), one poster replied:

I would recommend against scanning in safe mode unless absolutely
necessary.
My own testing indicated that spyware scanners will actually find fewer
items in safe mode due to some not loading.

Because that's contrary to most of the recommendations I've seen here (to
scan for malware in safe mode), I'd be interested in any comments on this
issue.

That message basically means that the app uses dialogs that were created for
that screen resolution, have a fixed size, and aren't resizable - no scroll
bars. If they're too big for the screen resolution, you can't get to the
parts offscreen. Otherwise, the app should work as normal.

HTH
-pk
 
J

Jim Byrd

Hi George - You might want to try running after doing a "Clean Boot" which
should allow you to use the higher resolution. From my Blog, Defending Your
Machine, addy below in my Signature:


#########IMPORTANT#########
Show hidden files and run all of the following removal tools from Safe mode
or preferably a "Clean Boot" when possible (which will let you use the
Windows Installer, access the Internet safely, etc., while still avoiding
interfering programs or malware), logged on as an Administrator. BEFORE
running these tools, be sure to clear all Temp files and your Temporary
Internet Files (TIF) (including offline content.) Reboot and test if the
malware is fixed after using each tool.
HOW TO Enable Hidden Files
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339
How to boot to Safe mode
http://spyware-free.us/tutorials/safemode/ and
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

Clean Boot - General Win2k/XP procedure, but see below for links for other
OS's (The procedure does differ by OS, so be sure to check for yours. The
following is for Win2k w/msconfig - you can obtain msconfig for Win2k here:
http://www.3feetunder.com/files/win2K_msconfig_setup.exe ):

1. StartRun enter msconfig.
2. On the General tab, click Selective Startup, and then clear the 'Process
System.ini File', 'Process Win.ini File', and 'Load Startup Items' check
boxes. Leave the 'boot.ini' boxes however they are currently set.
3. In the Services tab, check the "Hide All Microsoft Services" checkbox,
and then click the "Disable All" button. If you use a third party firewall
then re-check (enable) it. For example, if you use Zone Alarm, re-check the
True Vector Internet Monitor service (and you may also want to re-check
(enable) the zlclient on the Startup tab.) Equivalent services exist for
other third party firewalls. An alternative to this for XP users is to
enable at this time the XP native firewall (Internet Connection Firewall -
ICF). Be sure to turn it back off when you re-enable your non-MS services
and Startup tab programs and restore your normal msconfig configuration
after cleaning your machine.
4. Click OK and then reboot.

For additional information about how to clean boot your operating system,
click the following article links to view the articles in the Microsoft
Knowledge Base:
310353 How to Perform a Clean Boot in Windows XP,
http://support.microsoft.com/kb/310353
281770 How to Perform Clean-Boot Troubleshooting for Windows 2000
http://support.microsoft.com/kb/281770/EN-US/ (Procedure not using msconfig)
267288 How to Perform a Clean Boot in Windows Millennium Edition
http://support.microsoft.com/kb/267288/EN-US/
192926 How to Perform Clean-Boot Troubleshooting for Windows 98
http://support.microsoft.com/kb/192926/EN-US/
243039 How to Perform a Clean Boot in Windows 95
http://support.microsoft.com/kb/243039/EN-US/

(BTW, it's not pertinent to the 'Clean Boot' operation, but FYI you can add
a very useful 'Tools' tab to msconfig if you wish. See here:
http://support.microsoft.com/?kbid=906569)
#########IMPORTANT#########



--
Regards, Jim Byrd,
My Blog, Defending Your Machine,
http://defendingyourmachine2.blogspot.com/



In Curious George <[email protected]> typed:
|| "Malke" wrote:
||
||| Curious George wrote:
|||| In response to a question I posted in the XP MCE group (I meant to
|||| post in XP General; darn CDO web interface) about whether one
|||| could run the normal video driver in Safe Mode in order to see the
|||| Ad-Aware 2007 interface (which requires 1040x768), one poster
|||| replied:
||||
|||| I would recommend against scanning in safe mode unless absolutely
|||| necessary. My own testing indicated that spyware scanners will
|||| actually find fewer items in safe mode due to some not loading.
||||
|||| Because that's contrary to most of the recommendations I've seen
|||| here (to scan for malware in safe mode), I'd be interested in any
|||| comments on this issue.
|||
||| I would have to say that the person who said that was completely
||| wrong. As for scanning with Ad-aware, you can do it in Safe Mode.
||| Just ignore the warning and continue on.
|||
||| My malware removal recommendations (which are based on many years of
||| doing this work professionally):
|||
||| http://www.elephantboycomputers.com/page2.html#Removing_Malware
|||
|||
||| Malke
||| --
||| Elephant Boy Computers
||| www.elephantboycomputers.com
||| "Don't Panic!"
||| MS-MVP Windows - Shell/User
|||
||
|| Thanks, Malke. Your reply, and that of R. McCarty, is pretty much
|| what I thought.
||
|| As for Ad-Aware 2007, it's not a matter of ignoring the warning that
|| "1024x768 is recommended" but that I can't seem to re-size the A-A
|| window. In 640x480 some of the tabs and buttons needed to run the
|| app are just barely visible on the edge of the window. Moreover,
|| the A-A window doesn't have any scroll bars, either horiz or vert.
|| It seems that the size of the window is hard-coded in A-A, and
|| unless the screen is at 1024x768, the contents don't fit. AFAIK,
|| there is no way to load a "normal" video driver in safe mode -- or
|| am I wrong?
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top