Trojan won't allow boot into safe mode

[Tyrenta]

Hi all -- i've managed to cause more throuble than I solved --
attempting to repair a friends PC that was LOADED with virus/trojans,
but it would not let me boot into safe mode (it *would* boot normally
however, but when trying safe mode it blue screens and recycles).
Trouble is I thought I could get around it by setting /safemode in
msconfig -- bad idea as now I can't boot normally and safe mode has
the same issues, so I'm in an endless boot to safe/blue screen loop --
does anyone have any suggestions?? Thanks

 

[Patrick Keenan]

Hi all -- i've managed to cause more throuble than I solved --
attempting to repair a friends PC that was LOADED with virus/trojans,
but it would not let me boot into safe mode (it *would* boot normally
however, but when trying safe mode it blue screens and recycles).
Trouble is I thought I could get around it by setting /safemode in
msconfig -- bad idea as now I can't boot normally and safe mode has
the same issues, so I'm in an endless boot to safe/blue screen loop --
does anyone have any suggestions?? Thanks

Take the drive out, and attach it to another XP system that has up-to-date
virus protection. Scan the drive there, with the installed AV and with the
TrendMicro housecall online scanner (housecall.trendmicro.com). Because
the drive hasn't been booted, none of the trojans will be active and you
should have complete access to removing them.

Clear out all the temp folders and browser caches, as these are the usual
places for malware to enter. While it's attached, turn off System Restore
on that drive as the restore points are likely infected.

Also, delete the swapfile and hibernation files (if that was on) in the
root; these will be rebuilt, and this can sometimes help with this kind of
problem.

Empty the recycle bin.

You can clear these folders prior to the A/V scan, as this will reduce the
scanning time.

Finally you can edit the boot.ini and remove the /safeboot switch.

You may wish to defragment the drive while it's in the other system, as
well.

Then, you can put the drive back in and try to restart the system. Also,
try booting to Last Known Good if needed. You may get "file not found"
error messages at first - this would be a good sign that you removed the
infections, and just have to find the references that launch them.

Once you're in, run HijackThis to see if there's anything else to do.

HTH
-pk

 

[Tyrenta]

took me a few days to locate an enclosure for the drive (was a laptop
drive), but that did it -- back in operation. Thanks much for all the
assistance....