When computer faced a major virus infestation, it might be necessary to boot computer into safe mode and perform some actions there. What is the difference between normal boot and Safe Mode? Only basic drivers and services are loaded when booting into safe mode, thus not allowing viruses to start themselves. Most of the viruses will not operate in Safe Mode, so you could try curing it. It is not a surprise that some viruses disable safe mode as soon as they take control of computer.
How can be Safe Mode disabled? In most cases viruses simply delete registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot. When you try booting into safe mode on the machine that has this key deleted, you will receive the following BSOD:
Solution:
In this case you will need to find computer with the same version of OS and Service Pack, get these settings from there and then import them into problematic computer. To export settings from working computer, you will need to do the following:
- Open regedit
- Navigate your way to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot and export its contents into a file
This will create a reg file that we will transfer to the machine without SafeBoot.
Alternatively, you could use registry files created on our test machines, but some settings are machine-specific, so these files are provided "as is".
WinXP_SafeBoot.reg (26,81 kb)
Win7_SafeBoot.reg (36,04 kb)
Now when when these reg files are on the computer that needs Safe Mode restored, merge them with the registry. You can do that either by double-clicking or by right-clicking on the reg file and selecting Merge option from the dropdown menu.
SafeBoot should work from now on if the problem was in deleted key.