Help!? Virus controlling PC even in Safe Mode

I have a virus that runs even in safe mode.  I have scanned with AVG livecd and removed infected files including winlogon.exe and atapi.sys.  I replaced thosed files with copies from an uninfected computer.  After rebooting, antivirus caught another virus infecting the winlogon.exe file.  I stopped the system restore service and set it to disabled and rebooted and the system is in an endless loop of restarting even when attempting to boot into safe mode.

Who is Participating?
Sudeep SharmaTechnical DesignerCommented:
You could check the Registry of your system and see if there is any entry apart from "Userinit.exe" in "HKEY_USERS \ MyXPHive \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon" section.

Below is tutorial on how to do it.

How to edit the registry offline using BartPE boot CD ?

I hope that would help.

You might think about removing the infected drive, slaving it to another system and performing new scans.
wellnecessitiesAuthor Commented:
Thanks David.  I am currently in that process now.  One thing I didn't mention earlier is that this virus or one of the viruses seemed to infect when the drive was accessed - ala Autorun.ini.  

I am slaving it to a ubuntu system now to back up important files.  Hopefully I can determine the virus name so as to get removal instructions.  I have several other pcs on a network that are most likely infected.

I would scan that drive with Malwarebytes:
Malwarebytes: CCleaner:

When you connect the drive or anything you plan to scan make sure you hold down shift to prevent autorun. It may be getting passed around by usb.

Last resort removal tool:
wellnecessitiesAuthor Commented:
Thanks BC.  I have never heard of the "shift" option for stopping autorun, but that is very handy to know.  I have run nearly everything I can on this machine to remove viruses including, but not limited to bitdefender livecd, avg livecd, prevx 3.0, malware bytes, spybot s&d.

The BIG problem now is that it is stuck rebooting on a loop, i.e. I press power -> POST sequence -> Windows begins to start -> blue background like desktop is loading -> black screen -> back to POST.  

I have settled on re-installing, but knowing how to disable system restore before Windows boot, i.e. using a livecd to access those settings, would be infinitely helpful.  This particular virus reminds me of the downadup virus a while back with the difference that this virus embeds itself in such a way that it loads even in safe mode.  

Any idea about the virus identity?  I still have other potentially infected PCs that I would much rather clean than reinstall all of them as it would entail tracking down original installation media and reinstalling all drivers, applications, etc.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.