Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium


Help!? Virus controlling PC even in Safe Mode

Posted on 2011-04-19
Medium Priority
Last Modified: 2012-05-11
I have a virus that runs even in safe mode.  I have scanned with AVG livecd and removed infected files including winlogon.exe and atapi.sys.  I replaced thosed files with copies from an uninfected computer.  After rebooting, antivirus caught another virus infecting the winlogon.exe file.  I stopped the system restore service and set it to disabled and rebooted and the system is in an endless loop of restarting even when attempting to boot into safe mode.

Question by:wellnecessities
LVL 27

Expert Comment

ID: 35427875
You might think about removing the infected drive, slaving it to another system and performing new scans.

Author Comment

ID: 35427914
Thanks David.  I am currently in that process now.  One thing I didn't mention earlier is that this virus or one of the viruses seemed to infect when the drive was accessed - ala Autorun.ini.  

I am slaving it to a ubuntu system now to back up important files.  Hopefully I can determine the virus name so as to get removal instructions.  I have several other pcs on a network that are most likely infected.

LVL 13

Expert Comment

ID: 35428429
I would scan that drive with Malwarebytes:
Malwarebytes: http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html CCleaner: http://www.piriform.com/ccleaner

When you connect the drive or anything you plan to scan make sure you hold down shift to prevent autorun. It may be getting passed around by usb.

Last resort removal tool:
ComboFix: http://www.bleepingcomputer.com/download/anti-virus/combofix

Author Comment

ID: 35428537
Thanks BC.  I have never heard of the "shift" option for stopping autorun, but that is very handy to know.  I have run nearly everything I can on this machine to remove viruses including, but not limited to bitdefender livecd, avg livecd, prevx 3.0, malware bytes, spybot s&d.

The BIG problem now is that it is stuck rebooting on a loop, i.e. I press power -> POST sequence -> Windows begins to start -> blue background like desktop is loading -> black screen -> back to POST.  

I have settled on re-installing, but knowing how to disable system restore before Windows boot, i.e. using a livecd to access those settings, would be infinitely helpful.  This particular virus reminds me of the downadup virus a while back with the difference that this virus embeds itself in such a way that it loads even in safe mode.  

Any idea about the virus identity?  I still have other potentially infected PCs that I would much rather clean than reinstall all of them as it would entail tracking down original installation media and reinstalling all drivers, applications, etc.
LVL 30

Accepted Solution

Sudeep Sharma earned 2000 total points
ID: 35429158
You could check the Registry of your system and see if there is any entry apart from "Userinit.exe" in "HKEY_USERS \ MyXPHive \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon" section.

Below is tutorial on how to do it.

How to edit the registry offline using BartPE boot CD ?

I hope that would help.


Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
Sometimes people don't understand why download speed shows differently for Windows than Linux.Specially, this article covers and shows the solution for throughput difference for Windows than a Linux machine. For this, I arranged a test scenario.I…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an anti-spam), the admin…
Suggested Courses
Course of the Month15 days, 4 hours left to enroll

578 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question