How To Remove Malware In Safe Mode

There are some versions of malware that will crash your computer or prevent you from downloading or running programs to fix it. You might be faced with the "Blue Screen Of Death" and be unable to load and run Windows again. The good news is that in most cases you can boot into Safe Mode. Safe Mode is where Windows loads a minimum of drivers and startup programs. This is before most malicious programs are loaded, and sometimes hide or stop removal efforts. You can then use different tools and procedures to remove the infections.

The general steps are to delete restore points, temporary files, and anything in the Recycle Bin.  After cleaning, different removal apps are used to actually remove the infections.  After that, another cleanup, along with a registry repair, and the computer should be good to go.

Things you should have on hand:
Windows installation disk. Malware will sometimes change windows system files. In case they need to be replaced, you'll need this disk.

Administrators Password if you need one to log on as administrator. Write it down and have it handy.

Remove Malware Toolkit that you've put together or had made.

Turn off System Restore.  No need to keep restore points that have been infected with malware.
   XP - Start/Control Panel/System/System Restore  If empty, put
   a check mark in the box for Turn Off System Restore.  Click OK.
   Vista-Windows 7 - Start - right click My Computer-
   select Properties-select System Protection
   click on drive and click Configure button
   select Turn off system protection-click apply-click OK

Print this page. If you don't, then you'll have to come here after each reboot to continue following the procedures.

Boot into safe mode. If you run Windows XP, This is where the BootSafe program comes in handy.  Otherwise, user the F8 method.
Safe Mode - Minimal is OK if you don't need internet connection to update the virus definitions in the tools.
or
Safe Mode - Networking if you need to get on the internet to update, etc.

Start and run the applications in this order:

CCleaner
The object here is to remove temp files that might be malware infected.
From the Windows tab, leave default items checked and click the
Run Cleaner button
From the Applications tab, leave default items checked and click the
Run Cleaner button.

Dr Web CureIt!
This program is updated hourly in many cases, so make sure you have a recent download.  Run it, then reboot to safe mode - networking.

SuperAntiVirus Personal
Check for and download updates if necessary.
Do a full scan. Any infections should be found. Remove them and reboot to safe mode - networking.

MalwareBytes Anti-Malware
1 Check for and download updates if necessary.
2. Select “Perform quick Scan” and click Scan.
3. At the end of the MalwareBytes scan, quarantine anything that it finds.
4. Reboot to safe mode - networking.

CCleaner
Again, the object is to remove malware infected temp files.

Glary Utilities
In the main window (Modules) click Registry Cleaner
In next window click on Scan registry for problems
When it finishes scanning, click repair
Click Close - exit out of Registry Cleaner

Reboot to normal mode.

Turn on System Restore.  Control Panel/System/System Restore uncheck the box for Turn Off System Restore.  Click OK.

The steps shown on this page should take care of most problems that users will encounter.  If your computer is now free of the symtoms that indicated malware and virus infections, then you need to make sure its protected from future attacks.  My Protect Your PC page will give some suggestions for protecting it.

If your computer still shows signs of infection, there's still hope.  It's time to add a few tools to the toolkit and get serious. 

Next Page - If You're Not Able To Remove Malware In Safe Mode