Removing MalwareUsing Windows Safe Mode

 
Here's an article that describes
how to get into Windows Safe Mode:

Windows XP Safe Mode Explained

As the article explains, getting
into safe mode is a two-step
process:

1. Start Windows (boot it up)
2. Hold down the f-8 key

Why Safe mode? Why would you want
to boot up in safe mode to remove
viruses and spyware?

In some cases, you can prevent malware
from running by booting up into safe
mode. If you can do this, you stop
the malware from running and thus taking
steps to protect itself.

Malware is famous for protecting itself.
Try to remove it and it will try to protect
itself from removal. Of course, the malware
has to be running in order for it to
practice self-protection.

You might say that Windows Safe Mode
is the middle path. It is the middle path
between two extremes.

Running your copy of Windows in Windows
Normal Mode is one end of the extreme.
This is the mode that will almost surely
allow your malware problem to be running
concurrently to you running something that
is trying to remove your malware problem.
If this happens, you will likely have two
pieces of software doing battle.

One piece of software is the evil piece
of software, the malware that has infected
your computer. The other piece of software
is the good software, the malware removal
tool that is trying to fix your computer.
Both do battle with each other if both
are allowed to run at the same time.

Sometimes the battle is over before it
begins. Try to visit a website that has
a malware removal tool on it and you
are prevented from visiting that website
by the offending malware itself. I call
this phenonema malware redirection.

With maleware redirection any attempts
to visit a website that will help you to
remove malware are redirected to another
website. Often this redirection is to
a site that runs advertising of some kind.

I don't have enough experience to know
whether or not running your computer in
safe mode will solve this problem for you.
However, I'd at least give safe mode a try
if I had this problem.

Here's my hierarchy of good, better and
best when it comes to removing malware:

1. It is good to try to remove malware
   while running your copy of Windows in
   mormal mode. This often does some good,
   especially if your computer is not too
   badly infected. This has worked for me
   for years as of this writing.
2. Better yet is to run Windows in
   Safe Mode as this may knock
   out some malware temporarily. Of course,
   I can't guarantee this. However, it
   is worth a try.
3. For profound malware infections,
   it is best to run Windows off of a
   separate boot disk. For example, a
   copy of Windows on a CD or a DVD.

Of the three ways to run malware removal
tools, the bootable disk option
is the best in terms of effectiveness.
While I've not tried this mywelf, because
I've never had to, I can see that doing
this has a great advantage:

The advantage of a boot disk is that your
infected copy of Windows becomes a passive
entity that is asleep and totally dormant.
In other words, the infected copy of Windows
has no way to defend itself against malware
disinfection.

Here's a post that I've written that gives more
information about running Windows off of a
stand-alone disk for malware disinfection
purposes:

Michael Horowitz on Removing Spyware

Here's something to keep in mind when trying
to remove malware from your infected copy
of Windows: A good decision represents
a balance of interests.

Here's the two interets you want to consider
when trying to remove malware from your system:

1. Convenience
2. Effectiveness

Balancing these two interests might lead
me to try to remove malware in this order of
preference:

1. Try removing the malware in Safe Mode
   first using an online malware scanner.
2. If Safe Mode fails, use your credit card
   to order a bootable disk that has malware
   removal utilities on it.
3. If your problems are very minor,
   or you are very lazy about discovering Windows
   Safe Mode, then you might as well try running
   a malware removal tool in Windows Normal
   Mode first. Normal mode is better than
   nothing and hey, it might work.

Here's a broad outline of how to remove
malware in safe mode:

1. Boot up in safe mode
   by holding down the
   f-8 key on the
   top row of your keyboard.
2. Go to a website that has
   a malware removal tool that
   comes highly remcommended by
   more than one reputable source
   of information
3. Run the malware removal
   tool

It is important that you read
about your malware removal tool
first. Make sure it does malware
removal, not malware installation.

Your read this right. Some tools
that purport to remove malware
actually install it instead. Be
sure to seek out independent reviews
to make sure that your so-called
malware removal tool is not in fact
evil software masquerading as your
friend.

Ed Abbott