# Normal mode with safe mode restrictions [moved from Vista Support]



## LorenzoK (Apr 27, 2008)

Hello everyone. 
Sorry if it seems somewhat bad, my first post being one of imploring for help. Anyways, through some help from some Malware experts over at forospyware, I was able to get rid of a nasty Trojan.Virtumod which executed in memory.
Now, I can once again start in normal mode, and everything appears to be at standard speed (if not a tad faster). However, once it logs in, I don't get the normal GUI, but rather a plain screen with a command prompt, as if though I choose the option "Safe Mode with Command Prompt." It's not in terms of resolution, just of what is actually displayed.
To solve this, I tried to right-click/activate some services, but it said they were not available in safe mode (which I am not in). I also tried going into msconfig, and although it shows set to boot in normal mode, it still boots in diagnostic/restricted.
Even tried some editing with BCDEDIT.exe, but found it to provide very few information and be of little help.
Basically, I am wondering if there's some way to reverse this and go back to default.
Virus scans from Dr. Web, Malwarebytes, Kapersky online, SUPERantispyware....they all come up clean.
I'm fearful that on it's way out, the Trojan left some drivers or other system essentials scarred, and that the only solution will be a reformat or a clean installation of Windows.
I would gladly do this, except for one tiny impediment, I am at a loss when it comes to finding the Recovery CD's, so if there's any solution other than this, it'd be greatly appreciated, thanks.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Have you used Startup Repair  from AdvancedStartup Options under Repair Computer.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

I've given it a shoot, but beating my F8 key like it owes me money during start up hasn't brought the menu up.
Seems to be the best solution though, so I'll keep trying.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Hm...didn't really work (the start up repair), been reading up on the Use Last Known Good Configuration option, does anyone have any advice for that?


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

If no other option you can download the Vista recovery disk.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

I can has download recovery disk? I knew there had to be a way to, but didn't know which source to trust...

I
less than three
you


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Sorry, again, I have one last favor to ask.
Would you happen to have a link to a reputable ISO image burner (also torrent or other), which has no installing required?
Basically, with windows installer disabled, it would have to be something already installed, packaged, and for it to be a matter of extracting it and just using it.
It probably is a lot to ask for, but since I got the Trojan from a torrent site, not wholly confident with going around and searching freely again.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Use SFC SCANNOW at an elevated command prompt that will restore any corrupt system files.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Cd still downloading, the scan said there we some non-correctable corrupted files. Still messing around with it, the only true issue here is display and all the deactivated services :sigh:


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*



> I don't get the normal GUI


 You have no desktop at all and only have the command prompt window exactly as if in safe mode with command prompt?


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> You have no desktop at all and only have the command prompt window exactly as if in safe mode with command prompt?


Exactly, I have to input explorer.exe in order to interact with everything instead of inputting the commands for it (mind it's on normal mode, but still doing this).


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

You say you are in normal mode but let's see. Type ECHO %SAFEBOOT_OPTION% at the command prompt. If it displays MINIMAL you are actually in safe mode.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> You say you are in normal mode but let's see. Type ECHO %SAFEBOOT_OPTION% at the command prompt. If it displays MINIMAL you are actually in safe mode.


After inputting the aforementioned command, the command prompt came up with Network, not sure what it means though.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

You are actually booting into safe mode with networking simply because that system variable is being set to NETWORK. NETWORK means you have internet access. Type this at a command prompt and hit enter:

SET SAFEBOOT_OPTION=

This will clear that variable. Then reboot.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> You are actually booting into safe mode with networking simply because that system variable is being set to NETWORK. NETWORK means you have internet access. Type this at a command prompt and hit enter:
> 
> SET SAFEBOOT_OPTION=
> 
> This will clear that variable. Then reboot.


Is there anything to be put after the "="? 
I input the SET SAFEBOOT_OPTION= into an administrator-initiated CMD prompt, and it seems to register. 
I do the ECHO %SAFEBOOT_OPTION% option, and I get %SAFEBOOT_OPTION% as a response.
When I reboot though, I get the same old blank screen with a lonely cmd prompt open


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

You cleared it. To make sure type SET at a command prompt you will see all of the system variables and how they are set. SAFEBOOT_OPTION should be in the list set to NETWORK. Then clear it as in my previous post. Afterward, type SET again. SAFEBOOT_OPTION will no longer be listed. 

It looks like it is being set during the boot for some reason, possibly corruption somewhere. I'll try to reesearch it and get back to you.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> You cleared it. To make sure type SET at a command prompt you will see all of the system variables and how they are set. SAFEBOOT_OPTION should be in the list set to NETWORK. Then clear it as in my previous post. Afterward, type SET again. SAFEBOOT_OPTION will no longer be listed.
> 
> It looks like it is being set during the boot for some reason, possibly corruption somewhere. I'll try to reesearch it and get back to you.


All done, but yes, on boot, it once again seems to set itself. Been researching it myself, but no boot.ini = sad face


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Try this. Delete the file c:Windows\ntbtlog.txt. Then reboot into advanced boot options and select enable boot logging. Check the log file to see if any error msgs., etc. Attach the file on your next post and I'll look through it.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Do you have an option to restore from a previous backup or system restore?
I know you said you had a virus but it may be the only way and then have the virus removed by this forum. Also were you able to boot normally while you had the virus?


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> Do you have an option to restore from a previous backup or system restore?
> I know you said you had a virus but it may be the only way and then have the virus removed by this forum. Also were you able to boot normally while you had the virus?


To the previous response, I'll do the log thing next time I start up (once I finish typing this), and post the log here. 
Yes, I did have a virus (Trojan.Virtumod to be specfic) though I managed to remove it. And no, I was not able to boot in normal with the virus.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Here is the log from the boot:

Microsoft (R) Windows (R) Version 6.0 (Build 6000)
4 27 2008 20:25:40.375
Loaded driver \SystemRoot\system32\ntkrnlpa.exe
Loaded driver \SystemRoot\system32\hal.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\BOOTVID.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Loaded driver \SystemRoot\system32\drivers\acpi.sys
Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS
Loaded driver \SystemRoot\system32\drivers\msisadrv.sys
Loaded driver \SystemRoot\system32\drivers\pci.sys
Loaded driver \SystemRoot\system32\drivers\volmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\compbatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\BATTC.SYS
Loaded driver \SystemRoot\System32\drivers\mountmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\pciide.sys
Loaded driver \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
Loaded driver \SystemRoot\System32\drivers\volmgrx.sys
Loaded driver \SystemRoot\system32\DRIVERS\iaStor.sys
Loaded driver \SystemRoot\system32\drivers\atapi.sys
Loaded driver \SystemRoot\system32\drivers\ataport.SYS
Loaded driver \SystemRoot\system32\drivers\fltmgr.sys
Loaded driver \SystemRoot\system32\drivers\fileinfo.sys
Loaded driver \SystemRoot\system32\drivers\ndis.sys
Loaded driver \SystemRoot\system32\drivers\msrpc.sys
Loaded driver \SystemRoot\system32\drivers\NETIO.SYS
Loaded driver \SystemRoot\System32\Drivers\Ntfs.sys
Loaded driver \SystemRoot\System32\Drivers\ksecdd.sys
Loaded driver \SystemRoot\system32\drivers\volsnap.sys
Loaded driver \SystemRoot\system32\drivers\Combo-Fix.sys
Loaded driver \SystemRoot\System32\Drivers\spldr.sys
Loaded driver \SystemRoot\System32\drivers\partmgr.sys
Loaded driver \SystemRoot\System32\Drivers\mup.sys
Loaded driver \SystemRoot\System32\drivers\ecache.sys
Loaded driver \SystemRoot\system32\drivers\disk.sys
Loaded driver \SystemRoot\system32\drivers\CLASSPNP.SYS
Loaded driver \SystemRoot\system32\drivers\crcdisk.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunnel.sys
Loaded driver \SystemRoot\system32\DRIVERS\tunmp.sys
Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\wmiacpi.sys
Loaded driver \SystemRoot\system32\DRIVERS\intelppm.sys
Loaded driver \SystemRoot\System32\drivers\dxgkrnl.sys
Loaded driver \SystemRoot\system32\DRIVERS\nvlddmkm.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys
Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys
Loaded driver \SystemRoot\system32\DRIVERS\NETw4v32.sys
Loaded driver \SystemRoot\system32\DRIVERS\Rtlh86.sys
Loaded driver \SystemRoot\system32\DRIVERS\ohci1394.sys
Loaded driver \SystemRoot\system32\DRIVERS\sdbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\rimmptsk.sys
Loaded driver \SystemRoot\system32\DRIVERS\rimsptsk.sys
Loaded driver \SystemRoot\system32\DRIVERS\rixdptsk.sys
Loaded driver \SystemRoot\system32\DRIVERS\cpqbttn.sys
Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\System32\Drivers\TfKbMon.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\SynTP.sys
Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys
Loaded driver \SystemRoot\system32\DRIVERS\msiscsi.sys
Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys
Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys
Loaded driver \SystemRoot\system32\DRIVERS\pctfw.sys
Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\umbus.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\system32\DRIVERS\kbdhid.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\system32\drivers\RTKVHDA.sys
Loaded driver \SystemRoot\system32\DRIVERS\smserial.sys
Loaded driver \SystemRoot\system32\drivers\modem.sys
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
Loaded driver \SystemRoot\system32\drivers\rdpencdd.sys
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\System32\drivers\tcpip.sys
Loaded driver \SystemRoot\system32\DRIVERS\tdx.sys
Loaded driver \??\C:\Windows\System32\drivers\pctfw2.sys
Loaded driver \SystemRoot\system32\DRIVERS\smb.sys
Loaded driver \SystemRoot\system32\drivers\afd.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\system32\DRIVERS\pacer.sys
Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys
Loaded driver \SystemRoot\system32\DRIVERS\eabfiltr.sys
Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\System32\Drivers\usbaapl.sys
Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\system32\drivers\pctssipc.sys
Loaded driver \SystemRoot\system32\DRIVERS\USBSTOR.SYS
Loaded driver \SystemRoot\system32\drivers\pctmp.sys
Loaded driver \SystemRoot\system32\drivers\nsiproxy.sys
Loaded driver \SystemRoot\System32\Drivers\dfsc.sys
Loaded driver \SystemRoot\system32\DRIVERS\ATSwpDrv.sys
Loaded driver \SystemRoot\system32\DRIVERS\usbccgp.sys
Loaded driver \SystemRoot\System32\Drivers\usbvideo.sys
Loaded driver \SystemRoot\System32\Drivers\fastfat.SYS
Loaded driver \SystemRoot\system32\DRIVERS\monitor.sys
Loaded driver \SystemRoot\system32\DRIVERS\nwifi.sys
Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys
Loaded driver \SystemRoot\system32\DRIVERS\bowser.sys
Loaded driver \SystemRoot\System32\drivers\mpsdrv.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb10.sys
Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb20.sys
Loaded driver \SystemRoot\system32\DRIVERS\cdfs.sys
Loaded driver \??\C:\ComboFix\catchme.sys
Loaded driver \??\C:\Windows\system32\Drivers\PROCEXP90.SYS


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Those last two drivers look like they are remnants from your virus removal and are unnecessary. Go into the directory and rename them to .old so that you can rename them back later if they cause problems. Then reboot.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> Those last two drivers look like they are remnants from your virus removal and are unnecessary. Go into the directory and rename them to .old so that you can rename them back later if they cause problems. Then reboot.


Got me at a disadvantage with the second one, how do I change that one? (Catchme.sys is now .old, not sure how to do it for Procex)


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Are those two(combo fix and process explorer) programs that you can uninstall in start>control panel>programs>uninstall. If so, uninstall them and hopefully those two drivers will not try to load. Otherwise, for now just reboot with the first one renamed. How did you get combo fix in the first place?


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> Are those two(combo fix and process explorer) programs that you can uninstall in start>control panel>programs>uninstall. If so, uninstall them and hopefully those two drivers will not try to load. Otherwise, for now just reboot with the first one renamed. How did you get combo fix in the first place?




Well, I can't open the control panel (only non-service related feature I've found inaccessible so far), so uninstalling it is sort of out of the question. As for Combo Fix, it was recommended on a Virus/Malware experte forum, as I had a memory node infected with a nasty virus, and this cleared it right up.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Do you know howto find the uninstall string in the registry. If not look in program files folder for combo fix folder the uninstall program should be in there. Also give me the site I could download it and install and find the uninstall string.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> Do you know howto find the uninstall string in the registry. If not look in program files folder for combo fix folder the uninstall program should be in there. Also give me the site I could download it and install and find the uninstall string.


Should I do that? It shows as if though it has some nasty .dll's in quarantine. Not sure what happens with them after ComboFix's uninstalled, don't want to let them run a mock in the memory again.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

Did it delete the .dlls? If so, they are history anyway.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> Did it delete the .dlls? If so, they are history anyway.


.dll's were saved as .ini.vir in the Qoo folder. Deleted them


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

I think combo fix is your problem. Take a look at this:









But how do you uninstall it?


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Hm, maybe ComboFix really is it. However, it saved me from those unruly memory-lodged Trojans, so I'm grateful for that, but as for uninstalling it, no idea how to. I guess I could go look for the manual in forospyware (most likely in spanish) and see if there are any uninstalling methods there.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Apparently ComboFix is a standalone program.
Simply go to start, run, and type a ComboFix*space*/u. This should do it. Mind you I learned this is by no means a toy, and should not be executed unless instructed so by a Malware exert (which I luckily was, hehe). 
I got none, but should a dialog box come up, simply choose option 2.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Well, combofix uninstalled, and still facing the same problems.


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

I believe that a setting in combo fix is actually why you are booting into safe mode. Unfortunately, I am not familiar with combo fix and therefore cannot offer any additional help. I would advise you to request to have this thread moved to the security section where the experts there are familiar with that software.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*



frank200 said:


> I believe that a setting in combo fix is actually why you are booting into safe mode. Unfortunately, I am not familiar with combo fix and therefore cannot offer any additional help. I would advise you to request to have this thread moved to the security section where the experts there are familiar with that software.
> 
> View attachment 27229


First, I want to thank you very much for the help you've given me. The responses were fast, thorough, and overall very helpful.
Anyways, as for the suggestion, how is it I would recommend for a thread to be moves?


----------



## frank200 (Apr 2, 2008)

*Re: Normal mode with safe mode restrictions*

One last thing I thought of, maybe you've done this already. Reinstall and rerun combofix just as you did the first time in hopes that it will reset itself and allow you to boot normally.

I don't know how you get a thread moved.


----------



## LorenzoK (Apr 27, 2008)

*Normal mode with safe mode restrictions*

Hello everybody.
I already have an open thread about this on the Vista support, but I was suggested to get it moved here. As I was unsure how to do this, I'd figured it I would either post here requesting to get it moved, or just post my problem anew. 

Basically, after removing a bad Trojan (which completely disallowed me from booting in normal mode) using ComboFix, normal mode became available again. Now that I am able to boot in normal mode, I am restricted to safe boot with network (not resolution, but what is displayed). upon logging in, all I have is a CMD prompt, into which I must type in explorer.exe to do much.
Typing in SET, I am able to see a SAEBOOT_OPTION=NETWORK
Even if I input SAFEBOOT_OPTION= in to clear it, it seems to self reset upon boot up. I've tried everything, looked everywhere, and am honestly stumped at this point.
Any help would be much appreciated please.


----------



## LorenzoK (Apr 27, 2008)

*Re: Normal mode with safe mode restrictions*

Anyone? Please? 
Is it a result form leftover ComboFix setting?
This is incredibly annoying, and hard to work with


----------

