Windows SafeMode

Windows SafeMode software is a fake application that attempts to mislead computer users with fake hard drive error. Windows Safe Mode virus will state that there are several hard disk problems particularly on boot sector. It will advise to install the licensed version of the program that will end up users paying for this unwanted application via their own online payment web site. It will display the following messages to trick its victims:

Scanning for hard drive errors…
Hard drive scan helps detect and resolve hard disk problems and system performance issues. This may take a few minutes, please wait

Windows detected a hard disk problem
Windows detected a file index error caused by boot sectors problem. Install recommended software to fix detected error.
Install Windows Safemode software (recommended)
windows Safemode is a professional software toolkit designed to detect identify and fix hard ware memory related problems on a windows based computers.

Obviously, this text will appear even on a problem-free PC its primary intention was to scare victims and make believe that system is having troubles. According to the report, only a paid version of Windows SafeMode will be able to fix those errors. Leave this program alone and begin to download a copy of legitimate anti-malware software stated below. Do a full scan of the computer and let it detect Windows SafeMode as one of the rogue applications currently infecting thousands of computers. We all know that rogue program’s intention is to spread illegally. Obviously it will not provide any positive effects towards the end user.

Screen Shot Image:

Technical Details and Additional Information:

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Vista, Windows 7

How to Remove Windows SafeMode

Restore Windows Components

If this virus enters your system, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If you have a saved restore point before Windows SafeMode virus infiltrates the computer, please restore Windows to previous settings.

Windows SafeMode Removal Tool

In order to remove the threat completely, you need to download and run Malwarebytes Anti-Malware. This is a free malware removal tool. If Trojan infection blocks the downloading of this program, get it using a clean computer. Rename the executable file before executing on the infected PC.

Use A Portable SuperAntiSpyware:
For complete removal of the virus, carry out a separate scan using different security program. This may catch infected items that evade your previous scan. Download and run SAS Portable Scanner.

Alternative Removal Method for Windows SafeMode

Option 1 : Use Windows System Restore to return Windows to previous state

If Windows SafeMode enters the computer, there is a big chance that Windows files, registry entries and other essential components are also infected. System Restore can reinstate clean system files by restoring the configuration to an earlier date. The method also replaces compromised files with a clean version. If you have a saved restore point before Windows SafeMode infiltrates the PC, we highly encourage you to execute this procedure if none of the above works. You may proceed with Windows System Restore, click here to see the full procedure.

Option 2 : Windows SafeMode manual uninstall guide

IMPORTANT! Manual removal of Windows SafeMode requires technical skills. Deleting system files and registry entries by mistake may result to total disability of Windows system. We advise you to perform a backup of registry before proceeding with this guide.

1. Kill any running process that belongs to Windows SafeMode.
- Press Ctrl+Alt+Del on your keyboard.
- When Windows Task Manager appears, look for Windows SafeMode files (refer to Technical Reference) and click End Process.

End Task

2. Delete all registry entries that belong to this malware.
- Press [Windows Key]+R on your keyboard.
- In the 'Open' dialog box, type regedit and press Enter. This will open registry editor.
- Find and delete registry entries as mentioned in Technical Reference section below.
- Close registry editor. Changes made will be save automatically.

Run Regedit

3. Scan the computer with antivirus program.
- Connect to Internet and open your antivirus software. Please update to obtain the latest database and necessary files.
- Restart the computer in Safe Mode.
- Just before Windows logo begins to load press F8 on your keyboard.
- On Windows Advanced Boot Options, select Safe Mode and press Enter.

4. Delete all files dropped by Windows SafeMode.
- While still in Safe Mode, search and delete malicious files. Please refer to 'Technical Reference'. Make sure that you execute 'End Task' first before deleting the file. Otherwise, the system will not let you perform this action.

Associated Files and Folders:Added Registry Entries:

8 Responses

  1. Gary says:

    Hi this was not helpfull as this virus does not give you access to anything to be able to run any programs
    no desktop
    start menu
    task manager etc

    please be more specific

  2. Richard says:

    Totally agree with the comments of Gary, this is not helpful at all, if we could get into the computer in anyway shape or form we could probably find the offending files and remove the malware etc.

    As it is we end up in supposed safe mode with this thing running and have no access at all to the software, starting in any safe mode or any other way results in the same screen.

    So could someone please come up with a solution which actually helps solve this problem.

  3. Tom says:

    This virus doesn’t give you access to the tools needed to remove it as it locks you out of your system. The quickest and most viable way to fix your pc is to insert your OS disc and restore to an earlier point.Now you can access your pc! (Make sure you change boot order to disk drive on bios before doing this) then install antivirus software and scan throughally. If this method doesnt work then a full system restore is the only sure way to get rid of it, you lose all docs and programms but your pc is clean and yours again! you can backup all docs by doing stage 1 first. Best of luck

  4. Jeremy says:

    We recently had this virus on a computer that came into our office. What we did was connect the hard drive to another computer using a USB adapter and run virus scans on it there. SuperAntispyware was the virus scanner that located and removed the “Windows SafeMode” virus.

    Be aware that even after running scans with different virus scanners, the user profile that had been infected will have a background wallpaper that says “Safe mode” in the corners. Also, options for changing the wallpaper are all grayed out.

    What we did was to rename that user profile and allow Windows XP to create a new one. (Be careful here if you have Vista or 7: they store settings for the user profiles in the registry. If you have Windows Vista or 7, it may be best to create a new user account and copy over any data to the new user profile.)

  5. Rune says:

    Just boot up in safe mode by pressing F8 repeatedly when the PC is starting up.
    That will give you access to you PC with full internet access so you can install whatever you want.

  6. The Guy! says:

    This is to help you guys… to get into WINDOWS.

    boot windows, log on… you will get the safemode blah..blah..blah..

    do not cancel or exit out those windows… just leave it alone…

    –This is for XP users—

    1) Press and HOLD the “Windows logo Key” by the alt and ctrl key by the space bar and then press “U”… this will bring up Utility manager…
    2) click help / goto Options tab, than internet options
    3) Under Temporary Internet files, click settings
    4) Click “View Files…” this will open up your windows explorer
    5) goto C:\WINDOWS and then run explorer.exe

    Now you can get back into your windows…

    now do your malware removing blah..blah..blah…

    –For Windows 7–

    1) same as above
    2) same as above “help” is not listed but in a small circle top right
    3) click control panel
    4) explorer should be there.. click on the drop down menu and goto c:\
    5) same as above.

  7. The Guy! says:

    Forgot… Vista is the same step as 7….

    If you guys need anything else shoot me a email

    snapcracklepop s@

    later.. and have FUN with MALWARE!

  8. kevin says:

    People know who and where these people are? And do nothing about it? Get a pair and do the right thing. Probably hiding in another country.

Leave a Reply

Your email address will not be published. Required fields are marked *