This is why it is necessary when fixing some hijacks to kill a process, reboot into safe mode, delete the offending module, and remove it from the startup list. Otherwise, every time that task gets its look-in, it will check your settings and re-hijack them. [Angoid]
Is there an easy method to identifying which processes require a safe mode boot
or is this accumulated knowledge? I had systemie.exe in mind at the time of writing, and a shortlist filed away, but if there are some key attributes to look for it would be useful.
Just for reference, I made that remark in this thread here.
It's really a matter of learning at the feet of the experts as they fix HJT logs and the like, and learning as you go along.
I'm no expert at spotting them yet, but what I've learned has come from studying HJT logs, what entries go together, and what has to be deleted manually (tools such as HJT will delete some of them itself).
Where a program is actually running on a system, Windows locks it against any form of modification. If it did not do this, there would be serious consequences if the program was suddenly changed or got deleted while executing.
Safe Mode only starts what the system actually needs in order to run, but you typically won't have access to the Internet, the CD-ROM, and other peripherals. As a much shorter startup list is used, the offending programs (viruses, trojans, etc) are also not started up.
This is why it is only possible to delete them in Safe Mode. You cannot then start up a program that does not exist!
As a much shorter startup list is used, the offending programs (viruses, trojans, etc) are also not started up.
Not always the case in some real bad pests and with PE virus'
but in general that will hold true
What is a PE virus? a virus that attaches to exe's as they are ran
thus spreading the infection
