Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Safe Mode vs. Normal Mode


  • Please log in to reply
13 replies to this topic

#1 a.h.h.10

a.h.h.10

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:58 PM

Posted 23 March 2015 - 01:50 PM

Hi.

 

I was wondering if there was any program or any way to tell what all loads in safe mode and in normal mode.



BC AdBot (Login to Remove)

 


#2 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,607 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:58 PM

Posted 23 March 2015 - 02:39 PM

Hi a.h.h.10 :)

To put it simply, in Safe Mode, nothing starts except the basic services and programs Windows requires to run, and all of these programs are by Microsoft. Which means that there's no third-party program or service that will run at all. Safe Mode is meant to be used for diagnostic purposes, with only the bare minimum started hence why it's restricted to Windows critical services and drivers (even your graphic card drivers aren't loaded in Safe Mode). As for the normal mode, you can see what programs and services are getting started via msconfig. There's one tab for the Services (you can check Hide all Microsoft services to only show third-party services) and one for the Programs. You could also use Autoruns from the Sysinternals Suite, but this is for more advanced users and not only related to services and programs, but also shell extensions and other features.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#3 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:58 PM

Posted 23 March 2015 - 03:05 PM

Hi a.h.h.10 :)

To put it simply, in Safe Mode, nothing starts except the basic services and programs Windows requires to run, and all of these programs are by Microsoft. Which means that there's no third-party program or service that will run at all. Safe Mode is meant to be used for diagnostic purposes, with only the bare minimum started hence why it's restricted to Windows critical services and drivers (even your graphic card drivers aren't loaded in Safe Mode). As for the normal mode, you can see what programs and services are getting started via msconfig. There's one tab for the Services (you can check Hide all Microsoft services to only show third-party services) and one for the Programs. You could also use Autoruns from the Sysinternals Suite, but this is for more advanced users and not only related to services and programs, but also shell extensions and other features.

 

I can try that.

 

The reason why I asked is because I still have the unresolved issues with Malwarebytes (I went to their forum and that didn't help.)

 

Something's obviously different in safe mode and normal mode where Malwarebytes runs fine in safe mode but causes a BSOD in normal mode.



#4 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,607 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:58 PM

Posted 23 March 2015 - 04:06 PM

Can you link me your thread on Malwarebytes? They are the best persons to assist you in that issue since you're using their product.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#5 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:58 PM

Posted 23 March 2015 - 05:10 PM

Can you link me your thread on Malwarebytes? They are the best persons to assist you in that issue since you're using their product.

 

https://forums.malwarebytes.org/index.php?/topic/165062-scan-problem-blue-screen/



#6 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,607 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:58 PM

Posted 23 March 2015 - 05:41 PM

AdvancedSetup replied to your thread but you never updated it, how come?

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#7 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:58 PM

Posted 23 March 2015 - 06:00 PM

AdvancedSetup replied to your thread but you never updated it, how come?

 

I had it set up to where I would get an email if someone responded, but I didn't. I didn't know until today that AdvancedSetup had responded.

 

I don't really think my hard drive is the problem. I downloaded the 1.75 version of Malwarebytes today and it ran successfully. I guess I should tell them that.



#8 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,607 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:58 PM

Posted 23 March 2015 - 06:14 PM

I suggest you to continue getting assistance in that thread on Malwarebytes and not this one. Like I said, they are the most well placed person to assist you since it's their product.

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#9 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,281 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:58 PM

Posted 23 March 2015 - 06:46 PM


Safe Mode is a troubleshooting mode designed to start Windows with minimal drivers and running processes to diagnose problems with your computer. This means some of the programs that normally start when Windows starts will not run.

Why use safe mode? The Windows operating system protects files when they are being accessed by an application or a program. Malware writers create programs that can insert itself and hide in these protected areas when the files are being used. Using safe mode reduces the number of modules requesting files to only essentials which make your computer functional. This in turn reduces the number of hiding places for malware, making it easier to find and delete the offending files when performing scans with anti-virus and anti-malware tools. In many cases, performing your scans in safe mode speeds up the scanning process. Scanning in safe mode was a recommended course of action years ago before malware writers began to employ more sophisticated techniques to counter removal efforts in that mode.

Why not use safe mode? Some security tools like anti-rootkit scanners (ARKs) and programs with anti-rootkit technology use special drivers which are required for the scanning and removal process. These tools are designed to work in normal mode because the drivers will not load in safe mode which lessens the scan's effectiveness. Other security tools are optimized to run from normal mode where they are most effective. For example, scanning with Malwarebytes Anti-Malware in safe or normal mode will work but removal functions are not as powerful in safe mode. Malwarebytes is designed to be at full power when malware is running so safe mode is not necessary when using it. In fact, Malwarebytes loses some effectiveness for detection and removal when used in safe mode because the program includes a special driver which does not work in safe mode. For optimal removal, normal mode is recommended so it does not limit the abilities of such tools.

Further, scanning in safe mode prevents some types of malware from running so it may be missed during the detection process. If the malware is not related to a running process (i.e. malicious .dll) it probably will not make a difference performing a scan in normal or safe mode. A hidden piece of malware such as a rootkit which protects other malicious files and registry keys from deletion may not be detected in either mode without the use of special tools. Additionally, if the scanner you're using does not include definitions for the malware, then they may not detect or remove it regardless of what mode is used. If you're dealing with zero-day malware it's unlikely the anti-virus is going to detect anything. Also keep in mind that there are various types of malware infections which target the safeboot keyset so booting into safe mode is not always possible.

Generally I recommend performing a scan in normal mode unless that mode does not work or the tool is specifically intended for use in safe mode.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,281 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:58 PM

Posted 23 March 2015 - 06:47 PM

I downloaded the 1.75 version of Malwarebytes today and it ran successfully. I guess I should tell them that.

Yes you should.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 a.h.h.10

a.h.h.10
  • Topic Starter

  • Members
  • 113 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:58 PM

Posted 24 March 2015 - 03:01 PM

I wanted to let everyone know that I dowloaded the new 2.1.4 that has the new design and it successfully runs in normal mode!



#12 Aura

Aura

    Bleepin' Special Ops


  • Malware Response Team
  • 19,607 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:07:58 PM

Posted 24 March 2015 - 03:03 PM

Well that's good to know a.h.h.10 :) You can consider this issue as solved now!

unite_blue.png
Security Administrator | Sysnative Windows Update Senior Analyst | Malware Hunter | @SecurityAura
My timezone UTC-05:00 (East. Coast). If I didn't reply to you within 48 hours, please send me a PM.


#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,281 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:07:58 PM

Posted 24 March 2015 - 04:13 PM

Over the years and various version releases...there have only been a handful of reports where Malwarebytes would not run properly, not including anything malware related.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 arena leo

arena leo

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:05:28 AM

Posted 03 April 2015 - 06:48 AM

Its good that your problem is resolved now. It even help me out to understand safe mode and normal mode






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users