SAFE MODE

[cgoldman]

I would be very pleased to hear with Malwarebytes scanner operates in safe mode in respect of both Vista and WinXP operating systems please.

[nosirrah]

MBAM works from safemore but it is not designed to work that way .

MBAM will work better from regular mode both in terms of what it detects and what it can remove .

Doing a safemode scan with MBAM should only be done when a regular mode scan fails .

[WilliamP]

My son ,not knowing any better ran a scan in Safe Mode and told me it found 2 Root Kits. In normal scan it finds nothing. Is that normal?

[RubbeR DuckY]

Can you post a log from the safe mode scan. Thank you.

[WilliamP]

I will find out. He lives in a different state.

[WilliamP.Jr]

Can you post a log from the safe mode scan. Thank you.

When I ran a scan in safe mode it found 2 rootkits and removed them. I ran it again in safe mode it found 1 and removed it.

Malwarebytes located the root kits in the system32 area.

In safe mode my computer does not save a log file in Malwarebytes.

I see the other logs from when I ran in out of safe mode. But not when run in safe mode.

It seems only when I am not in safe mode does it save a log file.

P.S. This is a XP with the sp3 update installed.

[RubbeR DuckY]

You can save the log file yourself by clicking Save Log.

[WilliamP.Jr]

You can save the log file yourself by clicking Save Log.

Ok Thanks, I'll run it again tonight and post what i find tomorrow.

Thanks Again,

[WilliamP.Jr]

You can save the log file yourself by clicking Save Log.

I ran Malwarebytes in safe mode again and it now finds nothing else.

Thanks for your help.

Malwarebytes' Anti-Malware 1.20

Database version: 947

Windows 5.1.2600 Service Pack 3

8:55:18 AM 7/31/2008

mbam-log-7-31-2008 (08-55-18).txt

Scan type: Full Scan (C:\|)

Objects scanned: 76644

Time elapsed: 52 minute(s), 49 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\lvuvc.hs (Rootkit.Agent) -> Quarantined and deleted successfully.