How To Scan In Safe Mode?

jeffduck
jeffduck
in Antivirus

How do I scan for viruses in Safe Mode?


When trying to do so, I get an error and the only instructions I can find here in the forum are from 2007 and are outdated and incorrect.


Thanks.

Comments

  • columbo
    columbo ✭

    Hi JeffDuck, and welcome :)


    I'm assuming that when you try to do a Safe Mode scan, you get the error of "Bitdefender VSSERV services not loading(responding)", something to that effect, which handles the on demand, and on access scanning. Even though you can get it to scan (see below) I'm not sure if that's a "phantom" scan, as vsserv is not loaded.


    Safemodescan.png


    To be sure of a scan you're looking for, you will need to run Bitdefender in Rescue Mode, and scan via that mode. Note, that it cannot be run on Windows XP PCs. The instructions can be found here: file: http://www.bdantivirus.com/bitdefender/ant...ion.rescue.html which can be also found on the main Bitdefender console/Help and Support/Bitdefender Help.


    Be sure to understand it is an a Linux language, as far as choosing the H.D. to scan, that the main drive is usually the sda1 drive.


    Let us know how it goes, or if you have any other questions :)


    Kind regards,


    Columbo

  • jeffduck
    jeffduck

    Thanks Colombo,


    Sorry for not providing the exact message while in Safe Mode. I'm trying to not reboot more than necessary and didn't write it down and still haven't rebooted into Safe Mode for the account that's infected.


    When attempting to run BD from Safe Mode, the standard interface appeared with a mask over it and stating that it's not available.


    I've tried logging in with a second Admin account which I can. From there I ran BD and selected to run in Rescue Mode. I was able to reboot and BD On-demand scanner started. After starting it first wanted to run an update but BD has disabled networking so it got an error "Update error: the server address is not correct". I'm clearing that error and selecting "Scan Now" which allows me to select a 'directory' with the button options of Cancel or Open. I'm selecting my primary drive, sda1, and Open. I get a short message saying that it's loading the AV engine then I get an error saying "Failed to load the antivirus engines" and that's it. Game over.


    I'm running Win 7 Home Premium SP1 and am trying to remove the FBI Moneypak malware. (BTW - after manual cleanup Mawarebytes and running Trend Micro's Housecall, I still have it. Both of those showed no infection.)


    Thanks again for any help to get me further.

  • Charyb
    Charyb ✭✭✭
    edited October 2012

    Rescue mode failing to load engines is something that I can't help you with. If the FBI ransomware is blocking it from running then this is a serious problem which is speculation on my part.


    When I run across something hard to remove, I usually follow the advice at bleeping computers.


    http://www.bleepingcomputer.com/virus-remo...ypak-ransomware

  • jeffduck
    jeffduck

    I now have the ransomware removed. I did it manually so the system looks clean by any scan. But BD still will not run in Rescue Mode. I get the same result.

  • columbo
    columbo ✭
    edited October 2012

    Hi JeffDuck,


    We may think all is ok (and hopefully so :) ) and that you have it totally removed, but I agree with Charyb, this could be a little more imbedded that we know. I PMd you with a couple other suggestions that are not Bitdefender orientated to see what they come up with, just to be sure, and then go from there.

  • jeffduck
    jeffduck

    Thanks to both of you for the feedback (and columbo, your PM is coming up with some results - and thanks for that input) but I'm still hoping for a solution to running BD (my purchased AV) while infected. Clearly there's something that SHOULD work but doesn't and I don't want to be spending hours manually cleaning a computer because my AV missed it in the first place.


    If the AV can't catch it the beforehand, it should at least be able to do find it afterwards. I spent many hours assuring that I got everything, but it wasn't hard to find right from the start.


    I have multiple computers but I wouldn't expect a security suite that includes parental controls to require a user to know a secret Spacebar boot sequence nor to understand Linux hardware IDs to access a mode that, then, doesn't even work.


    I know that AV is a cat-and-mouse game but after commenting that the company has a pinned response to my question that's years outdated and wrong, an employee would step up and, not only respond that they'll update the pinned topic, but also chime in on the thread about why I can't perform a Rescue Scan.


    Any word from BD?

  • coolcool1227
    coolcool1227 ✭✭✭
    edited October 2012

    Bitdefender not works in Safe Mode. I posted this issue in 2011 version and got the reply which you can read from here "Instability In Safe Mode, BD Crash".


    If you want to run Rescue Mode and you have Windows 7, then you have to press spacebar when you just power up the PC to invoke the option to go Rescue Mode without going or booting into the Windows. Also keep in mind that at present Rescue Mode don't support Wi-Fi connectivity and only a wired connection is supported. And also Windows malwares can't affect the Rescue Mode environment. For information about Rescue Mode, read this post "Rescue Mode Queries"


    If you still want to scan your system from Safe Mode, then go to the location "C:\Program Files\Bitdefender\Bitdefender 2013" and execute the file "odscanui.exe".

  • columbo
    columbo ✭
    Hi JeffDuck, and welcome :)


    I'm assuming that when you try to do a Safe Mode scan, you get the error of "Bitdefender VSSERV services not loading(responding)", something to that effect, which handles the on demand, and on access scanning. Even though you can get it to scan (see below) I'm not sure if that's a "phantom" scan, as vsserv is not loaded.


    notresponding.jpg


    Hi JeffDuck, I don’t mean to hijack your thread for a bit, but in my asking these questions may help to both of us to know and understand if the safe mode vsserv.exe error scan is an acceptable option as seen in my 1st post


    So Christian, or maybe ONT can answer this, if Bitdefender uses the vsserv.exe process to do the scanning http://forum.bitdefender.com/index.php?s=&...st&p=126552 when BD is in normal Windows user mode, and odscanvi.exe is hardly using any resources, 1-2% of CPU resources.....


    Ondemandscanresources.jpg


    then when the warning comes up in safe mode that vsserv.exe is not responding, does that mean the odscanui.exe is now a scanning engine in safe mode? as it could be launched from the BD Consloe, ignoring the warning screen, from the taskbar shortcut (right click) to do a System Scan:


    Safemodescansystemscan.png


    I had previously thought to consider the other option of a odscanvi.exe scan too, but it also shows just that process scanning, which in the above option (when opening the Bitdefender console), warned of vsserv.exe not running, and thus not being able to do a scan?


    odscanui.jpg


    What is the difference between the Manual Scan (above image) by accessing the odscanui.exe file, and the System Scan loaded and run from the console taskskbar shortcut ? As both options are loading the same "scanner".


    Or does the Rescue Mode scanner load the vrsser.exe scanning engine, and thus is a true scan?


    Thanks for any insight you can give me :)

  • coolcool1227
    coolcool1227 ✭✭✭

    There are different scanning processes/tasks e.g On-Access/RTP Scanning, On-Demand/Custom/Manual/Contextual Scanning that may be handled by the vesserv.exe and it also perform many more other functions e.g as Christian stated in this post Bdis 2013- Downloder.exe & Vsserv.exe. Since vsserv.exe is doing a lot of functions other than scanning, so the launching of Bitdefender fails in Safe Mode is the expected outcome but also keep in mind that there are chances that the drivers that are required to run the Bitdefender services/processes including vsserv.exe are not loaded so vsserv.exe is not responding and there what we see in the Bitdefender in Safe Mode. But I appreciate if someone from the Technical support may shed some more light on the vsserv.exe process.


    @What is the difference between the Manual Scan (above image) by accessing the odscanui.exe file, and the System Scan loaded and run from the console taskskbar shortcut ? As both options are loading the same "scanner".


    I think odscanui.exe is used in all scan tasks, but used with different parameters which are set according to scan task e.g odscanui.exe \xyz etc where xyz are set according to the scan task type.


    And about the usage of the vsserv.exe in Rescue Mode, I have no idea yet. And if you have any questions about Rescue Mode, you can post them here Rescue Mode Queries.

  • rootkit
    rootkit ✭✭✭

    Hello :)


    The easiest way to scan in Safe Mode is to run this file:


    C:\Program Files\Bitdefender\Bitdefender 2013\odscanui.exe


    Remember one thing: Bitdefender can not be updated in Safe Mode because vsserv (the main process) is not running.


    Should you need further information, please do not hesitate to reply to this message.


    Take care.

  • columbo
    columbo ✭

    Omer, I just wanted to thank you for the time and effort you put into this reply, it's been on my mind for awhile. Sorry not to have acknowledged it sooner...thanks :)http://forum.bitdefender.com/index.php?s=&...st&p=163075

  • Georgia
    Georgia ✭✭✭

    Thank you all for your input on this topic. Indeed, all the security solutions are completely disabled in Safe Mode.


    @ JeffDuck : Sorry to hear about that. Can you tell me if the Rescue Mode issue still persists on your systems?

All Time Leaders

Categories

Defenders of the month