Using autoit to reboot into safe mode & run file

[seriouswrong]

Ok guys any help on this would be greatly appericated....

I know this might be off the beaten path. But I am using SC VNCUltra remote support client and when I am working on a customers machine sometimes i need to reboot into safemode to remove spyware & viruses.

This is a 2 part question.

How do you get windows to reboot into safe mode using Autoit?

Is there a way to get windows to run my support client upon reboot into safe mode? (lets call it support.exe) - If possible a quick way to remove support client from auto starting anymore when I am done with rebooting the customers machine.

You can find out mode about SC at www.ultravnc.com - my website has the auto SC web installer, www.pcexpertcare.com (this is to confirm my reasons are legit.)

Thanks!

Edited December 19, 2005 by seriouswrong

[CyberSlug]

I can think of answer for each one that might work but both are *risky*:

1) To automatically reboot in safe mode, you would need to modify the boot.ini file so that the default boot entry contains the /safeboot switch. Then just call Shutdown(1) with AutoIt.

2) Since safe mode disables all startup/autorun programs by design, you would need to do something like changing the default shell from explorer.exe to an autoit script that launchs explorer and VNC. Make sure the script changes the shell back to explorer before it exits!

Some references

http://www.winguides.com/registry/display.php/849/

http://www.sysinternals.com/Information/bootini.html

EDIT: Let me try this in Virtual PC.... I'll let you know how it goes....

Edited December 19, 2005 by CyberSlug

[MrSpacely]

in boot.ini here just example add /safeboot:minimal or /safeboot:network for safe mode with network support

example boot.ini

[boot loader]

timeout=30

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

multi(0)disk(0)rdisk(0)partition(1)\Windows="Microsoft Windows XP Professional" /fastdetect /safeboot:minimal

ofcourse remove the /safeboot option to go to normal mode after reboot

hmm almost same response but if the system logs in automaticly the startup folder in menu start does still work

Edited December 19, 2005 by MrSpacely

[CyberSlug]

None of this works on Windows 98, but it seemed to work in Virtual PC.

One other issues besides the boot.ini and shell registry key is whether a username and password is required to logon. Autologon can be enabled with: http://www.sysinternals.com/Utilities/Autologon.html

Of course if the computer's network ability is killed with spyware, you might need to run winsock fix or the command "netsh winsock reset catalog" first.

[MrSpacely]

None of this works on Windows 98, but it seemed to work in Virtual PC.

One other issues besides the boot.ini and shell registry key is whether a username and password is required to logon. Autologon can be enabled with: http://www.sysinternals.com/Utilities/Autologon.html

Of course if the computer's network ability is killed with spyware, you might need to run winsock fix or the command "netsh winsock reset catalog" first.

windows 98 was released in 1997 no one uses it

and with windows 98 you can change the msdos.sys to not load windows then add

win.com /D:M

or

win.com /D:N

for safe mode with networking

to the autoexec.bat

but thats besides the point who uses 98 today

that autologon thing by the registry is a really good point to autologin and have some special account for safe mode and add the fix program to that users startup folder

[seriouswrong]

Can't exe's be set as services that run before login?

Is there anyway to have a exe run as a service without special software?

Edited December 19, 2005 by seriouswrong

[PerryRaptor]

This is the reality of Windows Security; Miscrosoft attempting to secure networked computers to save us Admins from having to work so hard.

I've run into this SafeModeNetworking a number of times and have found that adding another entry to the Boot.ini for this mode works best for my situation. Once the computer checks in, I can remotely connect to it launching my bandaid script.

[MrSpacely]

Can't exe's be set as services that run before login?

Is there anyway to have a exe run as a service without special software?

I have no idea if all services run in the save mode, but...

http://www.pirmasoft.com/runassvc.php

a freeware programs wich can make any exe run as a service and also incredibly easy to use.

[seriouswrong]

Thanks for the tips so far guys...

So it seems I could use msconfig under Windows XP to set it to boot into safe mode with networking, perhaps automade it using AutoIt

Now I need to find a way to launch the client still under safe mode.

Perry:

Just curious, do you do this manually or automated?

This is the reality of Windows Security; Miscrosoft attempting to secure networked computers to save us Admins from having to work so hard.

I've run into this SafeModeNetworking a number of times and have found that adding another entry to the Boot.ini for this mode works best for my situation. Once the computer checks in, I can remotely connect to it launching my bandaid script.

Edited December 20, 2005 by seriouswrong

[DaveF]

Cyberslug's idea of using your script as the shell is a better plan than setting it up as a service; Windows services (except for TS) can either interact with the Desktop or access network resources, but not both. Any AutoIt script has a hidden window and thus would need to interact with the desktop (as would any child apps) so the service would need to be run as interactive and thus wouldn't be able to access the network. A random discussion about this can be found here.

A possible third option: if HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System holds the path to an EXE it will be run at the same time that the login GINA appears. I don't know what restrictions or network connectivity an app has if it's run this way, I've just seen it done before...

AutoLogon + script-as-shell is probably the best option because you can change the shell only for the logging-on user; if something goes wrong you can log off, hold SHIFT to insure you get a login prompt and then log in as another user...

[MrSpacely]

Actually autoit just needs to scan for some spyware

It would only need rights to the registry and filesystem.

as for using msconfig

So it seems I could use msconfig under Windows XP to set it to boot into safe mode with networking, perhaps automade it using AutoIt

don't just change the boot.ini much easier then controlling msconfig

for network just add /safeboot:network to the end of the last line (where fastdetect often resides)

[Gigglestick]

You could use something like this to modify boot.ini safely (maintaining multiple boot lines):

$bootini = EnvGet("SystemDrive") & "\boot.ini"
$defaultboot = IniRead($bootini, "boot loader", "default", "")
If $defaultboot <> "" Then
    $attr = FileGetAttrib($bootini)
    If StringInStr($attr, "R") Then FileSetAttrib($bootini, "-R")
    
    $bootline = IniRead($bootini, "operating systems", $defaultboot, "")
    If $bootline <> "" Then
        $ok = IniRenameSection($bootini, "operating systems", _
            "operating systems backup", 0)
        If $ok Then
            IniWrite($bootini, "operating systems", $bootline[1][0], $bootline[1][1] & _
                " /safeboot:network")
        Else
            MsgBox(16, "BOOT.INI Error", "There was a problem renaming a section of " & _
                $bootini & @LF & "or the main section has already been backed up.")
        EndIf
    EndIf
Else
    MsgBox(16, "BOOT.INI Error", "There was a problem reading " & $bootini)
EndIf

And this to restore the original configuration:

$bootini = EnvGet("SystemDrive") & "\boot.ini"
IniRenameSection($bootini, "operating systems backup", "operating systems", 1)

*EDIT* Fixed long lines for readability.

Edited December 20, 2005 by c0deWorm

[MrSpacely]

You could use something like this to modify boot.ini safely (maintaining multiple boot lines):

$bootini = EnvGet("SystemDrive") & "\boot.ini"
$defaultboot = IniRead($bootini, "boot loader", "default", "")
If $defaultboot <> "" Then
    $attr = FileGetAttrib($bootini)
    If StringInStr($attr, "R") Then FileSetAttrib($bootini, "-R")
    
    $bootline = IniRead($bootini, "operating systems", $defaultboot, "")
    If $bootline <> "" Then
        $ok = IniRenameSection($bootini, "operating systems", "operating systems backup", 0)
        If $ok Then
            IniWrite($bootini, "operating systems", $bootline[1][0], $bootline[1][1] & " /safeboot:network")
        Else
            MsgBox(16, "BOOT.INI Error", "There was a problem renaming a section of " & $bootini & @LF & "or the main section has already been backed up.")
        EndIf
    EndIf
Else
    MsgBox(16, "BOOT.INI Error", "There was a problem reading " & $bootini)
EndIf

And this to restore the original configuration:

$bootini = EnvGet("SystemDrive") & "\boot.ini"
IniRenameSection($bootini, "operating systems backup", "operating systems", 1)

good plan;) if something went wrong it would not even boot

good thinking

Hmm also good use of iniwrite I forgot about that just thought of filewrite

iniwrite is much better

Edited December 20, 2005 by MrSpacely

[BigDod]

I know that this is probably a bit late but it may be worth looking Here