How to Use VNC in Safe Mode

I recently had a problem with a computer located over 300 miles away, it had a nasty malware infection and I didn’t fancy a 6 hour drive. Very often, it’s easier to blow-away a computer and reinstall the operating system rather than spending days scanning and cleaning trojans, viruses and spyware, but sometimes that’s not the easy option.

I started to think about the possibility of cleaning the machine remotely, but I’d need control over the computer whilst it was in safe mode.… well it would have to be safe mode with networking, at least. I often use VNC for remote control (its open source), but as far as I knew I couldn’t get it to run in safe mode with networking….or could I?

This is a guide to using VNC in safe mode (safe mode with networking). Tested with ultraVNC (www.uvnc.com) on Windows, haven’t tested with realVNC: -

1.    Get ultraVNC installed on the target computer. Make sure that you are able to access it; it needs to be installed as a service. You can talk someone through this over the phone. Yes, you may need port forwarding configured at the target site; but if it’s part of a WAN you won’t necessarily have to do this. VNC uses port 5900. Check VNC is working properly.

2.    Download Bootsafe; This is a utility that will allow you to restart the machine in Safe Mode , and Safe Mode with Networking (which is what you need to use). Remember if you restart the computer you won’t be able to hit F8 remotely! that’s why you need to use bootsafe and it needs to be on the target computer.

3.    Open the command prompt on the target machine (Start, Run, ‘cmd’)  and enter the following:

REG COPY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winvnc HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\winvnc /s /f

This adds a registry key that allows VNC to start and work in safe mode with networking.

4.    Run Bootsafe on the target computer; select ‘Safe Mode – Networking’, click on ‘Reboot’.

If all goes to plan then you should be able to connect to the machine after it reboots in safe mode with networking. Use ‘ping –t’ ; you can see when the machine reboots and when it comes back to life. VNC Safe Mode !

Yes, there are other ways that you can achieve remote control in safe mode, but this did what I needed it to do. There are paid tools like logmein and you can also try VNCscan (I couldn’t get it to work). I’ve since cleaned a couple of machines using the VNC Safe Mode method and it has been surprisingly effective. If you’ve got malware problems try ComboFix combined with malwarebytes.

Standard warning: Step 3 adds a registry key to windows. Editing the registry could damage your computer. Do not edit the Windows registry unless you are confident about doing so.