Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
  • Is there a way to disable safe mode in Windows 7?

In XP, I can modify the following keys to disable safe mode, which causes BSOD and reboot.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network]

Unlike XP, Windows 7 prevents users from editing, renaming or deleting such registry keys. It gives error message, "Error Renaming Key, The Registry Editor cannot rename Minimal. Error while renaming key."

I HAVE TESTED IT. An enemy can get into safe mode (using decoy password) then do 101 stuffs like bypassing/disabling startup items, hexing the last password used to setup hidden volume. I spent weeks trying to find solution (not to mention the fake answers) but all in vain.

  • Is there a freeware to intentionally crash our system via hotkey while still logged on?

Bestcrypt has the emergency crash hotkey but it's part of the package which is not free. Thus, I'm trying to find free way to crash (possibly going into BSOD and reboot).

Also, I heard about the MBR killer virus some time ago. How can I get it for use on my own computer.. preferably in a password compressed zip to release it when decompressed? I think it's good for Truecrypt last line of defense.

share|improve this question

closed as unclear what you're asking by nhinkle Jun 28 '13 at 0:01

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Odd, but safe mode forces me to type a password. . . –  surfasb Jul 13 '11 at 20:51
    
There is no "decoy password", so I'm not sure what you're talking about. –  nhinkle Jun 27 '13 at 22:12

4 Answers 4

You want to forcefully disable Windows' failsafes?

While I understand the question, I don't think it's necessary. TrueCrypt's full system drive encryption covers you for most of your requirements. You need to enter the password before the Windows boot loader even runs. With customising the password entry prompt, you can fake a non-responsive hard drive at that screen.

As for crashing Windows using a hotkey, I don't know of any, but I'm sure something exists.

share|improve this answer
    
I'm actually referring to anti-forensics. I'VE TESTED IT on decoy volume. An enemy can get into safe mode (using decoy password) then do 101 stuffs like bypassing/disabling startup items, hexing the last password used to setup hidden volume. –  desperado Mar 31 '11 at 4:59
    
I'm not convinced. You can embed a second TrueCrypt volume inside the first one. Be that as it may, it's a given that physical access to a machine means it can be owned. It sounds like you're trying to get around this, and that's not possible in my opinion. –  user3463 Mar 31 '11 at 5:25
    
Yeah, Safe mode makes me use a password. Now if you enabled the built in admin account, that's a different story. . . –  surfasb Jul 13 '11 at 20:52

Force a crash from the keybaord

You must ensure the following three settings before the keyboard can cause a system crash:

If you wish a crash dump file to be written, you must enable such dump files, choose the path and file name, and select the size of the dump file. For more information, see Enabling a Kernel-Mode Dump File.

With PS/2 keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.

With USB keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters, create a value named CrashOnCtrlScroll, and set it equal to a REG_DWORD value of 0x01.

You must restart the system for these settings to take effect.

After this is completed, the keyboard crash can be initiated by using the following hotkey sequence: Hold down the rightmost CTRL key, and press the SCROLL LOCK key twice.

The system then calls KeBugCheck and issues bug check 0xE2 (MANUALLY_INITIATED_CRASH). Unless crash dumps have been disabled, a crash dump file is written at this point.

If a kernel debugger is attached to the crashed machine, the machine will break into the kernel debugger after the crash dump file has been written.

source of Information

.

To change the registry keys you may need to change the permissions of the key first, I have no way of knowing what negative affects this may cause, use at your own risk. Backup the key first, Export the key before you change it, label it so you know what it is.

Right click on the key in registry editor and select permissions, make changes in there like you would for any other windows file.

Do some reading on how to properly change permissions before you change anything, making the wrong permissions changes can have disastrous consequences.

enter image description here

.

Or try this free utility http://guino.home.insightbb.com/nosafemode.html

share|improve this answer

If renaming those registry keys is the magic, then the Offline NT Password and Registry Editor may be a solution. It allows editing Windows' registry hives while not booted into Windows.

Or it may just alert you to more reasons to be paranoid?

One of the security maxims I've heard is this: If the bad guys have physical access to your computer, it's not your computer anymore.

In any case, hope this helps.

share|improve this answer

Few days ago I was also looking for an simple solution to disable safe mode in windows 7. I don't like any registry or MBR modifications and I don't want anyone to see BSOD after pressing F8 key. Disable Safe Mode is the really simple tool which helped me a lot.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.