In-depth understanding of writing designed to kill the virus (2)

two o'clock Zhuanshagongju system startup, WindowsVista system users

due WindowsVista use NTFS partitions under DOS is not accessible, so we can not use the above method to achieve automatic Antivirus. However, we can also use Windows PE2.0 (hereinafter referred to as PE) to achieve automatic anti-virus.

first step: making designed to kill the batch file and save it as d: kill.bat, due to the command line of Windows support more parameters, we change the code as follows:

attrib- hr-sC: WindowsIGM.exe

rem delete the virus without verifying documents

del /f /q /sC: WindowsIGM.exe

mdC: WindowsIGM.exe

rem automatic restart

shutdown-r

virus after completion of the second step: downloading PE. Unzip and get an ISO file, then use WinRAR to extract all the files to d:PE.

Step Three: Download WimTool, WimTool downloaded to decompress, run one of the "WimTool runtime .exe" as an administrator, and then run WimTool same as an administrator, click the "Browse" The webpage teaching network reminds everyone to choose the Wim file to be solved: d:pesources?oot.wim, select the target folder to be unpacked and select d:PE1 (D is the NTFS partition). Check all options under the image volume number and click Mount Image.

fourth step: The system will automatically mount boot.wim file using Notepad open "d: peWindowssystem32peshell.ini" file, add the following code at the end of [the AutoRun] field, the code loading means After killing the PE shell, kill.bat automatically deletes the poisoned files.

1 = d: kill.bat

Step five: Return Wimtool window, click after the completion of the operation "Uninstall image", the program prompts whether to save when you change the image, click "Yes ", save the changed boot.wim file.

Step Six: Download Easybcd. After running Easybcd, switch to "Add/RemoveEntrIEs", switch to "WinPE" under "Addaentry", enter d:pesources?oot.wim in the Path path, click "Addentry", and then insert the Vista installation CD copy file as prompted. can.

Step Seven: After the completion of the operation, if you later want to antivirus, reboot multi-boot menu, select "NSTwinPEImage" to boot. After the antivirus is completed, it will restart automatically.

Tip: For WindowsXP single-user system, if the system partition using the NTFS format. We can also install PE to NTFS partition to kill viruses. Extract all downloaded PE files to c:, and use Wimtool to edit c:souces?oot.wim. Then open the C drive, change the XP boot file ntldr to WINXP, and change c:?ootmgr (the file released from the PE) to ntldr. Finally open "c:?oot.ini" and add "C:winxp="WindowsXP"" after the text (without the outer double quotes). After restarting, select "WindowsSetup[EMSEnabled]" to enter PE automatic antivirus.