In-depth understanding and writing a special killing tool system to kill the virus when booting (2)

Second, Windows Vista system users

Because Windows Vista uses NTFS partition, it is inaccessible under DOS, so we can not Use the above method to achieve automatic antivirus. However, we can also use Windows PE2.0 (hereinafter referred to as PE) to achieve automatic anti-virus.

Step 1: Make a special kill batch file and save it as d:\\kill.bat. Since the command line under Windows supports more parameters, our code changes as follows:

attrib -h -r -s C:\\WINDOWS\\IGM.exe

rem No need to confirm the direct deletion of virus files

del /f/q/s C:\\WINDOWS\\IGM.exe

md C:\\WINDOWS\\IGM.exe

rem Automatic restart after killing

shutdown -r

Step 2: Download PE. Unzip and get an ISO file, then use WinRAR to extract all the files to d:\\PE.

Step 3: Download WimTool, extract the downloaded WimTool, run the "WimTool runtime.exe" as an administrator, then run WimTool as an administrator and click "Browse". The web teaching network reminds everyone to choose the Wim file to be solved d:\\ pe\\sources\\boot.wim, select the target folder to be unpacked and select d:\\PE1 (D is the NTFS partition). Check all options under the image volume number and click Mount Image.

Step 4: The system will automatically mount the boot.wim file, use the Notepad program to open the "d:\\pe\\windows\\system32\\peshell.ini" file, and add the following code at the end of the [AutoRun] field. The code means that the kill.bat file is automatically deleted after the PE shell is loaded.

1=d:\\kill.bat

Step 5: After completing the above operation, return to the Wimtool window and click “Uninstall Image”. When the program prompts you to save the changed image, click “ Yes", save the changed boot.wim file.

Step 6: Download Easybcd. After running Easybcd, switch to "Add/Remove Entries", switch to "WinPE" under "Add a entry", enter d:\\pe\\sources\\boot.wim in the Path path, click "Add entry", and then press prompt Just insert the Vista installation CD and copy the file.

Step 7: After completing the above operation, if you want to anti-virus later, after rebooting, select “NST winPE Image” in the boot multi-boot menu. After the antivirus is completed, it will restart automatically.

Tip: For Windows XP single system users, if the system partition uses NTFS format. We can also install PE to NTFS partition to kill viruses. Extract all downloaded PE files to c:\\, and use Wimtool to edit c:\\souces\\boot.wim. Then open the C drive, change the XP boot file ntldr to WINXP, and change c:\\bootmgr (the file released from the PE) to ntldr. Finally open "c:\\boot.ini" and add "C:\\winxp="Windows XP"" after the text (without the outer double quotes). After restarting, select "Windows Setup [EMS Enabled]" to enter PE automatic antivirus.