7 replies to this topic

[computergenius]

I am currently using XP Pro machines that boot to either XP Pro or a hybrid of XP Pro PE and Bart PE. The OS is selected at startup. The reason I created this is to first boot to the limited PE OS to do the first pass of virus removal on an attached infected HD. In the PE mode my C: drive becomes X: and command line virus software can run in the limited PE environment without allowing viruses to start. I want to re-create this dual boot system with Windows 7 and Windows 7 PE. I would appreciate any suggestions before I start the project.

[allanf]

I want to re-create this dual boot system with Windows 7 and Windows 7 PE. I would appreciate any suggestions before I start the project.

Without much trouble, you can Boot WinPE 3.0 VHD from HDD. See here.

Basically:
1. Create a VHD with DISKPART under Win7. In the example, the VHD file is created on Partition d:, but can be anywhere.
2. Attach and format the VHD. DISKPART is used to assign a drive letter to the attached VHD. The example assumes e:, but check.
3. Wth imagex, apply the base winpe.wim: index #1 (from WAIK) to the attached VHD (check drive letter). Here you can customized the WinPE before detaching in the next step.
4. Detach VHD
5. Configure the Boot Configuration Data (BCD) by creating a new entry for the VHD with BCDEDIT.

Just one idea. (BTW. Looks to me like it may not load into RAM? ... :not sure: ...)

Regards

[computergenius]

With my current system, booting to the PE mode from the same disk/partition makes my internal HD C: on normal boot and X: on PE boot. This way I can boot to normal mode each morning and update virus definitions. When I boot the same HD to PE mode it becomes X: and the externally attached HD becomes C: allowing the virus cleaners to target the registry on C: (as they are programmed to do) for cleaning. Any additional drives or partitions would alter this ability and possibly target the wrong registry.

[allanf]

When I boot the same HD to PE mode it becomes X: and the externally attached HD becomes C: ...

Down the bottom of this page here, you will find "How to create an entry to boot a WIM image from a hard disk" - the standard (old) way of booting WinPE 2/3 from the same partition as Win7/Vista (and XP too). To me, it's more cumbersome than the vhd, and it's the same deal as far as drive letters are concerned.

[computergenius]

Thanks for the help. I really appreciate the lead.

Now, the XP and PE modes on the same HD share the same programs directory. Virus programs can be updated in normal XP mode and scan an external HD in PE mode. The XP mode uses c:windows\system32 for its registry and PE uses minint\system32 for its registry. In PE mode the boot drive becomes X: and the external HD becomes C: so the external HD's registry is scanned by default. Is it possible to accomplish this with a VHD?

The main thing I want from the PE mode is an OS that is so limited that it will not allow viruses to function. Currently I can't run programs that rely on DLL's. What I'm trying to accomplish is a limitd Win 7 OS that would allow only specific DLL's to run in PE mode and also run the same HD/Partition in real mode.

Thanks again for the pointer.

[allanf]

Thanks for the help. I really appreciate the lead.

Now, the XP and PE modes on the same HD share the same programs directory. Virus programs can be updated in normal XP mode and scan an external HD in PE mode. The XP mode uses c:windows\system32 for its registry and PE uses minint\system32 for its registry. In PE mode the boot drive becomes X: and the external HD becomes C: so the external HD's registry is scanned by default. Is it possible to accomplish this with a VHD?

The main thing I want from the PE mode is an OS that is so limited that it will not allow viruses to function. Currently I can't run programs that rely on DLL's. What I'm trying to accomplish is a limitd Win 7 OS that would allow only specific DLL's to run in PE mode and also run the same HD/Partition in real mode.

Thanks again for the pointer.

Well. I think there will be a problem with drive letters.

When WinPE 2/3 boots, usually it boots from RAM and the RAM Drive is assigned the letter x: (If you get fancy and customize the WinPE 3.x, you can change that letter using DISM set-targetpath, or something like that.)

In WinPE, the first partition on the first HDD is usually c:, the Optical Drive is usually d:, then the rest...

From a standard clean install of Win7, a separate active System Partition is automatically created without a drive letter under Win7. This contains boot files and BitLocker stuff, and will probably be seen by WinPE as c:. The Boot Partition containing Win7 files will probably be seen as e:, and the external HDD might be f: ...?

A third alternative to booting from vhd and booting from wim, is to boot WinPE "flat" - that is, not booting and running from RAM, but booting and running from HDD. You would use imagex to "apply" the winpe OS to a root directory, and configure BCD to boot from that root directory. With "flat" WinPE, I'm not sure of the drive-letter assignments.

The cmd-line virus scanner can be installed, or simply extracted, to a mounted (or applied) winpe image, so that only the WinPE OS is running when the scan is performed. By the sounds of it, it might need to point to the updated definitions on another drive. A better approach would be to extract or copy the definitions to the mounted winpe image so that the whole system is self-contained.

[computergenius]

I will try the various versions of your suggestions and let you know how they work.

Thanks for your thoughtful responses.

[allanf]

I will try the various versions of your suggestions and let you know how they work.

Thanks for your thoughtful responses.

No worries. I hope I'm not to vague on the procedures. Read all about them here.

Regards