Remove the Panda vaccine protection from the \AUTORUN.INF file (FAT)

Some people who use Panda AV or Panda USB Vaccine may find that the \AUTORUN.INF file on their E2B USB drive has been hidden and write-protected. Although it will not affect E2B, it does affect how the drive appears in Windows Explorer and how it is listed by grub4dos:

• The \AUTORUN.INF file is not visible in Explorer (even if 'Show all files' is enabled)
• You cannot write a new \AUTORUN.INF file or copy it over the top of the existing (hidden) one
• Windows Explorer does not show the E2B icon or display the Volume Label of the drive - it just shows 'Removable drive' or 'Local Disk'
• Grub4dos will not detect or list the file

What Panda appears to do is (on a FAT volume)

• Set the 'Hidden attribute' on the file
• Set one of the 'Reserved' attribute bits which makes Windows (and grub4dos) ignore it.

For a FAT volume, we can remove protection with this bit of (seemingly wrong!) code executed from the grub4dos command line once booted to E2B:

errorcheck off
if not exist /AUTORUN.INF fat del /AUTORUN.INF

This looks incorrect, but works because the grub4dos fat utility does not use the grub4dos filesystem driver and seems to ignore the 'reserved bit' that makes the file 'illegal'.

After this code is executed, the AUTORUN_.INF file can be renamed to AUTORUN.INF.

I have added a $Panda_RestoreAutorun.inf_FAT.mnu file to the Sample menus and also to the Alternate Download Area - mnu files folder. Just copy it to your \_ISO\MAINMENU folder to use it. You will only see it if there is no \AUTORUN.INF in the current volume.

$Panda_RestoreAutorun.inf_FAT.mnu
iftitle [if not exist /AUTORUN.INF] Restore \AUTORUN.INF (FAT32 only)\n Undo Panda Vaccination and delete or unhide AUTORUN.INF
errorcheck off
if not exist (hd0,0)/autorun.inf /%grub%/fat del (hd0,0)/autorun.inf > nul
if exist (hd0,0)/AUTORUN_.INF /%grub%/fat ren (hd0,0)/AUTORUN_.INF AUTORUN.INF
if exist (hd0,0)/AUTORUN.INF echo (hd0,0)/AUTORUN.INF now restored!
if not exist (hd0,1)/autorun.inf /%grub%/fat del (hd0,1)/autorun.inf > nul
if exist (hd0,1)/AUTORUN_.INF /%grub%/fat ren (hd0,1)/AUTORUN_.INF AUTORUN.INF
if exist (hd0,1)/AUTORUN.INF echo (hd0,1)/AUTORUN.INF now restored!
pause Press a key to reload the Main menu...
configfile (md)0xa000+0x8000 || configfile /menu.lst

For NTFS volumes, it is a lot trickier as there is no grub4dos equivalent to the fat utility for the NTFS filesystem (see next blog post).

If you want to try directly editing the NTFS filesystem to fix the AUTORUN.INF file, check the post  by Vasily Ignatov Apr 29, 2013 at 3:19 AM here.

Adding >4GB UEFI-bootable NTFS .imgPTN files to E2B

This page on the E2B site describes 5 methods on how to add UEFI-bootable .imgPTN files to E2B that contain >4GB files. i.e. how to UEFI-boot from an NTFS image file. This is useful if your source contains a >4GB Install.wim or Install.esd file.

I have recently added Method 5 to this page which describes how you can add a 2nd small FAT Primary partition to your E2B USB drive which contains Pete Batard's (Rufus author) UEFI-NTFS boot files (which I provide as an EFI_TOGO zip download file).

E2B_Editor v1.0.82 available

I have fixed a few niggly bugs in the E2B_Editor utility and hopefully made it more intuitive to use.

One problem was that on a 1600x900 screen, it defaulted to the 'borderless', fixed position mode.

Let me know if you find any problems, otherwise it will be in the next release of E2B v1.77.

Download from the Alternate Download Areas as usual and copy it to your \_ISO folder on the E2B USB drive.

It is intended to be run from the \ISO folder of the E2B USB drive and any bitmap that is used should be on the E2B USB drive in the correct location already, so that the path of the wallpaper bitmap file that is saved to the \_ISO\MyE2B.cfg file will be correct.
e.g. if you load a bitmap file from the Windows Desktop, then the .cfg file that you save will have an entry like:
set MYWBMP=/Users/Steve/Desktop/new800.bmp
so it is obviously not going to work when you use it on your E2B USB drive!

Switch_E2B v1.09 available

Following on from previous blog posts about using two partition image files for UEFI-booting of Windows installers with >4GB files...

As an alternative to using the MOVE_IMGPTN.cmd Windows script, Switch_E2B.exe v1.09 now detects the position of the two partition image files (e.g. FRED.imgptn and FRED) on an NTFS E2B drive and if they are in the wrong order for UEFI-booting, it will offer to attempt to re-order them for you.

It does this by copying the files up to 30 times and so it may take long time to do this, depending on the size of the files!

Since the file without the extension needs to be last one, this is the file that needs to be moved\copied. If this is a large file, it might take a while!

The re-ordering of the two files does not always work. If not, you can always try it again as it may work if you run it for a second time. Also, it may fragment the file (in which case you will need to run WinContig again and then try Switch_E2B again!

Note that this version shows you if a second partition image file is present that has no file extension.

It is available on the Alternate Download areas if you want to test it!

Let me know how you get on!

Note: SWITCH_E2B was only intended for use on NTFS E2B USB drives. The 'Restore E2B partitions' button should work on any drive, but switching to any .imgPTN file will only work on NTFS-formatted E2B USB drives - exFAT and FAT32 E2B drives will report an error.

Since the .imgPTN file needs to be first when using two partition image files and UEFI-booting on many systems, if SWITCH_E2B cannot move them, you could try just copying on the .imgPTN file, then defragging the whole partition (perhaps using Defraggler and WinContig?) and when all files are at the start of the volume, then copy over the 2nd file that does not have a file extension.

Netac U335 write-protected USB 3.0 flash drive for E2B

Today I got my new 32GB Netac U335 USB 3.0 Flash drive with a write-protect switch.

The write-protect slide switch is ringed in red.

The drive is not the fastest USB 3.0 drive I have ever seen (33MB/s read, 14MB/s write on a USB 3.0 port), but if you need a reasonably cheap USB drive with a write-protect switch then this would fit the bill.

Editing the MPI Tool Pack CSM menu (+ German version from Frettt)

The MPI Tool Pack only contains an English menu.lst file.

However, it does allow you to easily modify the files in the MPI Tool Pack to add your own menu.lst, background file and other files by using the CUSTOM folder.

When you run MPI, it starts by:

1. Creates a file-backed RAM DISK
2. Extracts the contents of the source (e.g. an ISO) to the RAMDISK
3. Copies the contents of the csm folder to the  root of the RAMDISK
4. Copies the contents of the CUSTOM folder to the root of the RAMDISK
5. Processes the files on the RAMDISK to convert them for use with E2B, including modifying the menu.lst file, etc.

Problems UEFI-booting .imgPTN files - continued...

I have experimented some more with my Asus Z87 UEFI system and .imgPTN files, and it seems that the firmware will not provide the user with the UEFI boot option to UEFI-boot from an MBR-partitioned USB drive, if the partitions on that drive are out of order.

The Partition Table in the MBR (first sector) has 4 'slots' for 4 partition entries.

Each Partition Table entry has the following fields:

• Drive number and Active/boot flag
• Partition Type number (e.g. 0C = FAT32)
• Start address of partition
• Number of sectors in the partition

(there are also some parameters for old Cylinder/head/sector addressing).

Problems UEFI-booting .imgPTN files!!!

Since about E2B v1.73, if the second partition is a small hidden type 21h partition that is placed there by RMPartUSB when you use RMPrepUSB or the MAKE_E2B_USB_DRIVE.cmd script, this partition is not removed when you switch to a .imgPTN file - this is only done if the extension is exactly ".imgPTN" or ".imgPTNAUTO".

This was done because some Legacy BIOSes would recognise  the USB drive as a floppy disk and thus fail to boot grub4dos and boot to the CSM menu unless a 2nd partition was present (e.g. some EeePCs).

Windows File Download problems - virus detected!

Windows 8/10 may not allow you to download files that it thinks are infected.

To be prompted to download it anyway, you need to change the Internet Properties setting:

You cannot download any file if the "File download" option is disabled in the Internet security settings. Follow these steps to check the Internet security settings:

E2B v1.76 RC1 available

• SWITCH_E2B v1.0.6 with FlashBoot and WinToGo+.imgPTN support.
• .isoBF fixed (did not work in 1.75!). 
• Zorin 9 persistent sample .mnu files added. 
• Fix for Zorin 9 in isoboot.g4b. 
• New AuroraBin default wallpaper. 
• Improve LZMA Encode/Decode scripts. 
• Fix bug - if user deleted some of the Windows sub-folders  (e.g. \_ISO\WINDOWS\XP) then the other Windows sub-folders were not enumerated. 
• Fix 'Trouble!' message if installing XP and >1 internal drive in system. 
• New grub4dos 0.4.6a version \grldr. 
• Add warning if Write-protected E2B USB drive found. 
• Improve MAKE_E2B_USB_DRIVE to detect Removable USB drives and set NOHELPER=1 in MyE2B.cfg for faster boot if using a Removable E2B drive.