'Kill switch\vaccine' for latest Petya\NotPetya ransomware found

A report on Bleeping Computer says that a way to prevent infection by the latest NotPetya ransomware is to create a read-only file at C:\Windows\perfc.

You can do this by downloading and running this file as Administrator.

I have no idea if it works, but if your organisation has un-updated/unpatched systems, this could be useful to prevent your disk from being encrypted.

As I suspected, virus developers will build in some sort of 'kill switch' to prevent their own systems from getting infected, as with WannaCry. I guess it's kinda difficult to write code and test it, only to find that the code has just encrypted all your source files and the decryption algorithm is not yet working! The Wannacry vaccine was coded to find a specific web server which meant it could be easily stopped by setting up a server of the correct name. The Petya developers obviously did not want to use the same mechanism, which was discovered and then used as a global 'kill switch', and so have used a local file instead to stop infection.

Installing 32-bit and 64-bit Windows ISOs with E2B

A user had Windows 10 32-bit and 64-bit ISO files in his \_ISO\WINDOWS\WIN10 folder.

We can make a .txt file for each .ISO file so that if the system CPU that we are booting from is a 32-bit CPU then only the 32-bit ISO will be listed in the Windows 10 menu. If the CPU is a 64-bit CPU then we can show only the 64-bit ISO file in the menu.

See here for details.

However, this user wanted to only show the 32-bit ISO if the system has <4GB of memory and only show the 64-bit ISO if the system has more than 4GB of memory.

The way around this was to create a new variable (GB4) in our \_ISO\MyE2B.cfg file:

# set 4GB variable if 4GB+ of memory present

set /a M=*0x8298 & 0xffffffff>>10+1 > nul ;; set /a M1=*0x82c0>>10+1 > nul ;; set /a M=%M% + %M1% > nul ;; if %M%>=4096 set GB4=1 ;; set M= ;; set M1=

We can now test for the existence of the variable GB4 in our .txt file:

Example:
We have a Windows10_x86.iso and a Windows10_x64.iso:

\_ISO\WINDOWS\WIN10\Windows10_x86.iso

\_ISO\WINDOWS\WIN10\Windows10_x64.iso

If a system has more than 4GB of memory, only show the 64-bit Windows ISO (it must have a 64-bit CPU if it detects >4GB). If it has less than 4GB we only show 32-bit Windows ISO.

 

Windows10_x64.txt

iftitle [if exist GB4] Win10 1703 x64\n Install 64-bit Windows 10

Windows10_x86.txt

iftitle [if not exist GB4] Win10 1703 x86\n Install 32-bit Windows 10

Note: There is a bug in E2B which causes a 'no title keyword found in xxxx.txt file' error when the Windows menu loads. This can be fixed by saving the .txt file as ANSI encoded instead of UTF-8 encoded - OR update your E2B drive with E2B v1.94a (beta) which has a bugfix for this.

MPI Tool Kit v0.077 now available

This version has two small changes:
1. Latest RMPartUSB.exe in the e2b folder
2. MakePartImage.cmd will now not  copy some 'special' files and folders when you use a USB drive as the source to make the .imgPTN file.

The excluded files/folders include $recycle.bin, pagefile.sys, hiberfil.sys, System Volume Information, etc. which often cause problems when copying under Windows.

To upgrade, download and extract the new MPI_Tool_Pack_Plus_CloverLite_077 folder to your Desktop and run CreateDesktopShortcuts.cmd. You can then delete the old MPI_Tool_Pack_Plus_CloverLite_0xx folder from your desktop.

Add PeppermintOS 8 + persistence to E2B

PeppermintOS 8 is based on Ubuntu\Lubuntu, so I have modified one of the Ubuntu_Persistence Sample menu files.

I used the Peppermint-8-20170527-amd64.iso (1.2GB) with the .mnu file shown below:

Easy2Boot v.1.93A available (to work around Win10 1703 bugs!)

Windows 10 Creators update (1703) is still buggy.

As you may be aware, Windows 10 1703 now recognises all partitions on Removable USB drives and attempts to mount them.

Sometimes it will assign a drive letter to each partition (and sometimes not!).
The Disk management console however still only shows one volume and one drive letter for the Removable drive even if it has multiple partitions.
Also DiskPart only lists one volume on a multi-partition USB drive.
If Windows assigns a drive letter to the 2nd partition, the letter cannot be changed or removed.

Explorer view of Removable USB drive with two primary partitions F: and J:

Disk Management console (where is F: ???) 

Disk Management Console (Disk 4 Partition 2 has no drive letter!)

DiskPart - where is volume F: ???

E2B v1.93A includes a new version of RMPartUSB which attempts to force Windows to assign all the USB drive partitions with a drive letter.

This should prevent the format that is done by RMPartUSB from failing and then prompting you to assign a drive letter manually.

P.S. If you are having problems changing the drive letter of a volume on a Removable USB drive because the letter is not listed by Disk Management or DiskPart, I have written a ChangeLetter.cmd script which you can download here (in Alternate Downloads areas). It only works on Removable USB drives and you must run the .cmd file which then runs the .vbs script as admin.

Easy2Boot v1.93/A Full version released

E2B v1.93A full release is now available.

It will also be uploaded to the E2B website in a few days.

Changes from v1.92 are:

1. Offline choco package support added to  SDI_CHOCO.cmd template
2. \_ISO\docs\Chocbox\ChocBox.cmd for making offline choco packages
3. NoSpeak.tag and NoBeep.tag now detected by SDI_CHOCO
4. Chocolatey offline package added - version 0.10.6.1
5. Snappy Driver Installer 'Origin version' now used
6. QRUN.g4b changed - small change to .imgPTN so if second *. image file present it will get a partition type number of 7 if grub4dos does not give it one 
7. Suppress suggestion prompt if *q.iso used (useful for WinBuilder ISO or other .iso files which don't work if you use the .isodefault extension)
8. Switch_E2B.exe v1.0.16 hidden file fix
9. OpenMandriva ISO sample mnu file added
10. New grub4dos 0.4.6a
11. GIFtoIMA.cmd script provided to make animations from GIf files
12. Make_E2B.cmd will now download bootmgr from internet and add it to E2B drive
13. \_ISO\docs\Make_E2B_USB_Drive\Add_Bootmgr_to_E2B_drives.cmd added
14. New default menu wallpaper

Please feedback ASAP if you spot a problem with the new version (and give step-by-step details about how I can reproduce the problem).

Tip: You can use v1.93 to update any previous DPMS USB drive.

You may get some AV warnings but these are false positives (honest!).

Add you own background wallpaper

Place an 800x600x24bit colour .bmp or .jpg file at \_ISO\MyBackground.bmp or \_ISO\MyBackground.jpg and it will be used instead of the default E2B wallpaper.

Copyright free images can be found on www.pexels.com.

MPI Tool Pack v0.076 available

I discovered a few issues in v0.075 to do with converting payloads which used isolinux/syslinux.

I have also simplified the way syslinux is installed - it now creates a \syslinux.bin file which the CSM menu can use as the boot file.

v0.076 is available on the Alternate Download sites and will also be updated on the E2B website soon.

Easy2Boot v1.93i available

This version has these extra changes:

• Feature for WinBuilder ISOs - if .ISO file ends in q.iso or Q.iso then auto-suggest prompt will be suppressed - use for WinBuilder ISOs which must use a .iso file extension, e.g. Gandalf_2016_x86q.iso. 
• Make_E2B.cmd changed - Win 8.1 bootmgr is now downloaded from the internet using JFX's GWT tool and added to USB drive if no good version of bootmgr is found on Windows host drive.
• \_ISO\docs\Make_E2B_USB_Drive\Add_Bootmgr_to_E2B_drives.cmd will download the Win8.1 version of bootmgr and add it to any E2B drive you have connected.
• Latest grub4dos 0.4.6a

I will release v1.93 as a full release soon. Please let me know if you spot a problem.

Summary of changes from v1.92:

• Offline choco package support for SDI_CHOCO function
• \_ISO\docs\Chocbox\ChocBox.cmd for making offline choco packages
• NoSpeak.tag and NoBeep.tag detection for SDI_CHOCO
• New Chocolatey version 0.10.6.1
• GIFtoIMA script to make animations easily
• Snappy Driver Installer Origin version now used
• QRUN.g4b changed - small change to .imgPTN so if second *. image file present it will get a partition type number of 7 if grub4dos does not give it one 
• Switch_E2B.exe v1.0.16 hidden file fix
• OpenMandriva ISO sample mnu file added
• New grub4dos 0.4.6a
• Make_E2B will download bootmgr from internet and add it to E2B drive
• \_ISO\docs\Make_E2B_USB_Drive\Add_Bootmgr_to_E2B_drives.cmd
• Suppress suggestion prompt/text if *q.iso used (for WinBuilder ISO or other .iso files)

Add bootmgr to your E2B drive

As you may know, E2B does not include bootmgr for legal reasons.

The Make_E2B.exe and the 'make' scripts look for the correct Win 8.1 version of bootmgr on your Windows system and will copy it to the E2B drive for you.

If you don't have the correct version, the E2B 'make' script will warn you that, in order to boot Windows .VHD and .WIM files, you will need to add it.

Note: E2B v1.93+ now will download the bootmgr file automatically when you run Make_E2B.exe.

Add_Bootmgr_to_E2B_drives

\_ISO\docs\Make_E2B_USB_Drive\Add_Bootmgr_to_E2B_drives.cmd will automatically add bootmgr to the \_ISO\e2b\grub\DPMS\NTBOOT.MOD folder of any E2B drive that you have connected when you run it. Internet access is required.

It takes just a second or so to run.

Note: The new Make_E2B script will automatically download bootmgr for you and put it on the E2B USB drive in the correct folder.

See here for more details on GWT.

E2B v1.93h available

v.1.93h has just a few small tweaks + latest grub4dos. + bug in ChocBox.cmd fixed.

One small change in SDI_CHOCO is that you now do not need to edit the SDI_CHOCO.cmd file when you copy it, to change the name of the configuration folder that you want it to use.

For example: if you want to make a new configuration called 'NEW', then you just copy and rename the SDI_CHOCO.cmd file and the SDI_CHOCO folder to NEW.cmd and NEW (folder).

The code in NEW.cmd will automatically look for a configuration folder of the same name as the .cmd file.

So your modified XML file will call NEW.CMD which will automatically use the NEW folder as the configuration folder. The files in the NEW folder:

• MySpecialize.cmd             - runs after Snappy driver installer before reboot
• MySetupComplete.cmd     - runs before OOBE
• MyStartup.cmd                  - runs after OOBE on first user login (which can be automatic)

will control the installation of additional drivers and apps, etc. and the .TAG files will control other
features:

• NoInternet.TAG - Internet connectivity will not be checked, msoobe will not be called to initialize n/w during Specialize
• NoChoco.TAG - choco will not be downloaded from internet (but can still be installed Offline)
• NoSDI.TAG - The Snappy Driver Installer will not run (useful if you install your own drivers)
• NoWSUS.TAG - WSUS Offline Updater will not run
• OfflineChoco.TAG - \_ISO\WINDOWS\INSTALLS\CHOCBOX folder is copied to C:\DRIVERS\CHOCBOX and Chocolatey is installed directly from E2B drive
• NoBeep.TAG - do not beep the speaker (v1.93+)
• NoSpeak.TAG - don't tell me what you are doing (v1.93+)

Read more: http://www.easy2boot.com/add-payload-files/windows-install-isos/sdi-choco/

Removable v. Fixed 

I have added a new page to the E2B site  here  about why the type of USB drive you use for E2B matters.

How to add the UBCD4WIN ISO to E2B

The UBCD4WIN ISO is now quite old and development has been discontinued and the website is no longer available.

UBCD4WIN miniXP (BartPE) lacks drivers for modern systems and so is really only suitable for older systems and chipsets.

Offline Chocolatey for Win7 installs

I was asked yesterday (using online 'Chat') about using the E2B SDI_Choco offline feature to install Windows 7.

The problem here is that Chocolatey requires .Net 4 Framework and this is not included in Windows 7.

If you download the standalone install package for .Net 4 and try to install it, it requires a reboot before it will work. However, we cannot reboot during the Specialize pass or Windows Setup will complain about it when it reboots and will not proceed.

Equally, we cannot allow a reboot during MyStartup.cmd because this only runs once on first user login and so the code to install the offline choco apps will never run.

The solution was to install the .Net 4 package at the end of MySetupComplete.cmd when a reboot is imminent anyway.

I have added the necessary instructions to the Offline Choco page on the E2B website here under the Requirements heading.

If you have any questions, you can chat with me by clicking on the chat icon on the E2B website.

Click to chat

Old PC won't boot from E2B USB drive (flashing cursor)

To ensure that your E2B USB flash drive will boot from as many systems as possible, it should have the following characteristics:

1. Have the boot partition marked as Active (bootable)
2. Have grub4dos boot code in both the first sector (master boot record or MBR) and the first sector of the first partition (partition boot record or PBR)
3. Have two primary partitions in the MBR partition table
4. Have all boot files and E2B files within 137GB (128GiB) from the beginning of the drive

If you use the Make_E2B.exe GUI to make your E2B USB drive, then it will have these properties already.

It has been rumoured that some BIOSes will only boot from a USB FAT partition and not from an NTFS partition (although I have never seen this personally and I have never had any specific confirmation of this phenomenon!).

However, even if your drive is correctly made, some early PCs with USB 1.0 and early USB 2.0 ports may not boot to grub4dos\E2B.

E2B v1.93g available

Changes from 1.93f are:

• latest \grldr grub4dos version
• UUID and volume label of ISOs now displayed briefly in some cases
• NoSpeak.tag and NoBeep.tag files can be used with SDI_CHOCO to suppress talking and beeping

Now you can stop SDI_Choco speaking to you and also stop it beeping by adding two tag files to your configuration folder.

Please update your existing E2B drive(s) with 1.93g and let me have your feedback.

Note that in the final v1.93 version, I will delete the chocolatey.nupkg file from the \_ISO\WINDOWS\INSTALLS\INSTALLCHOCO folder and make the file available as a separate download. This will prevent a later E2B update from overwriting your chocolatey package and also reduce the size of the E2B download back to 17MB.

P.S. if you use ChocBox.cmd, there is a small bug. It says to use the command
choco install %appx% --source C:\DRIVERS\choco -y -r
but this should be
choco install %appx% --source C:\DRIVERS\chocbox -y -r

Change History

v1.93a - Addition of offline choco package support for SDI_CHOCO function (adds 6MB)
v1.93b - Improved \_ISO\docs\Chocbox\ChocBox.cmd for making offline choco packages.
v1.93c - GIFtoIMA script and improved ChocBox.cmd script
v1.93d - improved GIFtoIMA script to delete files > 0255.bmp and save as BMP or JPG, new grub4dos 0.4.6a
v1.93e - new Snappy Driver Installer Origin version, latest grub4dos 0.4.6a 2017-05-29, QRUN.g4b small change to .imgPTN so if second *. image file present it will get a partition type number of 7 if grub4dos does not give it one, improved ChocBox.cmd (now can get specific app version)
v1.93f - Switch_E2B.exe v1.0.16 hidden file fix, new Chocolatey version 0.10.6.1, openmandriva ISO sample mnu file
v1.93g - latest grub4dos, NoSpeak.tag and NoBeep.tag for SDI_CHOCO

What is the best way to speed up my notebook?

A friend recently asked me this question.

How to super-hide E2B files from Windows Explorer

A simple way to hide an ISO, .imgPTN or other payload files on an E2B drive is to simply set the Hidden attribute (right-click - Properties - tick Hidden - OK). But you knew that already right?...

But what if the user has 'Show hidden files' enabled in Explorer? He will still be able to see the files - so how can we prevent this?

Well, to make the file super-hidden (hidden+system), simply make sure the filename starts with a ~ symbol (as well as having the Hidden attribute set).

e.g. \_ISO\LINUX\~kali.iso

Explorer will not show the file, even if the user has 'Show hidden files' enabled (you may need to press F5 to refresh Explorer after you have changed the name, before it will disappear).

The user (and you) will still be able to see the file if  'Hide protected operating system files' is unticked however, but using ~ is easier than using the attrib +h +s command on the command line because you can add a ~ using Explorer.

WARNING: DO NOT USE SWITCH_E2B.exe on a ~xxx.imgPTN file - it will corrupt the drive! This bug is fixed in SWITCH_E2B v1.0.16.

Of course, this won't stop linux or the  dir /ah command from listing the files, but it is a simple tweak and will fool most Windows users.

Reference: Raymond Chen from here.

Adding OpenMandriva to E2B

The OpenMandriva ISO does not boot as a .ISO file when simply placed on an E2B drive.

Instead we need to make a .mnu file for it and specify the Volume Label of the ISO.

Here is an example menu:

E2B v1.93e available

Change History

v1.93a - Addition of offline choco package support for SDI_CHOCO function

v1.93b - Improved \_ISO\docs\Chocbox\ChocBox.cmd for making offline choco packages.

v1.93c - GIFtoIMA script and improved ChocBox.cmd script
v1.93d - improved GIFtoIMA script to delete files > 0255.bmp and save as BMP or JPG, new grub4dos 0.4.6a
v1.93e - new Snappy Driver Installer Origin version, latest grub4dos 0.4.6a 2017-05-29, QRUN.g4b small change to .imgPTN so if second *. image file present it will get a partition type number of 7 if grub4dos does not give it one, improved ChocBox.cmd (now can get specific app version)

Snappy Driver Installer is dead-ish - long live Origin!

It seems that that old Snappy Driver Installer has forked to a new 'Origin' version (SDIO).
'The old sdi-tool.org project  is no longer in the hands of the original developers, is no longer open source and is not safe to use.'

This is rather confusing because the old site clearly says it is free and open source, but apparently does contain adware now...

For the new Origin version is here but cannot simply replace the old version because the executables have different names (AUTO.cmd requires changes).

E2B v1.93e will include the new forked version but if you want the sdi-tool.org version, then remove all the SDIO files from the SNAPPY folder (except for the AUTO.cmd file) and replace them with the download from sdi-tool.org.

The new version of AUTO.cmd will call the SDIO version by default, but if the SDI executable is present, it will use that instead (if you have replaced SDIO with SDI from the sdi-tool site).

Do you have a StarTech S2510BU3ISO Virtual DVD emulator enclosure?

A few months ago I contacted StarTech support about the bug in their S2510BU3ISO product.
Many users on Amazon and elsewhere have reported difficulties with the product.
You can read my review in a previous blog post here.

If you freshly format the drive and then add a single ISO file to the \_ISO1 folder, then it should work correctly.

But, I gave them a simple Windows cmd test script (StarTechFormatTest.cmd in Easy2Boot Alternate Download Areas - Other Files) which will format the hard disk in the USB enclosure and then copy 1GB files to it. You just need to download the debian-live-8.1.0-amd64-mate-desktop.iso file from t'internet and rename it to 1GB.ISO first. You will need a 60GB+ disk fitted (SSD recommended for speed).

E2B v1.93d BETA available

v1.93d has an improved GIFtoIMA script.
http://www.easy2boot.com/configuring-e2b/animation/ has been updated.

GIFtoIMA.cmd now only uses frames up to frame #255 (maximum for grub4dos) and can also now save as JPG instead of as BMP to save space.

Note that using a transparent background setting for JPGs does not work well because some of the background pixels may be a slightly different RGB value, so if you want to use a transparent background for your animation, choose the BMP option (default).

I spent a LOT of time looking for a GIF editor, but eventually I found a utility

E2B v1.93c with new 'GIFtoIMA' script for making animation files using drag-and-drop

Changes in v1.93c

• Improved ChocBox.cmd script for making offline Chocolatey packages (with website lookup for packages)
• New GIFtoIMA.cmd script for converting animated GIFs to a .IMA image file for use with E2B

\_ISO\docs\E2B Utilities\GIFtoIMA\GIFtoIMA.cmd is a script which will convert an animated GIF to a floppy disk .IMA file ready for use with E2B. It even generates the required grub4dos code that you can paste into your \_ISO\MyE2B.cfg folder.

P.S. E2B v1.92d version will also delete any frame_00256.bmp and over files because maximum is 255 for grub4dos\E2B anyway.

E2B v1.93b with SDI_CHOCO offline package support

The E2B v1.93b BETA download is now available from the Alternate Download areas. You can use it to update your E2B Flash drive.

v1.93b has an improved version of the ChocBox.cmd script which makes choco offline packages.

We can now add almost any Chocolatey application to an SDI_CHOCO configuration as an offline install.

This means we no longer need an internet connection to use SDI_CHOCO and can now install drivers, Windows updates and applications offline  using any unmodified Microsoft Windows ISO install file (Win7+).

P.S. There is now a Chat facility on www.easy2boot.com, if you have a quick question for me.

E2B OFFLINE DEMO STICK (280MB)

WARNING: Do NOT use the Update E2B button as this DEMO version will overwrite your current SDI_CHOCO configuration files!

If you want to make an E2B DEMO USB stick without having to configure anything or add apps, you can download E2B_v1.93a_OFFLINE_SDI_CHOCO_DEMO.exe from the Alternate Download Area (280MB), add your Microsoft Win10 ISO and then pick any SDI_CHOCO XML file to wipe your hard disk and install Windows 10 + a few drivers + a few apps automatically. This version has some Snappy Drivers and app packages (Foxit, ProduKey, notepad++ and WinMerge) which is why it is so big. I will remove it in a few days.
To add more Snappy drivers, run the Snappy executable. To add more apps, read the E2B web page here.

Note: This version has an older (buggy) version of ChocBox.cmd - you can quickly update it using the Update button in v1.93b or later.

Install Chocolatey and Chocolatey packages offline

I have now added a set of files which will install Chocolatey onto a system to the Alternate Downloads Area.
The install package for Chocolatey itself is now in the E2B v1.93 downloads.

It includes the current Chocolatey.nupkg file and a script to install Chocolatey onto a Windows system.

This means you can install Chocolatey and Chocolatey packages completely offline and so the whole SDI_Choco process can be done offline.

Since many app packages are in Chocolatey, you are to pick from 1000's of ready-made install packages.

See the previous blog post for details.

P.S. E2B v1.93 has the required utilities and SDI_CHOCO support for choco offline installs. I have this working and I can now do a completely automated offline install with drivers, WSUS updates and any offline choco apps apps I want with no Ethernet cable attached.

P.P.S. E2B v1.93a BETA and DEMO now contain these scripts, so I have removed the separate downloads from the Alternate Download areas. Download the latest v1.93 instead!

ChocolateStore - offline Chocolatey packages for SDI_CHOCO (E2B)

If you use the SDI_CHOCO feature of Easy2Boot to install drivers, Windows updates and applications completely unattended, you will know that applications are installed using Chocolatey.

The SDI Snappy Driver Installer and the WSUSOffline updater are both offline utilities, however Chocolatey is an online utility. Every time it runs, it will download the latest version of an application from the internet and automatically install it onto the target system. This takes time depending on your internet download speeds and also means we may get a different version of the software now than we got last week.

I have utilised the ChocolateStore github software by BahKoo on github so that we can now add offline chocolatey packages to the SDI_Choco process.

By installing the apps offline using Chocolatey, we get faster installation and we will always get the same app versions (unless we manually update them). We can still remove the USB drive after Setup reboots.

Not quite completely offline...

Note that we still have to get Chocolatey itself installed on the target system. Although the apps do not require an internet connection, the installation of Chocolatey using the standard SDI_CHOC scripts does require an internet connection. However, I have made an offline package to install Chocolatey (see end of this bog post). This means that you can now choose from 100's of ready-made Chocolatey apps and install Chocolatey itself completely offline.

P.S. E2B v1.93 will have the required utilities and SDI_CHOCO support for choco offline installs. I have this working and I can now do a completely automated offline install with drivers, WSUS updates and any offline choco apps apps I want with no Ethernet cable attached.

Watch this space!

How to use ChocBox

Add Webconverger to E2B

Webconverger is a professional Kiosk Browser which you can run from a LiveCD ISO or as an installed OS on a hard disk or USB drive (it is based on Debian and FireFox). It can also be configured as a 'signage' panel.

Kai Hendy of Webconverger offers a 30-day free trial which is needed if you want to make use of the 'control-panel' configuration features (though it seemed to mostly work without subscription for me).

Kai Hendy tells me:
The way it works is once your credit card is provided, you have a 30 day
free trial. So no deductions are made if you want to experiment for a
month. If there is a charge on a test machine, I can refund it, don't
worry.
For those customers, if they want to cancel for any reason, I offer a 30
day money back guarantee.

The online configuration form can control many machines
all registered to the same email account.

Once a machine is 'subscribed', all remote control-panel seemed to work well and as expected, although for some changes, a reboot was required.

If your E2B USB drive is a Removable drive (e.g. most USB Flash drives) then you can just directly boot from it as an .iso file from E2B (or use .isodefault to suppress the suggestion messages). You can enter the email address that you can also use for your subscription.

However, if your E2B USB drive is of the Fixed-disk type (e.g. USB HDD) then it will not boot directly from the ISO because the pre-defined linux boot parameters include the cheat code bootfrom=removable so that it will only boot from removable media.

A simple way to remove the bootfrom=removable code is...

Add Lenovo diagnostics and BIOS Updates to E2B

The linux bootable Lenovo Diagnostics ISOs can simply be copied to any E2B menu folder (e.g. \_ISO\UTILITIES). The diagnostics will only run on Lenovo-branded systems.

The linux-bootable-cd-41308857.iso is also UEFI 64-bit bootable.

Install the E2B MPI Tool Kit and then drag-and-drop the ISO onto the Windows MPI_FAT32 shortcut (I suggest you rename the ISO first because the CSM menu title has the same name as the ISO file).


Lenovo also supply UEFI-bootable versions of their diagnostics (see below).

Hit by WannaCry? There is a decryptor now for XP and Win7.

If you or one of your users have a Windows XP or Windows 7 system and have been hit by the WannaCry ransomware virus, do not despair!

The first thing to do is to warn all users that if they are hit (and their systems are Win7 or XP),

do NOT turn off the system - do NOT reboot it - do not use it - just leave it alone!

The next thing to do is (as quickly as possible) download the decrypting software wanakiwi.exe onto a USB stick (don't use the infected system!), plug it in to the affected system and run it.

If possible, it would be better to make sure every computer had a copy of wanakiwi.exe already on their hard disk because connecting a USB drive may destroy the keys which are left in memory.

More info and an animated GIF of it in action on Windows XP and Windows7 here.

Although this has been demonstrated on a freshly infected system and wanakiwi was run as soon as the ransomware had completed encryption, I am not sure if any cases have been reported yet of wanawiki successfully working in a real life situation...

Can't boot to Windows but need some important files?

Scenario

• You are given a Windows computer which will not boot to Windows any more.
• You have tried to boot to Recovery Media/ISO and repair it, but it did not work.
• The NTFS filesystem and memory seem to be OK (you ran memory test and chkdsk).
• The issue seems to be that the Windows OS is broken.
• The internal hard disk is pretty full, so you cannot install a second copy of Windows as there is not enough free file space.
• The customer wants only a small number of certain important files recovered from the hard disk, but he doesn't know exactly where they were stored. The customer does remember a bit of the file name as does know that he used MS Word to edit the documents.

Your Mission (should you decide to accept it), is to backup those important files to an offline USB drive before you start messing around with the customers OS or the files on his hard disk.

Discussion

At this point, you could decide to take an image of the internal hard disk using any decent backup package. This is a very sensible thing to do, but it will take a while.

Install proxmox v4 from E2B

After a LOT of problems, I have managed to work out how to install the later versions of proxmox from E2B direct from the ISO file.

You will need to make a .mnu file.

See the bottom of this old post for details.

E2B v1.92 officially released

v.1.92 is now officially released.

Changes are listed here.

Add a BitLocker encrypted Windows 10 To Go OS to Easy2Boot

Windows 10 1703 (Build 15063) or later will mount all formatted partitions of a USB Removable media Flash drive.

This means we can not only boot from a flat-file installation of Windows 10 now, but because we can create a multi-partition USB flash drive, we can also encrypt the Windows volume using BitLocker.

Windows 10 will allow us to MBR-boot (not UEFI-boot) to an encrypted volume either by entering a short password (e.g. 8 characters or more) or by inserting a USB flash drive containing a .BEK key file for the encrypted volume.

E2B v1.92l and MPI Tool Pack 074 now available

I am hoping to release this as v1.92 Full Release version in a few days!

Includes latest grub4dos 0.4.6a (hopefully with all bugs fixed!).

MPI v0.074 has improved detection of the isolinux version.

Alternate OneDrive Download Area

Adding the HP PC Hardware Diagnostics 3-in-1 USB Key to E2B

The HP Vision Diagnostics ISO can be added to an E2B Removable USB drive if you use the .ISOPE01 file extension. It will boot straight to WinPE and you should briefly see the blue console shell window which will load the ISO as a virtual drive and allow it to find the drivers and diagnostic programs inside the ISO.

If you have a E2B HDD, you will need to convert the ISO to a FAT32 .imgPTN file (or if you boot it as .isoPE01, you could use the SHIFT+F10 key and run \_ISO\e2b\firadisk\LoadISONP.cmd from the E2B USB drive to load the ISO file as a virtual DVD to allow the diagnostic files to be seen).

The HP PC Hardware Diagnostics 3-in-1 USB Key software however, does not come as an ISO file.

Here is how to add it (or the Vision Diagnostics ISO) to E2B.

Add DLC Boot 2016, 2017, 2019 and 2022 to E2B

'DLC Boot 2016 v3.2' .rar file (Build 160727) can be downloaded from the official dlcboot.com site.
As it contains copies of Windows and other licensed utilities, you should ensure you have the appropriate licences (or morals) before you use it however!

DLC2019 video with download links.

See end of page for DLCBoot 2022 .imgPTN instructions.

After unpacking the .rar file, you can run DLCBoot.exe from Windows as Administrator to either create a new bootable USB flash drive (use FAT32 for UEFI x64 booting) or a bootable ISO file or run any of the tools directly.

Run as Admin and click the CD icon to make an .ISO file

E2B v1.92k BETA now available (fixes problem when formatting as NTFS)

I had problems formatting a new USB drive using Make_E2B.exe today and discovered Windows 10 Creator is still causing RMPartUSB problems due to it recognising all partitions on a removable USB drive.

There is now a new version of RMPrepUSB and RMPartUSB (v2.1.739A) and the E2B download has also been updated. If you still get any problems making an NTFS E2B drive, please let me know!

• Google Drive download area
• OneDrive download area

Add ASCII art to E2B

If you have a text file which contains ASCII art, you can display it on the E2B boot screen by adding this line to your \_ISO\MyE2B.cfg file:

cat /%grub%/ASCII_E2B.txt && pause --wait=1 > nul

This will display the text file briefly as E2B boots...

The next version of E2B will contain the ASCII_E2B.txt file (but you have to add the line into your MyE2B.cfg file to see it).




If you are displaying lines longer than 79 characters, you will need to switch to 800x600 first to change from the initial boot screen resolution of 640x480 (80x30 characters).

graphicsmode -1 800 ;; cat /%grub%/ASCII_E2B.txt && pause --wait=1 > nul

Make your own ASCII art

Add netboot.xyz to E2B and PXE boot

If you want some of the payloads mentioned below (see list), but don't have room on your E2B drive for all of them and you can always boot on a system which has fast internet access, you can add the small kernel 339KB netboot.xyz.lkrn PXE boot file (or the iso) to your E2B drive and get all of them!

netboot.xyz.iso now also supports UEFI booting - see FAQ for full list.

E2B v1.92j available

Changes from 1.91B (changes from v1.92h are in bold)

• Ukrainian language added (thanks to 'ruffian')
• Small bugfix to XPWINNT.g4b to allow SVR2016 folder to be selected
• New Make_E2B to add Ukrainian and Vietnamese language support
• Check added in Make_E2B_USB_DRIVE.cmd to check Windows find command is working
• Revised English F1.cfg help file
• New version of RMPartUSB to format the 2nd small hidden partition to prevent Win10 Format pop-up dialogue box and also sometimes failing to format as NTFS
• Bugfix to XP DPMS2 for AMD chipsets - was sometimes getting wrong PCI ID and hence wrong driver
• New \_ISO\PimpMyDrive.cmd to add extra options to Main menu
• UtilMan account hack XML and CMD files added to new \_ISO\docs\utilman folder
• Delay added to linux fmt.sh scripts after parted command, 
• WinLite10 Sample XML files added
• \_ISO\mybackground.jpg will be used if \_ISO\mybackground.bmp is not present
• \_ISO\docs\SysInfo\SysInfo2.hta added for convenient way to get system info under Windows
• Commodore PET theme added into Templates and mythemes folder
• New SanFrancisco Bridge default wallpaper
• New \grldr grub4dos 0.4.6a 2017-05-05
• Improved Utilities Menu - list files and dirs menus
• Change to .cmd files to use PowerShell to run as Admin if available (MAKE_DRIVE_CONTIGUOUS.cmd now only requires one UAC prompt)
• SDI version updated
• Vietnamese language added (thanks TN)
• Strings.txt language files changed to add new 'List files' string

E2B v1.92i available

This version has a new version of grub4dos (\grldr) which has a nice new vol command, so I have also tweaked the UTILITIES menu commands for  'ls (DIR)' and 'List BIOS Disks' to improve the text output and show the volume labels.

I have also tried to improve some of the .cmd scripts which require Admin access so that they will now use Powershell to request Admin access (if Powershell is available). I have tested it on XP, Win7 and Win10 so I hope that I have not broken anything! The main advantage is that the MAKE_THIS_DRIVE_CONTIGUOUS.cmd script now only gives you one UAC prompt instead of two.

Let me know if you find any issues.

Running a .cmd script with Admin rights

If you are interested, I used this single line near the top of each .cmd file

if not "%1"=="am_admin" call powershell -h | find /i "powershell" > nul && if not "%1"=="am_admin" (powershell start -verb runas '%0' am_admin > nul & exit)

The extra code is added so that under WinPE and WinXP, it does not just abort with a 'bad command' error if 'powershell' is not understood.

It checks to see if PowerShell is present and if so, it runs itself again using runas, so the beginning of the script actually runs twice.

E2B v1.92i

E2B v1.92h Beta available (Release Candidate)

1.92 will be fully Win10 Creator update compatible (I hope), so I am keen to release it soon.

Changes from 1.91B are:

• Ukrainian language added (thanks to 'ruffian')
• Small bugfix to XPWINNT.g4b to allow SVR2016 folder to be selected
• New Make_E2B to add Ukrainian lang
• Check added in Make_E2B_USB_DRIVE.cmd to check Windows find command is working
• Revised English F1.cfg help file
• New version of RMPartUSB to format the 2nd small hidden partition to prevent Win10 Format pop-up dialogue box and also sometimes failing to format as NTFS
• Bugfix to XP DPMS2 for AMD chipsets - was sometimes getting wrong PCI ID and hence wrong driver
• \_ISO\PimpMyDrive.cmd to add extra options to Main menu
• UtilMan account hack XML and CMD files added
• Delay added to linux fmt.sh scripts after parted command, 
• WinLite10 Sample XML files added
• \_ISO\mybackground.jpg will be used if \_ISO\mybackground.bmp is not present
• \_ISO\docs\SysInfo\SysInfo2.hta added
• PET theme added into Templates and mythemes folder
• New SanFrancisco Bridge default wallpaper

Please download and test it and let me know if you find any problems before I release it officially in a few days as version 1.92.

E2B v1.92g BETA available

This version has a few small tweaks to Utilman scripts and a new default wallpaper.
The XML files for UtilMan now start with 'UtilMan - xxxxx.xml' so that they are listed together in the E2B XML menu list. If you see four Utilman XML files, delete the ones which do NOT start with 'UtilMan - '

Let me know what you think of the new default wallpaper... ;-)

P.S. A variety of 800x600 jpg wallpapers are available in the Alternate Downloads Area - Themes  folder at WallPapers800x600.jpg.zip. if you copy these to the \_ISO folder and use the Change Wallpaper_JPG.mnu file, you can try them out.

XML file for WinLite10

WinLite10 v7.2 for Win10 1703 Build 15063

Alacran (on reboot.pro) has notified us of a few .cmd scripts available from 'sickdroid' (or Felix Wiegand) which can remove many non-essential Windows components such as Cortana, etc. during a fresh installation of Windows 1703.

You can automatically run the rmApps.cmd script during installation of Windows 10 as follows:

Commodore PET 40 year anniversary theme for E2B

The Commodore PET was first announced, and later released, in 1977 (40 years ago).

It was a complete All-In-One computer with built-in keyboard, monitor and storage media and was months ahead of the Apple II or TRS80 (Trash80!). In essence, it was an early Macintosh and was one of the first computers suitable for business use, rather than hobbyists.

On a side note, the PET never really took off in France for some reason (apparently 'pet' is slang for another word!). Later, Commodore released the VIC, which did not sell too well in Germany either, as it sounded like you were asking for a 'fick' which is German for something quite different!

At the time, my family ran a small 12th-Century hotel in Oxford, now made famous by my late friend Colin Dexter, who wrote the world famous Inspector Morse books (Colin reviewed examination papers with his colleagues, ate, drank and sometimes slept at our hotel). Our hotel was even featured on the front cover of one of the paperback versions of 'The Secret of Annexe 3'. Colin even gave me a few first edition signed copies of various Inspector Morse books over the years, which I guess must be worth a few pennies now!

When I was a boy, I was interested in computers and had built and programmed several of my own, but I really wanted a new Commodore PET...

Now, payroll software for the PET was non-existent at that time, but in early 1978 I persuaded my father to buy me a new PET, on the promise that I would write a complete staff wages program for the hotel. I explained that this would save him hours of pouring over his H.M. Gov tax tables and Kalamazoo wages sheets every week to work out the pay packets for the 12+ staff we had working at the hotel!

E2B v1.92f with revised UtilMan hack

E2B v1.92f has a slightly different and easier implementation of the UtilMan hack now.

Steps 3 and 4 have been reversed and there is much less typing for the hacker!

Basically the process is now:

1. Boot to E2B Win 10 ISO and choose Hack Windows (UtilMan.exe).xml to patch the .exe files.

2. At Windows login screen press WIN+U and type 2 [ENTER] to make the ADMIN account.

Now play around as you like!

3. At Windows login screen, press WIN+U and type 3 [ENTER] to delete the ADMIN account.

4. Boot to E2B Win 10 ISO and choose UnHack Windows (restore UtilMan.exe).xml to unpatch the .exe files.

I have updated the previous blog post to describe the steps in more detail.

P.S. It seems MS have broken SFC now so it is unable to repair utilman.exe and sethc.exe! For the last 4 weeks or so, SFC has not been able to repair some files and complains about corrupt source files, i.e. it does not recognise the files in its own WinSXS folders - probably because they were not updated by the recent Windows updates - but hey, it only affects millions of people all over the world and Microsoft cannot possibly afford to validate it's own software or respond to bug reports!

Hack any Windows OS - UtilMan scripts now added to E2B v1.92f

Note: This blog post has been changed to match E2B v1.92f and later versions of E2B! v1.92f is now even easier to use than v1.92e!
For updated details, go to the Easy2Boot website page here.

As you may know, if you have not encrypted your Windows OS with BitLocker, it is quite easy to get into your OS by using the trick of replacing UtilMan.exe and\or SetHC.exe with Cmd.exe.

Once you have done this, you can hit WINKEY+U or press the SHIFT key five times to bring up a Windows cmd shell box with full admin rights! You can then create a new Admin account and log into Windows.

This is especially useful if you have a system handed in for repair and the client does not know or remember any of the Admin account passwords.

To semi-automate this process and save some typing, E2B v1.92e now contains a new \_ISO\docs\utilman folder which contains four .cmd script files.

E2B v1.92c Beta available (with PimpMyDrive.cmd!)

v1.92c has a few, very small changes and also a new file has been added - \_ISO\PimpMyDrive.cmd.

This script must be run from the E2B drive. It copies a selection of Sample mnu files to the \_ISO\MAINMENU\PIMP folder.

Note that the Change Theme menu requires the current \_ISO\MyE2B.cfg file to be overwritten - so take a backup of the MyE2B.cfg file first (the script will take one backup for you)!

The extra menu items that are added can be see in the screenshot above menu items #1 to #21.

SysInfo2.hta - an hta Windows script to quickly collect System Information

Some years ago I developed a .hta script in VBScript to collect system information. This was used on thousands of systems by field engineers and customers alike, so that they could quickly send a report back to the office techs for further diagnosis and investigation.

You can run SysInfo file on any Windows system that allows .hta files and VBScript to run.

If you download and unzip it, make sure Properties - UnBlock is ticked or Windows may prevent you from running it.

I have slightly revised it now for Windows 8 and 10 and also tweaked the email facility so that you can send the report, using your gmail account, to yourself or to someone else.

You can easily modify it to display your own company name in a heading, etc.

RMPrepUSB v2.1.737 and 738 for Windows 10 Creator now available

If you tick the RMPrepUSB option Boot as HDD (C: 2PTNS) then RMPartUSB will create a second 31.5KB partition at the end of the drive. The type is 21hex which no previous Windows OS has ever recognised... until now!

This 2nd partition is only present because some BIOSes will boot a single-partition Removable USB drive as a floppy disk instead of a 'hard disk' and thus you just get a 'black screen - flashing cursor' when you try to boot from the drive. The presence of a 2nd primary partition ensures that even these BIOSes will boot from the Removable USB drive as a 'hard disk' hd0 instead of fd0.

Under all previous versions of Windows, this 2nd partition was not detected by Windows and was not given a drive letter.

However, in recent versions of Windows 10, Microsoft has changed the way Windows detects primary partitions on Removable drives such as Flash Memory devices (and without actually telling anyone!). Now we can have multiple partitions on USB flash drives - we can even boot WindowsToGo 10 Creator version from a flat-file (non-VHD) Removable flash drive now!

The means that now, if you use RMPrepUSB or RMPartUSB to format a drive with the Boot as HDD option ticked, the new Windows 10 will now 'see' the 2nd partition as an unformatted volume and prompt the user to format it!

v2.1.737 now formats the 2nd partition as a small FAT12 volume. Windows will give it a drive letter and you can even store files on it (though it is only 11.5KB in size after formatting!). Note that if you connect the same USB drive to a pre-Windows 10 Creator version of Windows, you will not see the 2nd partition though!

The download page is here.

I found a problem in that RMPartUSB would get confused because it would see two drive letters after partitioning the drive and sometimes chose the wrong drive letter to format as NTFS. v2.1.738 now fixes this (it ignores the small partition).

Please report any issues ASAP.

Easy2Boot v1.92b available

E2B v1.92b BETA is now available from OneDrive here.

Changes from v1.91B are (changes from 1.92a in bold):

• Ukrainian language added (thanks 'ruffian')
• small bugfix to XPWINNT.g4b to allow SVR2016 folder to be selected
• new Make_E2B to add Ukrainian lang, 
• check added in Make_E2B_USB_DRIVE.cmd to check Windows find command is working, 
• revised English F1.cfg help file, 
• new RMPartUSB to format the 2nd small hidden partition to prevent Win10 Format pop-up dialogue box
• bugfix for XP DPMS2 sometime getting wrong PCI ID and hence using the wrong driver

An E2B user contacted me to say that XP installs from ISO did not detect his internal hard disk on his HP G62 AMD notebook. I bought a G62 notebook from eBay, found the issue and fixed it.

If anyone in the UK wants a silver HP G62-a17SA, Win 10 Home 64-bit, AMD Athlon II P320 2.10GHz, 320 GB 7,200 rpm HDD, 4GB RAM, HDMI, Enet, webcam, WiFi, DVD R/W, USB 2.0 x 3, good battery, with WPS Office, very nice and clean, very few scuffs (looks almost unused), for £150 ono - let me know!


You can update your current E2B DPMS USB drives using this new Beta version.


The next BETA will include the latest version of grub4dos which hopefully has all the niggly bugs fixed now.