Using Bart’s PE Builder to Make an Anti-Spyware and Rescue CD
By Adrian Crenshaw (Originally posted on IronGeek.com)

• Run Anti-Spyware tools like Ad-Aware Pro SE or HiJackThis.
• Use MSConfig to configure what apps start on login.
• Read and write to NTFS and FAT partitions.
• Edit the registry on the local hard drive.
• Copy files off of a hosed machine to another computer over the network.
• Access USB drives.
• Use MMC and Disk Manager to partition drives.
• Change local passwords.
• Defrag the hard drive with out booting from it (running defrag this way does a better job since there are no locked system files on the hard drive).
• Load the CD with SSH, Remote Desktop Client and VNC so you can use the boot CD as a workstation.
• Recover deleted files from slack space.
• Perform a byte for byte wipe of the hard drive so others can’t recover deleted files.
• Read event logs off the hard drive.
• Undo Syskey and get password hashes for later cracking if you lost a password.
• Use Internet Explorer and Firefox from the boot CD to surf the web.
• Run security tools for checking your network.
• Make a locked down web terminal for patrons. Since the CD is read only media deviant users can do little to corrupt the workstation that can’t be fixed by a quick reboot.

        One great use for a PE Builder CD is to remove spyware from a computer and that is the task that this article will focus on. A lot of spyware is hard to remove when you are running the removal tools while booted in the Windows OS from the local hard drive. Some spyware will try to reinstall itself as soon at its files or registry keys are deleted. You can get around some of these problems by running the anti-spyware tools in safe mode, but even then some spyware can find a way to keep itself alive. By booting a copy of Windows from a boot CD and running tools like Ad-Aware and HiJackThis you can eliminate this problem almost entirely.

Things you will need

        Before you can start creating your own boot CD there are a few things you will need to collect. First, get a copy of Barts PE builder from:

http://www.nu2.nu/pebuilder/

        The current version as of this writing is 3.1.3. For convenience download the EXE self extracting package and let it install to the default location (C:\pebuilder313).

        Next you need to copy the setup files from a Windows XP SP2 install CD to your hard drive. If you do not have an XP Pro CD integrated with Service Pack 2 just copy the files from the one you have and integrate SP2 yourself using the Source->Slipsteam menu option in PE Builder. I chose to copy the files to a folder called C:\WinXPProSP2-CD\ and will be using that path in this tutorial. Bart’s PE Builder comes with a lot of useful plugins but there are a few more you will want to download and setup before you begin creating your own boot CD.

        After you have setup PE Builder and copied the Windows XP SP2 files to the hard drive the next thing you need to do is download Sherpya’s XPE and Nu2XPE ShortCuts Converter v0.3 plugins from:

http://oss.netfarm.it/winpe/

        When you download them choose the CAB packages because the ZIP files are just the source code. The current version of XPE as of this writing is v1.0.2. While we are downloading third party plugins we also want to get the following packages - the Ad-Aware SE Pro plugin and the Runscanner plugin (necessary to let other plugins read the registry off of the local hard drive) from:

http://www.paraglidernc.com/

        The PE Builder package comes with an Ad-Aware Plugin, but it’s not as good as Paraglider’s. Now download the HiJackThis and MSConfig plugins from:

http://www.irongeek.com/i.php?page=security/pebuilder


Preparing to build the CD

        Once you have everything downloaded you need to extract all of the files into C:\pebuilder313\plugin\. Many of the plugins come as CAB archives so if you don’t have software to extract them just use the Add option when you select your plugins in PE Builder. Each of the plugins should come with an HTML file detailing how to install the plugin and what files you will need to copy from your system to the plugin directory, where to download them from, and where to put them. For example, Paraglider’s Ad-Aware SE Pro needs you to install Ad-Aware on your system and copy the files from “c:\Program Files\Lavasoft\Ad-Aware SE Plus\” into the “Files” folder inside of the Ad-Aware plugin’s directory. The HiJackThis plugin needs you to download the HiJackThis executable from http://www.spychecker.com/program/hijackthis.html and put it in the files folder in the HiJackThis plugin’s directory.

        Now that we have everything downloaded start up PE builder by running C:\pebuilder313\pebuilder.exe. Choose the path to the Windows XP Source Files (C:\WinXPProSP2-CD) which you copied to the hard drive earlier.

        Click on the “Plugins” button, add the plugins that came in CAB archives, and enable the plugins you wish to install (make sure all of the ones you downloaded above are enable). Disable the following Plugins so XPE will work properly:

• nu2Shell v1.0
• PE Loader 0.4
• PENETCFG: Automatically start PE Network configurator
• PENETCFG: PE Network configurator (theTruth)
• Profiles folder

        You will most likely see two Ad-Aware plugins. The one labeled as “Ad-Aware SE Pro” is the one you want enabled, make sure the plugin labeled as just “Ad-Aware SE” is disabled. Once you are done enabling and disenabling plugins click the “Close” button.

Customization

        There are a few items you will want to customize before you continue. Look in the c:\pebuilder313\plugin\xpe-1.0.2\ folder and rename “z_xpe-custom.inf.sample” to “z_xpe-custom.inf”. Open up z_xpe-custom.inf in Notepad or another text editor. By editing z_xpe-custom.inf we can change quite a few of XPE’s options. The following are some useful suggestions:

First let’s change the name displayed on start up. Find: