Loading...

Knowledge Center


How to create a Windows XP boot CD including McAfee Command Line Scanner using BartPE
Technical Articles ID:  KB67088
Last Modified:  07/24/2013
Rated:


Environment

McAfee VirusScan Command Line Scanner 6.x
Bart's Preinstalled Environment (BartPE) bootable live Windows CD / DVD 3.1.10a or later
Microsoft Windows XP

Summary

When dealing with a suspected virus, you need to clean a computer properly by starting from a non-infected disk. This article supplies all the information required to create a McAfee BartPE Preboot Environment. You can use the CD to create a clean boot environment after a (suspected) virus infection. 

Solution

Use the following steps to create a Windows XP boot CD including McAfee Command Line Scanner using BartPE:

CAUTION: This solution is largely based on non-McAfee software and is not supported by McAfee. Usage of this article is entirely at your own risk. McAfee accepts no responsibility for any direct or indirect damage.

  1. Obtain the necessary software:
    1. Download BartPE from http://www.nu2.nu/pebuilder/#download.
    2. Download the latest McAfee XDAT:

      To download a DAT, Engine, XDAT or Stinger, go to http://www.mcafee.com/apps/downloads/security-updates/security-updates.aspx.

      You might have to download these if your automated update fails or if you want to use an ExtraDAT on an infected system.
       

       
    3. Download the latest version of McAfee VirusScan Command Line Scanner.

      McAfee product software, upgrades, maintenance releases, and documentation are available from the McAfee Downloads site at: http://www.mcafee.com/us/downloads/downloads.aspx.

      NOTE:
       You will need a valid Grant Number for access. KB56057 provides additional information about the McAfee Downloads site, as well as alternate locations for some products.

      If you are not licensed to use Command Line Scanner, contact McAfee support for assistance. For contact details, see the Related Information section.
       
    4. Obtain the relevant licensed Windows XP SP1 (or later) CD for the computer affected.

      NOTE: If the disks of your computers are not local (for example: NAS, SAN, or RAID storage), you may need additional drivers. Some drivers can be obtained from: http://www.nu2.nu/pebuilder/drivers/
       
  2. Set up BartPE:
    NOTE: BartPE allows you to read NTFS drives without having to start up the computer's operating system. This means no files on the infected drive can be in use, which makes spyware and virus removal easier.
     
    1. Create an installation folder called Barts PE.
    2. Copy the downloaded, self-installing package or ZIP file to the new folder, run it, and set the installation directory for the same folder.
      NOTE: Alternatively, you can extract the ZIP file into the Barts PE folder. 
       
    3. Copy the entire contents of your XP CD to:  \Barts PE\XPCD
    4. Copy the latest XDAT to: \Barts PE\plugin\McAfee\files\
       
  3. Extract the XDAT file:
    1. Click Start, Run, and click Browse.
    2. Navigate to the \Barts PE\plugin\McAfee\files\ folder and select the XDAT file.
    3. Add  -e  to the end of the existing name and click OK.
      This will tell the XDAT file to extract to its current location, as opposed to looking for a McAfee product to update. You can delete the XDAT file when you are done.

      NOTE: XDAT does not contain the scan Engine components mcscan32.dll and config.dat. These Engine components are part of the Command Line Scanner package.
       
  4. Use the McAfee Command Line Scanner executable:
    1. Launch Windows Explorer.
    2. Locate the downloaded Command Line Scanner package.
    3. From the downloaded Command Line Scanner package, copy scan.exe, config.dat, license.dat, license.txt, mcscan32.dll, and signlic.txt.
    4. Navigate to the \Barts PE\plugin\McAfee\files\ folder and paste the copied files.
       
  5. Build the .ISO image:

    1. Launch pebuilder.exe to build the image.
    2. In the welcome screen, click Next.
    3. Select the directory you have copied the XP files to (\Barts PE\XPCD) and click Next.
    4. To add the plugin, highlight McAfee VirusScan for Win32 and click Enable/Disable until the Enabled option on the right side of the window is set to Yes.
    5. Click Next.
    6. Type the name of the Output directory and the location where you want to store the .ISO image, and then click Next.
      NOTE: Creating the .ISO image may take some time.
       
  6. Burn the .ISO image.
    Refer to your CD burning software documentation for instructions.
     
  7. To use Bart PE boot disk:
    1. Start the computer from CD/DVD.
    2. Open the menu from the bottom left side. From the menu, select McAfee VirusScan GUI Wrapper.
    3. Under What to scan, minimally select the following:
      • Scan all local drives       
      • Scan subdirectories
         
    4. Under Action, select Clean viruses from infected items.
    5. Under Report, select:
      • Report to file
      • Include corrupted files
      • View report after scan
      • Include errors 
         
    6. Set the report name and location.
    7. Click Scan.

Rate this document

Did this article resolve your issue?

Please provide any comments below

Glossary of Technical Terms


Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.
United States - English
© 2003-2013 McAfee, Inc.