I have been researching a way to add the new Microsoft offline security scanner to the bootloader on windows 7. Allow security scanner to be used when a machine is possibly infected. Visual BCD may do it. I was wondering if anyone has accomplished this as yet?

Boot Loader (thanks AslVG)
(source: askvg.com)

  • I hate when people ask me "why" I want to do something this way, but I can't help myself - sorry. Wouldn't it be a lot safer to boot from a non-writable live cd in case of an infected machine/disk? And to your question - you can certainly create another boot partition and do this. You could perhaps build it with BartPE and add the tool you want there. problem is the scanner changes all the time. How would you keep it current? – uSlackr Feb 8 '12 at 23:50
  • good point. yes typically you could load it via usb or livecd. usb allows for the updates that the tool can do. So the updates is the cool feature. you could boot into the tool and get updates via wireless or wired connection and then run the tool locally. – mikedopp Feb 8 '12 at 23:58
  • However you do have a good point about a hard drive being infected. I guess it would depend on the situation but it might be a useful tool to have handy. just sayin' – mikedopp Feb 8 '12 at 23:59

Technical answer:

The "list" object (ToolsDisplayOrder element) is of the same type as the "loader list" object (DisplayOrder element).

DisplayOrder and ToolsDisplayOrder elements belong to {bootmgr} object and make up Windows Vista/7/8/10 "boot menu".

These elements are lists of GUID's - unique identifiers of objects in Windows BCD.

You can add any BCD object of type application to ToolsDisplayOrder or DisplayOrder using Visual BCD Editor or bcdedit.

Application objects have a type of 0x1.........

Visual BCD Editor displays all properties of BCD elements and objects so advanced users can easily distinguish what is what.

Less advanced users could get a basic understanding of BCD using a short introduction to Windows BCD structure, objects and elements.

The Microsoft reference for Windows BCD is for more advanced users.

A special hidden partition could be used for installation (copy) of a standalone (offline) security scanner. The security scanner should be able to update its virus signatures on run so the whole exercise would have a meaning. This offline scanner should also check itself on start so infection could be signaled !

Every product which can start from a CD/DVD/USB could be installed to a disk partition and later chain loaded from Windows 7/8 boot manager (assuming MBR partition style disk).

The UEFI implementation of Windows boot manager limits the loadable applications to Microsoft EFI applications (and GPT style disks). (But, you can load any EFI application using UEFI firmware boot manager.)

| improve this answer | |
  • I don't think secure boot would let it scan its own bootsector, you would need an offline tool for that. – Jim B Aug 11 '15 at 4:01
  • Secure boot is does not use boot sectors - UEFI firmware boot manager loads an EFI application (OS "loader" or OS "manager") from EFI System Partition directly. The whole chain of loaded OS executables, libraries and drivers is signed so the chain is secure (including firmware boot manager). – snayob Aug 12 '15 at 20:36

The whole point of an offline security scanner is to be (oddly enough) offline. You could probably create a vhd and add an entry with bcdedit (or visualbcd), or a separate partition and add a boot entry but from an infection standpoint I wouldn't consider it trustworthy.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.