Presentation of Malekal Live CD (Win7PESE) features

1.1.11. RogueKiller

In the "RogueKiller" category of the start menu, you will find the "RogueKiller" program.
Note that you can start RogueKiller in 2 ways :

• RogueKiller (without driver) : launch RogueKiller without its drivers.
  Which is handy if RogueKiller doesn't launch properly in normal mode.
• RogueKiller : launch RogueKiller in normal mode (loading its drivers when the program starts).

RogueKiller is a program that scans your computer's processes, registry, hosts file, files, ... for malware (malicious software) and rootkits (malicious software hidden in Windows startup).

Note : the secure boot supported by the EFI firmware of recent motherboards makes it possible to protect against rootkits, since the entire boot chain must be signed and this is checked at each boot.

Once RogueKiller is fully launched, you will need to accept the terms of this program to use it.
Click on the button on the left to accept them.

All you have to do is click the "Scan" button to perform a scan with Rogue Killer.

1.1.12. System Tools

In the "System Tools" category of the start menu, you will find shortcuts to :

• FireWall Disable : allows you to disable the firewall of the Windows PE environment where you are.
• FireWall Enable : allows to enable the firewall of the Windows PE environment.
• MountStorePE -RL : allows you to launch the MountStorePE utility below with the "-RL" options.
• MountStorePE : allows the use of USB devices (such as external hard drives) plugged in after the Windows PE environment boots.
• Startup Repair (Win 7) : allows to launch the "Startup Repair" tool of the Win RE environment of Windows 7.
• Synchronize Letters : allows you to quickly change the letters assigned to the different partitions.
• System Recovery : allows access to the "System Recovery Options" of the Win RE environment of Windows 7.
• Registry\RegShot2 : allows you to take images of the registry to quickly find the changes made to the registry.
• Registry\Remote Regedit : allows you to edit the Windows PE environment registry.

Mount Storage PE will allow you to mount partitions not currently accessible.

The "Startup Repair (Windows 7)" shortcut corresponds to the "Startup Repair" tool.

Once the wizard has attempted to repair Windows 7 startup, all you have to do is click : Finish.

The "System Recovery" shortcut corresponds to "System Recovery Options".

Select your Windows 7 installation and click Next.

The "Regshot" program will allow you to make snapshots (images) of the registry to easily find the changes that have been made to it.

The "Remote Regedit" shortcut allows you to open the registry editor to modify the registry of the Windows PE environment where you are.