Removing a rootkit that loads before the Windows boot manager

When malware infects a Windows system at a level deeper than the operating system itself, ordinary antivirus software becomes almost useless. A bootkit — a category of rootkit that activates before the Windows boot manager — sits inside the Master Boot Record, the EFI System Partition, or the boot sector of the system drive. Because it runs before any security tool starts, it can quietly patch the kernel as Windows loads, hiding its own files and registry keys from anything that comes afterwards. Learn more about What To Do When Your Email Account Is Hijacked By Malware E2dc95.

Pre-boot rootkits are not everyday consumer threats. They show up more often in targeted campaigns against companies, journalists, and government staff. Even so, plenty of Australian households have been hit through compromised driver packs, pirated activation tools, or shady USB drives handed out at trade shows in Sydney and Melbourne. The Australian Cyber Security Centre regularly flags firmware-level attacks as a growing concern in its annual threat assessments, and the trend has only accelerated over the past two reporting cycles. Learn more about Security News.

Detecting one is the hard part. You might notice sluggish startup, missing files in places that should be packed, unexplained reboots, or a Secure Boot flag mysteriously disabled in the UEFI. Some victims report strange log entries in Event Viewer pointing to drivers that never existed on a clean install, or a recovery partition that has quietly shrunk in size. Learn more about For Windows.

The good news is that removal is possible without throwing the PC out the window. With a clean boot environment, the right tools, and a bit of patience, even a stubborn boot-time rootkit can be evicted from the machine without a full reinstall.

Preparing the workspace

Before touching anything, back up what matters. A rootkit can corrupt files on demand, so do not assume the data on the infected drive is fully trustworthy. Copy documents, browser bookmarks, and important photos to an external USB drive or upload them to a cloud account you normally use. Australians often keep their photos in iCloud or Google Photos, which is fine for this step — just make sure you are signed out of every session on the infected machine before you continue.

Download the rescue tools you need on a second, clean computer. Useful packages include bootable antivirus discs from vendors such as Kaspersky Rescue Disk, Bitdefender Rescue CD, or the ESET SysRescue Live image. Burn or write them to a USB stick using Rufus on a working PC. You will also want a blank USB stick ready to reinstall Windows cleanly if the boot environment cannot be repaired, and a spare external drive for forensic images if the incident is work-related.

If your machine is a work laptop supplied by Telstra, Optus, or a state-government employer, ring the IT desk before doing anything destructive. Many large Australian organisations have an incident-response hotline, and they may want the drive imaged for forensics before you wipe it. The ACSC also publishes step-by-step guidance for businesses that suspect a deeper compromise, and reporting early often makes remediation far simpler.

Booting from a trusted environment

The whole point of a pre-boot rootkit is that it cannot be seen from inside Windows. So the first real step is to get Windows out of the picture entirely. Restart the computer and enter the UEFI or BIOS by hammering Escape, Delete, or F2 as it powers up. The exact key depends on the motherboard manufacturer, but Australian retail machines sold at JB Hi-Fi or Officeworks usually follow the standard hints shown on the splash screen.

Once inside firmware settings, disable Secure Boot temporarily. The rootkit almost certainly replaced or bypassed the existing boot loader, and a clean external environment will refuse to launch while Secure Boot is enforcing signatures. Plug in your rescue USB, change the boot order so the USB device runs first, then save and exit. The machine should now load a Linux-based scanner that has no trust relationship with the infected drive.

From inside the rescue environment, run a full scan of the system drive. A decent boot-time scanner can read the Master Boot Record and the EFI partition directly, which is exactly where this kind of malware parks itself. Let the scan finish completely. Interrupting it mid-write can leave the boot sector in a worse state than before, and you may end up with an unbootable machine on top of the rootkit.

Running dedicated rootkit scanners

Standard rescue discs catch a lot, but purpose-built rootkit tools go further. Booting into a separate utility such as Kaspersky Rescue Disk, GMER, or Malwarebytes Anti-Rootkit lets you inspect kernel hooks and hidden services the way a regular AV cannot. These utilities look for SSDT patches, inline hooks in ntoskrnl.exe, and unsigned drivers loaded from non-standard paths that would otherwise be invisible to anything running under Windows itself.

Tool	Boot environment	Detection depth	Skill level
Kaspersky Rescue Disk	Linux live ISO	MBR and EFI scanning	Moderate
Bitdefender Rescue CD	Linux live ISO	Standard AV signatures	Easy
ESET SysRescue Live	Linux live ISO	Deep boot sector checks	Moderate
Malwarebytes Anti-Rootkit	Windows PE	Kernel hook inspection	Easy
GMER	Windows PE	Low-level driver hooks	Advanced

When the scanner flags a suspicious file, do not delete it blindly. Note the path, the hash if shown, and the description. Analysts often cross-reference these findings with the ACSC's malware reporting portal or a private threat-intel feed, since some legitimate security software also installs deep kernel components. If you are confident the item is hostile, quarantine it through the scanner's interface rather than deleting it outright, so you can roll back if a false positive wipes a critical driver.

For users who already suspect their credentials were exposed during the same incident, a separate cleanup of email and cloud accounts is essential. The walkthrough on what to do when your email account is hijacked by malware covers password resets, app-specific password revocation, and inbox rule audits in detail, and it pairs well with the boot-level cleanup described here.

Rebuilding the boot environment

After the scanner reports the system is clean, the boot environment still needs attention. Boot back into the Windows installer USB, choose Repair your computer, and open Command Prompt. From there, run bootrec /fixmbr on legacy BIOS systems, or use bcdboot to recreate the EFI boot files on GPT-based machines. These commands overwrite the corrupted boot code with a fresh copy signed by Microsoft, which is essential because the rootkit will have tampered with the original files in subtle ways.

Re-enable Secure Boot once Windows starts normally. Some firmware updates released through Windows Update or the manufacturer's utility can patch vulnerabilities the rootkit originally exploited, so let those run before considering the job done. Australian households on the National Broadband Network should also be wary of routers that store boot configuration in a separate partition — if the rootkit targeted your PC through a poisoned firmware update, it is worth checking the modem as well.

Reboot several times and confirm Windows loads cleanly each time. Run a second full scan from inside the operating system to be sure nothing reappears from a hidden persistence location, and check that Secure Boot shows as enabled in the system information panel rather than greyed out.

Locking down the system going forward

A bootkit got in through something, and it pays to figure out what. Common entry points include pirated software downloaded from torrent sites, fake driver updaters promoted through dodgy ads, and USB sticks left in public places. Review your browsing history, your installed driver list, and the contents of your Downloads folder for anything unfamiliar. The security news category at PC Malware Expert tracks fresh campaigns, including several that have hit Australian government departments, healthcare providers, and small businesses in Parramatta and the outer suburbs over the past year.

Keep the motherboard firmware updated, enable Secure Boot alongside a TPM-based startup PIN where the hardware supports it, and avoid third-party PC optimiser suites that demand kernel-level access. For Windows-specific hardening, the Windows guides published across this site walk through group policy tweaks, controlled folder access, and Credential Guard settings that make boot-time tampering much harder for any future campaign.

Finally, treat unexplained boot failures as a red flag rather than a glitch. The faster a boot-level compromise is caught, the easier it is to undo — and the less likely you are to spend a long weekend rebuilding a machine that should have stayed clean in the first place.