Removing a BCD-Based Rootkit From Windows Safely

A rootkit that abuses Windows Boot Configuration Data (BCD) can start before ordinary security software, giving it a chance to hide drivers, alter startup behaviour, or reinstall other malware. Because the infection may affect the EFI System Partition or boot manager, careless deletion can leave the computer unable to start.

This guide is intended for Windows users who need a careful, evidence-based cleanup process. If the machine contains business records, cryptocurrency wallets, health information, or other irreplaceable data, disconnect it from the network and consider a qualified incident-response technician before making changes.

Approach	Best use	Main limitation
Defender Offline scan	Detecting boot-level malware	May not repair damaged boot files
BCD inspection and repair	Removing unauthorised boot entries	Incorrect commands can prevent startup
System restore or recovery	Reversing recent configuration changes	Restore points may be infected or unavailable
Clean Windows installation	Persistent or confirmed rootkits	Requires backups and application reinstallation

Recognising Boot-Level Rootkit Symptoms

Warning signs include a new boot entry, an unfamiliar .efi or .exe path in startup settings, security tools that stop working, or Windows starting through an unexpected loader. Repeated reinfection after a normal malware scan is especially concerning. Sudden changes to Secure Boot, BitLocker recovery prompts, or firmware settings also deserve attention.

Some symptoms have less serious explanations. Slow performance can come from a cryptocurrency miner, while unwanted advertising may be caused by browser extensions or hidden adware. For comparison, this guide to hidden video adware covers a different type of persistence that does not normally alter the boot chain.

Protecting Data Before Cleanup

Disconnect Wi-Fi and unplug Ethernet, then use a separate, trusted device to change important passwords. Avoid logging into banking, myGov, email, or work accounts from the affected computer. Australian households commonly rely on NBN connections and shared family PCs, so check other devices on the same network if suspicious activity appeared across several machines.

Back up personal documents to a clean external drive, but do not copy unknown programs, scripts, cracked software, or boot files. Record the Windows edition, encryption status, and recovery keys. If BitLocker is enabled, make sure its recovery key is available through the Microsoft account or the organisation’s management system before altering boot settings.

Entering Windows Recovery Environment

Open Settings, choose System, Recovery, and Advanced startup, then select Restart now. If Windows will not load, interrupt startup two or three times or boot from a genuine Windows installation USB and select Repair your computer. Choose Troubleshoot, Advanced options, and Command Prompt.

In Recovery Environment, drive letters can change. The Windows installation might be D: rather than C:. Use diskpart, then list volume, to identify the Windows volume and the small FAT32 EFI partition. Type exit when finished. Do not format any partition at this stage; confirm its size, file system, and role first.

Inspecting BCD Entries Carefully

At Command Prompt, run:

bcdedit /enum all /v

Look for entries that point to an unfamiliar volume, a strange directory, or a file outside the normal Windows and recovery paths. Save the current configuration before making changes:

bcdedit /export C:\BCD-backup

The letter may need to match the Windows volume identified earlier. Do not delete an entry solely because its identifier looks unfamiliar; recovery, diagnostic, and vendor entries can be legitimate. Photograph or copy the output so a technician can review it if the system becomes unbootable.

Scanning Outside the Installed System

Return to Advanced options and choose Microsoft Defender Offline scan if it is available. This restarts the computer into a trusted scanning environment, allowing Defender to inspect files before the usual Windows processes load. Apply all available security intelligence updates first, if the recovery environment provides network access.

A second opinion from a reputable vendor’s rescue medium can help identify a bootkit that Defender misses. Create rescue media on a clean computer, verify the download source, and boot from it using the temporary boot menu. Avoid random “rootkit remover” utilities advertised in pop-ups, including those seen on sites targeting users in Sydney, Melbourne, or Brisbane.

Rebuilding the Windows Boot Path

If the BCD is clearly damaged or contains a confirmed malicious loader, use the recovery tools conservatively. First try:

bootrec /scanos
bootrec /rebuildbcd

If the installation is not detected, the EFI partition may need to be mounted and the boot files recreated. After identifying the EFI volume, assign it a temporary letter in DiskPart, then use a command such as:

bcdboot D:\Windows /s S: /f UEFI

Replace D: and S: with the verified Windows and EFI letters. This recreates legitimate boot files; it does not remove every malicious file from the EFI partition. If an unknown .efi file remains, do not delete it blindly. A clean reinstall is safer than guessing, especially on a work laptop managed under the Australian Essential Eight framework.

Confirming the Machine Is Clean

Restart with the network still disconnected and check that Windows loads normally. Re-run Defender, inspect bcdedit /enum all /v, confirm Secure Boot is enabled in firmware where supported, and install current Windows updates. Review installed applications, scheduled tasks, services, browser extensions, and local administrator accounts for changes made during the infection.

If suspicious processes return, the boot entry reappears, or security software is disabled again, treat the compromise as persistent. Miners often return after incomplete cleanup; guidance on cleaning mining malware explains a related recovery situation. For a home user, wiping the system drive and reinstalling Windows from official media is usually more dependable than repeatedly removing individual files.

Preventing Another Boot Compromise

Keep Secure Boot enabled, use a standard user account for daily work, and install software only from official publishers. Turn on automatic updates for Windows, browsers, firmware, and security tools. Do not disable antivirus because an installer or game crack requests it, and avoid opening unexpected attachments claiming to be from Australia Post, myGov, or a bank.

After recovery, review Microsoft account sign-in activity and change passwords from a known-clean device. Businesses should preserve logs and contact their IT provider or the Australian Cyber Security Centre for appropriate reporting guidance. A tested backup, application allowlisting, and phishing-resistant multifactor authentication provide stronger protection than relying on a single malware scan.