What to do when a rootkit corrupts Windows boot data

When a rootkit corrupts the Windows boot configuration data and prevents booting, the first priority is to stop the malware running again while protecting files that may still be recoverable. A missing boot manager, repeated returns to a recovery screen or altered startup behaviour can signal damage to the Boot Configuration Data (BCD), although failed updates and failing storage can produce similar symptoms.

Treat the computer as contaminated until it has been scanned outside Windows and the operating system has been repaired from trusted files or rebuilt. Avoid repeated startup attempts, factory resets and repartitioning until recovery keys are secured and important data has been assessed. For a workplace device, preserve its condition and involve IT or an incident-response provider before making changes.

Identify what has failed

A rootkit may hide processes, intercept kernel operations and alter boot components before ordinary security software loads. An in-Windows scan may therefore report a clean system while the compromise remains. Separate symptoms from guesses: note whether the machine reaches Windows, whether the storage is detected in the BIOS/UEFI setup screen and whether a USB containing trusted recovery files behaves normally.

Check event logs only from a trusted environment, if accessible, and record error codes rather than repeatedly testing the damaged installation. A rootkit diagnosis matters because repairing the BCD can restore startup without removing the hidden component that caused the damage.

Contain the infected machine

Disconnect Ethernet, disable Wi-Fi and unplug external drives, backup disks and memory cards. If the machine restarts in a loop, leave it powered down rather than allowing another infection to execute. Keep suspect USB media quarantined; inserting it into a second computer can transfer the problem.

Create current Microsoft installation media on a separate trusted computer, then boot the affected PC from it. Disconnect its internal data drive while doing so if practical. In shared offices across Sydney, Melbourne and Brisbane, quarantine any USB device or portable backup drive that was connected during the incident, and use a clean spare drive for recovery files.

Rebuild the boot configuration

From the Windows installer, choose Repair your computer, then Troubleshoot, Advanced options and Command Prompt. Run bcdedit /enum and record the Windows volume, EFI system partition, boot identifiers and firmware type. If the original BCD is readable, preserve a copy for examination; do not replace it with a BCD taken from another PC.

For UEFI systems, assign the EFI system partition a temporary letter and rebuild the Windows boot files with a matching bcdboot command, such as bcdboot C:\Windows /s E: /f UEFI, after confirming the actual volumes. Legacy BIOS systems need the BIOS equivalent. Avoid mixing UEFI and BIOS instructions, and do not erase the EFI partition or run disk-format commands while trying to repair entries.

Protect recoverable files

Data recovery and malware cleanup are separate tasks. For business-critical files, ask a recovery professional to create a sector image and work on that copy. Avoid chkdsk on a drive making clicking noises, showing new bad sectors or holding the only copy of important data, because repair writes can destroy recoverable information.

Retrieve any BitLocker recovery key before altering encrypted volumes; your Microsoft account, administrator or printed escrow record may hold it. If files are also encrypted, treat the incident as ransomware alongside the rootkit and follow the site's external drive recovery guidance before writing to the disk. Keep the affected drive disconnected until a clean recovery environment is ready.

Remove persistence and exposed access

Run a reputable offline malware scanner from rescue media before returning the PC to normal use. Repairing the boot configuration does not remove a kernel-level rootkit, so a trustworthy clean installation is the safer endpoint when the compromise is confirmed or cannot be ruled out. Reinstall Windows from trusted media after files are secured, update it fully and scan recovered documents. If suspicious behaviour survives a clean installation, seek specialist analysis rather than assuming the drive alone was responsible.

Use a clean device to change important passwords, revoke active sessions and enable multi-factor authentication. If banking details were entered, contact the bank using the number on your card. For a second opinion on whether the damage involves malware or hardware, send a concise hardware and symptom summary through the site's contact page.

Australian organisations should also consider reporting the incident to ReportCyber, operated by the Australian Signals Directorate's Australian Cyber Security Centre. They should assess notification duties under the Privacy Act 1988 and the relevant privacy law in their state or territory, documenting the investigation and decisions made.

Strengthen the next clean installation

After restoration, update the BIOS/UEFI, Windows and security software, enable Secure Boot where the hardware supports it, and remove unused legacy boot options. Keep autorun disabled, use standard-user accounts for daily work and maintain tested offline or cloud backups. The site's latest security news can help identify changing risks that affect boot-chain and removable-media advice.

When replacing storage, buy from a reputable Australian computer retailer and keep the receipt because Australian consumer guarantees may apply to faulty goods. Imported hardware must meet customs requirements administered by Australian Border Force. An authorised Microsoft reseller can confirm the correct Windows edition and licensing path for your organisation.

Situation	Safer next step	Why it matters
BCD is damaged, but Windows files still boot	Rebuild firmware entries and scan offline	Restores startup without trusting the compromised installation
Important files remain on affected storage	Make an image and recover from a copy	Reduces further writes and preserves recoverable data
Rootkit indicators survive a clean installation	Seek specialist bootkit analysis	Distinguishes persistent compromise from ordinary boot damage
An encrypted volume has no working recovery key	Use a trusted backup and stop repeated repair attempts	Avoids unnecessary damage while the only copy is examined