What it is
A bootkit is stealthy malware that buries itself in the startup area of a PC (MBR/UEFI), so it runs before Windows. That early start lets it hide other malware, survive reboots, and dodge many on-device scans.
What you may notice
-
Odd boot behavior: extra delay, crashes, or unexpected reboot loops
-
Security tools disabled or detections that keep coming back after cleanup
-
BitLocker/Secure Boot warnings, or boot order changing on its own
How it works
-
Infects the bootloader or firmware so code runs at power-on
-
Hooks low-level disk or OS functions to hide files and traffic
-
Can reinstall companion malware even after you think you removed it
If you suspect a bootkit (safe cleanup)
-
Disconnect from the network; power down.
-
Scan from outside Windows using a trusted bootable rescue media.
-
Restore the boot chain: re-enable Secure Boot, repair boot records, or reinstall Windows if required.
-
Update firmware/BIOS and drivers; then rescan.
-
Change passwords from a clean device; watch accounts for alerts.
Prevent it
-
Keep Secure Boot on; prefer UEFI over legacy boot.
-
Update firmware/BIOS, OS, and drivers regularly.
-
Block booting from untrusted USB/DVD; set a BIOS/UEFI admin password.
-
Use reputable real-time protection and avoid cracked installers.
Use a trusted recovery environment
A running operating system may not reliably report a bootkit that starts before or during the boot chain. Preserve alerts and disk details, then scan from trusted recovery media or an offline security environment. Verify Secure Boot and firmware settings, install official firmware and boot updates, and do not replace boot records with commands copied from an unverified source. If integrity cannot be established, back up personal data and rebuild from trusted media. A bootkit is related to a rootkit, but its boot-stage persistence makes normal file removal especially unreliable; Safe Mode alone may not be sufficient.