What it is
Early Launch Anti-Malware (ELAM) is a Windows feature that lets your security software start first during boot. By loading a tiny anti-malware driver before most other drivers, ELAM can block boot-time threats (like rootkits) before they take hold.
Why it matters
Boot-level malware hides under the OS and can dodge normal scans. ELAM flips the script: your defender wakes up first, checks what’s trying to start, and stops known-bad drivers from ever loading.
How it works
-
Early start: an ELAM driver is loaded at the very beginning of boot.
-
Classify drivers: when other drivers try to load, ELAM tags them (good/bad/unknown).
-
Block or allow: known-bad gets blocked; known-good loads; unknown can be allowed with caution or policies.
What you might notice
-
A one-time boot warning if a suspicious driver was blocked.
-
Cleaner restarts after removing stubborn infections that used to come back.
Quick check on Windows
-
ELAM is built into modern Windows and works with compatible security products.
-
Keep your security app updated and Secure Boot enabled in firmware/BIOS for the best protection.