A bootkit is malware that infects the boot process so it can run before or during the operating system startup. Because it starts so early, a bootkit may hide from normal tools, load malicious drivers, disable protections, or reinstall other malware after cleanup. Modern bootkits often target UEFI or bootloader components rather than old-style disk boot sectors.
What is a bootkit?
- A bootkit is a rootkit-style threat that compromises the boot process.
- It can start before Windows fully loads, which makes detection harder.
- Secure Boot, firmware updates, and trusted boot chains reduce risk.
- Bootkit cleanup may require offline scanning, boot repair, firmware checks, or reinstalling the OS.
Bootkit definition
A bootkit is a type of rootkit focused on boot persistence. Older bootkits often modified the Master Boot Record. Newer threats may target UEFI firmware, EFI System Partition files, bootloaders, or early startup drivers. The purpose is persistence and stealth.
| Threat | Where it hides | Main risk |
| Rootkit | User mode, kernel, boot, or firmware | Hides malicious activity |
| Bootkit | Boot process or EFI/bootloader components | Starts before normal OS defenses |
| Firmware rootkit | Firmware on motherboard or device | Can survive disk replacement in rare cases |
Possible bootkit symptoms
- Security tools fail before or shortly after startup.
- Malware returns after normal removal.
- Boot errors or unexpected bootloader changes appear.
- Secure Boot settings are disabled or changed unexpectedly.
- Antivirus reports bootkit, rootkit, EFI, or boot-sector detections.
How to protect against bootkits
- Keep UEFI/BIOS firmware updated from the device vendor.
- Keep Windows and security tools updated.
- Use Secure Boot where supported.
- Avoid cracked software, malicious drivers, cheats, and unsigned boot tools.
- Use full-disk encryption and strong account security on portable devices.
- Run offline scans if boot-level malware is suspected.
FAQ
Is a bootkit the same as a rootkit?
A bootkit is a specialized rootkit that targets the boot process. All bootkits are rootkit-like, but not all rootkits are bootkits.
Can Secure Boot stop bootkits?
Secure Boot reduces the risk by checking trusted boot components, but it is not a guarantee against every firmware or configuration attack.
Can antivirus remove a bootkit?
Sometimes, especially with offline scanning. Serious bootkit cases may require boot repair, firmware updates, or reinstalling the operating system.
Are bootkits common?
They are less common than phishing, adware, or ordinary trojans, but they are high-impact threats when they appear.
