Blog | G5 Cyber Security

GPT Boot Virus Removal

G5 Cyber Security

TL;DR

Boot viruses on GPT disks are rare but serious. They typically infect the EFI partition. Recovery usually involves using a rescue disk or reinstalling your operating system, but attempting to repair the bootloader with tools like bootrec and checking for malicious files in the EFI partition can sometimes work.

Understanding the Problem

GPT (GUID Partition Table) is a modern partitioning scheme. Unlike older MBR systems, GPT stores boot information in an EFI System Partition (ESP). A boot virus on GPT will target this ESP to gain control during startup. Traditional boot sector viruses won’t work directly on GPT.

Step-by-Step Removal Guide

  1. Boot from a Rescue Disk: This is the safest first step. You’ll need a bootable USB drive or DVD with a trusted operating system (e.g., Windows installation media, Linux live environment). This allows you to access your system without running the infected OS.
    • Windows: Boot from the Windows installation media and choose ‘Repair your computer’.
    • Linux: Boot from a Linux live USB. Most distributions will allow you to mount your partitions and access files.
  2. Identify Your EFI Partition: Once booted into the rescue environment, you need to find the ESP.
    • Windows (Command Prompt): Open Command Prompt as administrator. Use diskpart: 
      diskpart
list disk
select disk <your disk number>
list partition
select partition <EFI System Partition number>
assign letter=Z:  (Assign a drive letter for easier access)
exit
    • Linux (using lsblk): Open a terminal and run: 
      lsblk -f

      Look for the partition with type ‘EFI System’. Note its mount point.

  3. Scan for Malware: With the ESP mounted, scan it thoroughly using an updated antivirus scanner.
    • If you have a bootable antivirus rescue disk, use that.
    • Alternatively, copy the contents of the ESP to another drive and scan them from within the rescue OS. Be careful not to execute any files directly from the infected partition.
  4. Attempt Bootloader Repair (Windows): If no malware is found or after removing it, try repairing the bootloader.
    • Open Command Prompt as administrator within the Windows recovery environment.
    • Run these commands in order: 
      bootrec /fixmbr
bootrec /fixboot
bootrec /scanos
bootrec /rebuildbcd
    • If /rebuildbcd finds your OS, add it to the boot menu.
  5. Check EFI Boot Files: Look for suspicious files in the ESP.
    • Windows: Navigate to Z:EFI<Your OS Manufacturer> (e.g., Z:EFIMicrosoft). Look for unusual executables or files with strange names.
    • Linux: Check the contents of the ESP mount point for unexpected files, especially in directories like /EFI/BOOT and folders related to your OS.
  6. Reinstall Operating System (Last Resort): If all else fails, a clean reinstall is often the most reliable solution. This will erase everything on your system drive, so back up any important data first (if possible).
    • Ensure you boot from trusted installation media.

Prevention

Exit mobile version