Newly Discovered BOOTRASH Malware Is Almost Undetectable - Boots Before Windows Loads

There’s a new bout of malware doing the rounds which is virtually undetectable. The malware has been in use the entire year but has only just been discovered, owing to the fact it boots before Windows has even loaded. The so-called ‘bootkit’ BOOTRASH burrows down to your system at the deepest possible level, becoming one of the first things to begin running when you boot your PC up.

The BOOTRASH malware is part of the renowned Nemesis series of malware. Previously this was targeted at financial institutions, but it now appears is if a popularised version of the malware is being used to obtain personal details. It is capable of transferring files, capture images, logging keystrokes, and injecting its own processes.

Because BOOTRASH runs before Windows itself loads, Windows has extreme difficulty in detecting its presence. Even a total reinstallation of Windows won’t remove it from your system, hiding away from your Windows install.

How does it achieve all this? Well, it works by infecting the Master Boot Record (MBR), which is the primary utility that loads when you turn on your system. From here the MBR can load up hard drive partitions and detect your Windows boot. The bootkit integrates itself between partitions, so the MBR cannot detect it.

"The use of malware that persists outside of the operating system requires a different approach to detection and eradication," wrote security firm FireEye in a blog post. "Malware with bootkit functionality can be installed and executed almost completely independent of the Windows operating system. As a result, incident responders will need tools that can access and search raw disks at scale for evidence of bootkits."

Detecting it and getting rid of it seems like a tricky business then, with the only surefire way being a total format of the hard drive. It’s a bit disconcerting never knowing it’s there, but hopefully someone can figure out a way to combat this.