Before Windows loaded, I saw a message claiming the computer had been hacked, followed by scrolling white text on a black screen for about 30 minutes. Windows eventually started normally, and the message hasn't reappeared.
A regular antivirus scan found nothing. Could this be a bootkit or firmware problem, and should I reset or reflash the firmware?
The message alone isn't enough to identify a bootkit. Text appearing before the Windows desktop could come from several places, including startup software, and a clean antivirus scan doesn't prove the system is clean either.
If it happens again, take a photo or video of the screen, including what appears before and after the message. The computer make and model, Windows version, and firmware version would also help narrow down where it's coming from.
I'd run a Microsoft Defender Offline scan and check whether Secure Boot is enabled. The offline scan runs outside the normal Windows session, so it's a useful additional check when a regular scan hasn't found anything.
Also look for unfamiliar startup entries or scheduled tasks. Neither of those checks can rule out every possible compromise, but they're more reasonable starting points than assuming the firmware has been infected.
Disconnect the PC from the internet while investigating if you're concerned it may be compromised. That won't diagnose or remove anything, but it limits network access while you check.
If you find stronger signs of malware, a fresh Windows installation is an option. Don't rush into a firmware reflash based on this one message. First try to identify what actually appeared and where in startup it came from.
Answers are reviewed before publication.
Related Discussions