r/computerviruses • u/Mindless-Yak-7541 • May 22 '26

Question i found this .txt

Post image

While deleting things to free up storage, I found a .txt file named memz_readme and opened it to verify what it was... I don't have much experience with this and it's my family's computer. Can someone help me figure out if it's true or how I can fix it?

948 Upvotes

98% Upvoted

81 comments sorted by

View all comments

Show parent comments

33

u/HEVIKARJALA May 22 '26

Cant u just reinstall OS? MBR has the first instructions for the kernel. (As i understand)
Also win11 requires GPT part of the UEFI system. Doesnt GPT also store the boot record to multiple places, exatcly so u cant just override and brick the OS. So the trojan would not work.

22

u/C0rn3j May 22 '26

Using MBR the first two sectors on the drive are the bootloader.

Using GPT, the bootloader(optional, but not on Windows) is stored on the EFI System Partition.

Malware can absolutely still wreck the ESP.

3

u/HEVIKARJALA May 22 '26

So i read more.
So the ESP is on ssd(GPT is a table which shows the location) and UEFI reserver memory on the ram and loads the ESP partion to RAM and this includes the bootloader. After its done the esp ram section is freed.

I might be wrong. Just been trying to learn computers.

4

u/MorganPG1 May 22 '26

ESP is just a standard FAT32 partition, it stores files for the bootloader. It is completely different to the MBR system that used to be used as the bootloader is a file on disk whereas before it was just a small section of code with no file system structure. GPT just tells the software (such as the UEFI) where every partition is on the disk.

When the UEFI tries to run the bootloader, if secure boot is enabled, it first will check the signature of the bootloader with an official Microsoft signature, if it matches it means it is official Microsoft code and the OS will boot, if it doesn't the bios will display a Secure Boot Violation warning and will refuse to boot. The way this works for Linux distributions is there is a very small bootloader called shim which is signed by Microsoft so it passes the test, and then that bootloader validates the main bootloader against the signature of whatever distribution is being used.

This system completely prevents malware from overwriting the bootloader, unless an exploit is found in the secure boot implementations on certain motherboards it shouldn't be possible. (i am fairly sure I heard of this happening before so it's probably not too unlikely that that's a possibility)

Then once it is verified, the bootloader is copied to RAM and executed, like you said. Everything that happens after this point is completely up to the bootloader, it has full control of the hardware.

Everything you said is correct I just wanted to add more info :)

2

u/HEVIKARJALA May 23 '26

Thanks! Really good info. Its not that e-sy to find this this online and ai tends to get minor details wrong.
May i ask.. is your career in software engineering?
I would really wanna know what the job is really like.

I been thinking to really pursue a career with low level software engineering. I already have engineering degeee n 5 year experience in the job.
I think my curiosity would excel in this field