Can Restarting An Infected Computer Make It Worse?

Question

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures load after the core, thereby deepening its infection level, or making it more difficult to remove. I am not sure if this pertains to a rootkit in particular or not... it may have been describing malware transforming into what is known as a rootkit.

QUESTION: Is this true and does it apply to Android and Windows 7/8/10? How about Linux and Mac?

A FEW QUICK THOUGHTS: On the other hand, I know that a lot of incident response guidelines suggest disconnecting the network cable AND/OR shutsown the computer after discovering or suspecting a malware infections, which is a contradiction to the previous point. In an enterprise environment, technicians may wish to keep the computer alive to preserve forensic evidence, but I also know that most techs will just shut it down and take it back to the shop for the scan. Also of note, is that the most thorough scanning method using a bootable CD would require a restart to load as well.

To be clear, this question is not about incident response, but the capabilities of malware and the consequences of restarting the computer after infection. Incident response guidelines may be offered in addition to your answer where appropriate.

Answer 1

It depends on the type of malware.

If it is ransomeware shut it down as fast as you can preferably by hard reset this way it may not have been able to encrypt some files and you can grab any files you need off of the hard drive.

If it is a rootkit, shutting down is a horrible idea because the rootkit has set hooks that allows it to climb through rings on the next reboot. Theoretically a rootkit cannot reach ring0 (kernel level) without a restart. (Contrary to some comments above. You'd have to be crazy to try to modify a kernel while it is in use.)

Use how the malware works to determine if it is safe to power off/reboot.

Answer 2

Since this question has about a billion comments and no answer, allow me to propose one. In general, if malware gets into a system, take it off the network, shut it down, wipe the drive, and essentially nuke it from orbit.

Although it is true that shutting down may clear out information that might be useful for a forensic analysis, such as data stored in ram, trying to actively remove malware from a system while it's running is just a bad idea. The longer malware exists on your machine, the longer an attacker has to steal/encrypt data, create new backdoors, gain access to other machines on the network, or worse, especially if they start getting red flags that their malicious program is being put on the defensive.

As for restarting, I jokingly mentioned on another post that malware could install a linux iso to a usb plugged into a computer, and the next time the computer rebooted it would boot from the usb if it was on the top of the boot order. Honestly this is a pretty impractical scenario, but it does illustrate the point. Malware can get greater access to a system if it is restarted through plenty of nefarious means like boothooks, rootkits, bootkits, etc. (Just look at the comments on your question for more evil ideas.)

The best option is to do a hard shutdown (i.e. hold the power button, don't give the malware the chance to know that the computer is shutting down (in general give it as little information as possible), disconnect the machine from the network, wipe any attached drives, restore data from a backup from before the malware entered the system or a default company machine image, and figure out how the program got on your machine to start with. Sure, you might have less info to go off of, but the malicious program also will have gathered less information than it might have been able to. And if you really want more information, hopefully you still have server/router logs to comb through.