Do common malware compromise recovery partitions?

Question

Just about now a friend of mine got compromised, actually she was compromised by various adware since long ago but she installed something (her browser was hijacked to deliver even more malware) and the machine crashed.

I told her to reinstall from the recovery partition since she's not tech-savvy and doesn't know how do to a proper reinstall from a clean Windows ISO.

Now, I'm wondering, do common malware also compromise the recovery partition ? I know an experienced attacker targeting that particular machine would definitely do this, however I don't think she's victim of a targeted attack (she doesn't have anything valuable on her machine nor her network), so does the usual crap you can get from shady websites/malvertising also takes the hassle to compromise recovery partitions ?

Answer 1

Worse! I can't find it but the other day I read about a UEFI hack that installs a rootkit in your UEFI - the bootloader. If that is possible, you can reinstall your system and still get infected.

But this is not common - yet. And I believe these rootkits are not easily made, probably need to be modified for many different systems.

Answer 2

This would purely depend on the type of malware that infected the machine. If the malware goes on to randomly create multiple points inside every partition of the machine, then it might affect the recovery partition as well. Possible solution would be to try and do a recovery through partition and if the problem still persists, then you can think of other ways like system scan, re-image etc.