The fact that the malware shrinks the C: drive by 100 MB and moves the bootloader onto a new partition before enabling Bitlocker is no surprise at all. Windows does exactly the same thing if you turn ...