@groob I wondered about that, but I figured I would look for the modification the malware made, even if it worked (in terms of the OS loading it) or not, since this is quick & dirty. But yes, this is probably a way to do it.