If this were true, how would the malware ever get itself to the point where it is loaded before the kernel is?