[tinus_hn]

The 'malware' used a Windows misfeature that allows the BIOS to supply an executable that is run during startup. So the malware was in the firmware but only runs on Windows.