Hi,

Long story short, a program that shouldn't have been run on this machine has been, and it's created a naughty .sys file that is being loaded right after pci.sys (as determined by NBTLog.txt)

I've had a look a BCDEdit, EasyBCD and a number of Registry keys but I can't seem to determine where about winstart.exe actually gets the list of sys files to load from!

The sys file itself is running in high elevation and appears to be defeating all attempts to remove it; I could (probably should) make a Linux USB boot disc and use it to delete the sys file, but I'd really appreciate understanding the mechanics here.

((FWIW: the problem stemmed from a sibling running a Trainer for some game; he has been suitable chastised))