True, although for a remote attack there's no reason it can't just be reinfected after the reboot.