now checks for some rootkits