Detecting stealth software with Strider GhostBuster
Copilot - a coprocessor-based kernel runtime integrity monitor