Detecting stealth software with Strider GhostBuster
STRIDER: A Black-box, State-based Approach to Change and Configuration Management and Support