Hi FreewheelinFrank,
I agree here with FreewheelinFrank. There should be a way not only to find Fu rootkit up, but also to eliminate it. In the war between malcreants and AV producers we have once again come into a new arena. There are two ways to go by: one is have a program that prevent that a rootkit is set up (system monitoring is one of the possibilties to prevent this), another way is to find them up, there are minor differences in the ways the normal kernel and the rootkitted kernel react to api calls. This is a way to get a grip unto them. Another way is to detect them from an uncompromised variant on a CD or from another uncompromised computer in a system. But rootkits are getting more sophisticated and less easily to detect. We will hear more abou them,
polonus
