I am no expert in this area, but I would suggest you might look into "Rootkit Revealer" and how it works.

My rather simplistic concept of how most of this stuff (to date) works is that it goes...