The trouble with any rootkit detection software is that if the rootkit is really good, it will work to hide traces of itself from the detecting software as well.
I imagine that rootkits could be detected with more certainty by watching the traffic coming out of the potentially-infected computer from an alternate computer. Something like:
- Configure alternate computer (I'll call it the "monitoring computer") to route all traffic for the infected computer (either via wired or wireless)
- Configure infected computer to use the monitoring computer as its gateway or wireless access point
- Software on the monitoring computer has definitions of likely traffic which would indicate infection (e.g. virus signatures, IRC protocol patterns, smtp patterns for outbound spam)
- If the monitoring computer detects a problem, it reports the issue and drops the suspect traffic.
- All innocent traffic is routed onward.
Does such software exist for any platform? The infected computer would likely be running Windows, but the monitoring computer could run any OS since it's acting as a router.