@evildictaitor:

And if the rootkit answers correctly all 100 ways? The fact of the matter is though, there is no perfect security. Intrusion detection with no false negatives has been shown to be an undecidable problem.[1]

[1]: http://vxheavens.com/lib/afc01.html