If F-Secure Blaklight (or anything for that matter) finds a bagle rootkit Igor was asking for a sample in an earlier thread.