Is there any source for a VI, VIM, or even EMACS that has all libraries compiled 
into it statically? That would make monitoring for the rootkit much easier. The 
same could be said for utilities such as chkrootkit. With compiled in static 
libraries these level three (user space) rootkits can't edit the results you 
get, as easily. (Any file system components in user space would also have to be 
statically linked.)

{^_^}   Joanne