Originally Posted by u-Bob

When a system has been compromised you know 1 thing: That the system has been compromised.

Based on the output of the system or programs running within that system, you can't know what the attacker has done. You can't know what the attacker has installed. You can no longer trust any info the system provides. Why? Because the system has been compromised. That's security 101.

Ken Thompson already made that point back in 1984 (or 1985) with his "reflections on trusting trust" (or "reflecting on trusting trust") presentation. (Remember his famous c compiler trojan?).