Donna wrote:


> I was asking here because I am assuming that the network activity back to
> the mother ship would be the weak point in detecting this software.


Unlikely. It's called steganographic tunneling.

The real weak point is that the software, if installed, changes the state of
the system. Comparing against a known good state will show it up.