From: Mike N. 

On Sat, 28 Apr 2007 10:20:58 -0400, "Geo."  wrote:

>I want to see them use hardware trusted mode with this, that would be
>something new..

   Unless I missed something, hardware trusted mode is the only current
defense.  For this case, TPM + Bitlocker would detect the modified startup
files at the next restart, before they could be loaded.   The user would
have to first re-validate  (which they would probably do blindly; since
their AV didn't alert them).

--- BBBS/NT v4.01 Flag-5