Rootkit

How detect a LD_PRELOAD rootkit and hide from ldd & /proc