create a user rootkit that:
- provide a backdoor/command-shell opportunity,
- hide malicious network connections from netstat (and perhaps lsof), and hide malicious files.