Detecting (and creating !) a HVM rootkit (aka BluePill-like). - Anthony Desnos; Eric Filiol; Ivan Lefou (J. Comput. Virol., 2011)