>A KTH virus would have to anticipate all tools which may be written to detect it

I wonder if you couldn't reduce this to the halting problem to prove that this is actually impossible.

edit: Ah, never mind. It's already been mentioned in the OP that this has to be the case.