You check the certificate chain and compare it to a clean version. Obviously that's going to be a solution limited to very savvy users.