Comparing low level and operating system calls run from a read-only CD before startup to the same calls on the actual machine is the most reliable way to detect them.  
Greg Hoglund and James Butler's text on these details "fusion" ones that communicate by issuing IOCTL commands. The best ones issue commands like "cli" and "out" to writes to a hardware port, made possible because they run on (*) Ring 0 on Intel x86 processors. One called Blue Pill could serve as a hypervisor and was only detectable if there were flaws in virtualization code. Comparing low level and operating system calls run from a read-only CD before startup to the same calls on the actual machine is the most reliable way to detect them.  For 10 points, name these types of malware that grant the namesake high level access, most famously included with Sony DRM CDs.
Greg Hoglund and James Butler's text on these details "fusion" ones that communicate by issuing IOCTL commands.
{Rootkit}s