Running a virus scan wouldn’t be enough

No, those can be bypassed. If your kernel is what’s infected, then it’s not going to find anything.

Scanners are useful, but what they can look for is limited.