ehm. anti-virus? there's a whole discussion about it, i won't go into here.
but what can an anti-virus do? best would be to patch the database (might be pretty hard). then it could write something like:
echo "you have been hacked!"; exit 0
into the .profile. that will let the user spot the cracking attempt.
Would be neat if there were an exploit which injected something to make further injection impossible.