That hypervisor would have to be at the hardware level, I'd imagine. A read-only PE for boot (WORM drive) with all your typical programs pre-installed, and then a separate encrypted removable data drive would be the mitigation against that.