Rootkit, LKM, hook getdents to hide files