Fixed umbreon rootkit check