Patent ID: 8281393

Claim:
A computer-implemented method for detecting a rootkit, comprising: identifying a plurality of real addresses within an operating system kernel by accessing a plurality of kernel export tables, wherein the plurality of real addresses are associated with a kernel mode Nt function; scanning a system service dispatch table (SSDT) in order to determine if unwanted modifications have occurred in the SSDT, wherein the scanning includes comparing the plurality of real addresses with a plurality of addresses within the SSDT; determining a real address of a function that accesses a system service directly from inside the kernel for comparison with another address; calling the function that accesses the system service directly; receiving results from calling the function that accesses the system service directly; calling a function that accesses the system service indirectly; receiving results from calling the function that accesses the system service indirectly; and comparing the received results from calling the function that accesses the system service directly and the received results from calling the function that accesses the system service indirectly to determine presence of a rootkit, wherein the function that accesses the system service directly is the kernel mode Nt function, and the function that accesses the system service indirectly is a user mode Nt function or a Zw function.