Patent ID: 8856932

Claim:
A method of detecting a kernel-level rootkit, said method comprising the steps of: a computer system detecting a changed entry in a System Service Descriptor Table (SSDT) or an Interrupt Descriptor Table (IDT), wherein said changed entry results from an installation of suspect software in said computer system, said computer system having at least one processor and at least one memory; said computer system determining a value of said changed entry is not referenced by a white list; in response to the step of determining said value of said changed entry is not referenced by said white list, said computer system updating a black list to include a reference to said value of said changed entry to indicate that said value of said changed entry results from an installation of said kernel-level rootkit on said computer system; said computer system determining said suspect software is said kernel-level rootkit based on said value of said changed entry not being referenced by said white list; and in response to the step of updating said black list to include said reference to said value of said changed entry, said computer system restoring said changed entry to an entry of said SSDT or said IDT, said entry included in a first state of data structures of a kernel of an operating system of said computer system, said first state based on said SSDT and said IDT referencing hooks indicated in said white list which are not the result of any kernel-level rootkit being installed on said computer system.