Patent ID: 7631357

Claim:
A computer program product for implementing a method for a computing system to detect the presence of a rootkit in the form of rootkit code that, when executed, manipulates responses to a file system, the computing system including an operating system, a storage unit, a snapshot component configured to take a snapshot of the storage unit, and a rootkit detection component, the computer program product comprising one or more computer-readable storage media having thereon computer-executable instructions that, when executed by one or more processors of the computing system, cause the computing system to perform the method, the method comprising: an act of initiating a computing system shut down operation; an act of the snapshot component pausing the shutdown operation prior to the completion of the shut down and taking a snapshot of at least a portion of the storage unit, wherein the act of the snapshot component pausing the shutdown operation prior to the completion of the shut down comprises shutting down at least one functional layer of the computing system before shutting down a device driver for the storage unit, wherein the at least one functional layer is logically positioned above the device driver; an act of the rootkit detection component accessing an enumeration of individual files represented in the snapshot using an alternate file system I/O, wherein: the operating system comprises the rootkit detection component; the operating system comprises a first file system I/O; the alternate file system I/O has a different source code implementation than the first file system I/O for interpreting file system data structures; and an act of the rootkit detection component using the enumeration to detect the presence of a rootkit.