Patent ID: 7874001

Claim:
A method in a computer system with a processor and a memory for determining whether a process being hidden is a root process of malware, a root process being a process of the malware whose access to system resources is not filtered by the malware, the method comprising: invoking by the computer system a high-level function of user mode to identify processes; invoking by the computer system a low-level function of kernel mode to identify processes; when a process is identified by the low-level function but not identified by the high-level function, indicating that the process is hidden; injecting code into code of the hidden process, the injected code for determining whether a resource is hidden from the hidden process; and after injecting the code, launching execution of the hidden process; and during execution of the injected code within the hidden process, determining whether a resource is hidden from the hidden process; and upon determining that no resource is hidden from the hidden process, indicating that no resource is hidden; and when the injected code indicates that no resource is hidden, indicating that the hidden process is a root process.