Patent ID: 7996903

Claim:
A method for detecting and removing a hidden pestware file on a storage device of a computer, the method comprising: detecting, using direct drive access, a file on the storage device, the direct drive access bypassing standard file Application-Program-Interface (API) function calls of an operating system of the computer; determining whether the file is detectable by the operating system by attempting to access the file using a standard file API function call of the operating system, the file being detectable by the operating system when the attempt to access the file using the standard file API function call is successful, the file being undetectable by the operating system when the attempt to access the file using the standard file API function call is unsuccessful; identifying the file as a potential hidden pestware file, when the file is undetectable by the operating system; confirming through an automated pestware-signature scan of the potential hidden pestware file that the potential hidden pestware file is a hidden pestware file; and removing automatically, using direct drive access, the hidden pestware file from the storage device; wherein a backup copy of the hidden pestware file is made before the hidden pestware file is automatically removed from its original location on the storage device, the hidden pestware file thereby being quarantined to enable automatic recovery of the hidden pestware file when removal of the hidden pestware file is in error.