Patent ID: 8677492

Claim:
A computer system for detecting hidden objects, the system comprising: computer circuitry having at least a processor coupled to a memory arrangement, the computer circuitry being configured to execute at least an operating system and a security arrangement; wherein the operating system is adapted to facilitate execution of a plurality of processes and provide at least one native service module that returns a first set of requested information relating to at least one object in the computer system in response to a request made by at least one of the plurality of processes; and wherein the security arrangement includes: a secondary service module that is adapted to generate and return a second set of requested information relating to the at least one object in the computer system in response to a request made by at least one authorized process of the plurality of processes, wherein in generating the second set of requested information, the secondary service module bypasses the at least one native service module; an access limiting module that limits access to the secondary service module such that only the at least one authorized process is permitted to access the secondary service module, wherein the access limiting module is adapted authorize the at least one authorized process based on cryptography and to thereafter direct the at least one authorized process to access the secondary service module, and such that non-authorized processes are not permitted to access the secondary service module; and a comparison module adapted to compare the first set of requested information and the second set of requested information to produce a comparison and, based on the comparison, determines whether any object is present in the second set of requested information that is absent from the first set of requested information, and to analyze properties of any such object to determine whether an absence of that object from the first set is indicative of a presence of a rootkit in the computer system.