Patent ID: 8661541

Claim:
A method in a computer system with a processor and a memory for determining whether a process being hidden is a root process of malware, a root process being a process of the malware whose access to system resources is not filtered by the malware, the method comprising: determining whether a process that is executing code is hidden; after determining that the process is hidden, injecting code into malware code executed by the hidden process, the injected code for determining whether a resource is hidden from a process that is executing the malware code; after injecting the code, launching execution of the malware code as a process; and during execution of the injected code within the launched process, determining whether a resource is hidden from the launched process by generating a lie list and a truth list of resources and determining that no resource is hidden when the generated lie list and truth list are the same; and upon determining that no resource is hidden from the launched process, marking the hidden process as a root process.