Microsoft Technology Licensing, LLC

Vincent R Orgovan

Yi-Min Wang

Scott Field

Yun Lin

Mihai Costea

Alexey A Polyakov

John D Service

Gretchen L Loihle

Björn Levidow

Wael H Bahaa-El-Din

Robert J Hensing, Jr

Embodiments of a RootKit detector are directed to identifying a RootKit on a computer that is designed to conceal malware. Aspects of the RootKit detector leverage services provided by kernel debugger facilities to automatically obtain data in specified data structures that are maintained by an operating system. Then the data obtained from the kernel debugger facilities is processed with an integrity checker that determines whether the data contains properties sufficient to declare that a RootKit is resident on the computer.

Automated rootkit detector

A method and a system for obtaining shutdown information for a computer allows a user to indicate a reason or reasons for the shutdown. The states of the user mode processes that are running on the computer are saved for later analysis. The state information as well as the shutdown reason entered by the user is stored in a computer-readable memory, such as in the form of a log file. A user may report a shutdown reason by selecting a reason from a predefined reason list and/or by typing a reason in a comment area.

Method and system for obtaining computer shutdown information

Growing community of inventors

Bellevue, WA, United States of America

Vincent R Orgovan