System and method for bypassing a malware infected driver

Abstract

Aspects of the present disclosure relate to setting up an alternate communication path to a device, resource, file, etc., in order to avoid a potentially infected driver. New drivers may be established as part of the alternate communications path, thereby providing access to a device, resource, etc. using drivers that are known to be clean or, in other words, not infected by a rootkit. In doing so, a rootkit hunter, e.g., antivirus software, antimalware software, etc., may access an infected device, resource, etc. without alerting a rootkit, thereby avoiding activation of the rootkit's defensive mechanisms. In one aspect, an I/O request may be serviced by using the new communications path bypassing any potentially infected drivers while another request may be serviced using a previously established communications path. The responses (e.g., data returned, action performed, etc.) of the requests may then be compared.