Abstract: Upon detection of a rootkit, a host computer system is rebooted. The boot process is interrupted. Access to a media, e.g., a volume or disk, containing the rootkit is gained and the media is directly accessed. The rootkit is disabled, e.g., renamed or deleted, and the host computer system is rebooted a second time. If the rootkit has not been previously removed, e.g., only renamed, the rootkit is removed, e.g., using a conventional antivirus application. Thus, upon detection of a rootkit, the rootkit is removed without a clean boot.

Abstract: A system for distributed discovery and management of frozen images includes a first and a second computer host, a first and a second frozen image agent and a frozen image server. Each of the first and second frozen image agents may be configured to identify one or more storage hierarchies hosted at a respective computer host, and to provide an encoding representing the identified storage hierarchies to the frozen image server. The frozen image server may be configured to aggregate the encodings provided by the frozen image agents into a system-level storage hierarchy catalog.