Description: under rootkit detection windows of the hidden documents. Some usermode overwrites first few bytes of ZwQueryDirectoryFile and that trick will fail then : (So, you will probably need a small database of the correct indexes for all Windows versions
File list (Check if you may need any files):