Abstract: A Rootkit is a set of programs and code that allows a permanent or consistent，undetectable presence on a computer.Windows kernel Rootkit based on file system filter driver has been researched.The work principle of file system filter driver and the realization of filter driver and occultation techniques of kernel Rootkit based on file system filter driver have been introduced.The techniques of Rootkit detection have been discussed.

Key words: file system, Rootkit, filter driver, occultation