1. A method of comprising: detecting, by a virtual machine monitor, a virtualization trap occurring as a result of an action by a rootkit executing in a computing system; and analyzing the virtualization trap to detect the presence of the rootkit in the computing system, wherein the virtual machine monitor is to execute at a higher privilege level, in cooperation with a separate partition, than the rootkit to prevent the rootkit from hiding by executing at a same privilege level as the virtual machine monitor.