1. A method in a computer system for determining whether resources are being hidden, the method comprising: invoking a high-level function of user mode to identify resources; invoking a low-level function of kernel mode to identify resources; and when a resource is identified by the low-level function but not identified by the high-level function, indicating that the resource is hidden.