Dynamic detection technology of Rootkit malicious code has been studied.It summarizes typical dynamic system API functions which are called by Rootkit malicious codes.It extracts behavioural characters of the typical system API functional series accompany with the running of malicious code

forms feature vectors by counting up the generating elements important degree of system call series

uses fuzzy membership function and normalization fuzzy weights vector

and comes to the fuzzy pattern recognition conclusion with the use of weighted averaging method.It exactly locates the types of Rootkit malicious code based on the analysis method of layered multi-attributes support virtual machine

according to the subtasks constructed by the independent API system call behaviours

and with the calculation of hamming distance of dynamic behaviour properties.Experiments indicates the proposed dynamic detection method of combining fuzzy pattern recognition with support virtual machine technology not only improves the accuracy rate of Rootkit automatic detection but also has the ability of detecting the previous unknown type malicious code.