In one embodiment, an antivirus uses a secure call path that includes an antivirus system call table containing a reference to an operating system kernel routine. The call path may also include an antivirus device driver that has access to the antivirus system call table. The antivirus may send a service request to the operating system kernel routine by way of the call path to perform file manipulations for virus scanning, for example. Advantageously, the call path gets around possible rootkit infestations.