It's a tool that runs from something akin to a LiveCD and diffs the output of "dir /s /a" using the dir commands from the LiveCD and from the corrupted system. The files that show up on one list and not the other would be the ones being hidden by the malware. REsults are saved to a floppy or USB drive that is only connected while the LiveCD is "live".

One could probably fashion the same from a Linux LiveCD with read-only NTFS support enabled.