I was asking the original poster, just to avoid any confusion (the term "warm restart" is used quite vaguely).
To clear things up, the rootkit scan will only take place after real Windows boot. I.e. not after a resume from hibernation (or sleep).
Vlk