: Windows uses a registry key called KnownDLLs to speed up loading common system files.
Tools like this work by restoring these hooked DLLs to their original, "clean" state. This effectively blinds the security software. UnhookingKnownDlls.exe
: Ethical hackers use these tools to test if their own security systems are robust enough to detect "unhooking" attempts. : Windows uses a registry key called KnownDLLs