UnHackMe
•  Greatis •  AppDatabase •  Utilities •  Delphi/CB •  Visual Basic • .NET •  Outsourcing

UnHackMe - First BootWatch AntiRootkit
 UnHackMe     Entire site
Choose one
For home users

Professional - for anticrime squad

Roaming - for admins

Enterprise - for small and large business

Education

Free TDL Rootkit Detector

Info
Warrior Benefits

Features

ScreenShots

How it works

Download

Rootkit Testing

FAQ

UnHackMe for beginners...

One-click purchase
UnHackMe Single

UnHackMe Family

UnHackMe Business

UnHackMe Family+Business

UnHackMe Roaming

UnHackMe Pro

Download trial
UnHackMe
Forums
Greatis Forum

Home Download Order Support Press Room   Newsletter Your shopping cart ?
How to remove cnprov.sys related to Baidu rootkit

Baidu search toolbar allows using Chinese domain names during browsing web sites.
All information about visited web sites are collected and may be used by the manufacturer of the toolbar.
What's wrong?
The toolbar is useless for non-Chinese users and we don't know why the different web sites offer to download this software.
Baidu software doesn't hide their files and registry keys.

But the Baidu kernel driver "cnprov.sys" prevents the Baidu's files and registry keys from deletion.
A user has a right to uninstall toolbar using included uninstaller.

cnprov.sys
It looks good but I don't like that the simple toolbar uses the kernel driver that hooks the registry and files operations on the kernel level.

Each kernel driver decreases performance and increases the risk of BSOD. The kernel drivers are good for hardware devices or in the antiviral software. But it is absolutely not allowed for standard Windows software.
Why the Baidu uses the kernel driver in this version of this software?
The answer is one. It's hard in removal and some of the users couldn't do it.
They will be under the Chinese watch or they need to format their computers. Annoying procedure isn't?


UnHackMe detects and removes Baidu software.


Removal

UnHackMe detects the "cnprov.sys" driver and it removes the driver from the registry at the next reboot.

But you need to repeat the deletion procedure at next check. This why the driver is already loaded in memory.

We need using reboot to unload the driver.

Also, we need to remove idnsvr.exe and cnprovh.dll from Windows startup.

After that we can simply delete Program Files\OCINS subfolder and the %SysDir%\cnprov.dat.

Purchase
Buy Now UnHackMe

Supported Windows NT4/2000/XP/2003/Vista/Seven.

Compatible with all known antiviral software.

Free updates. On-line support.

System Requirements.


They say

My PC had gotten a bad rootkit
that my ISP antivirus software (powered by McAfee) could not detect, nor could fix. I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.

Jeff

Bob Rankin

What's new?
January 23 2012

Released UnHackMe 2012 Build: 397!


November 3 2011

Morto Removal Video

July 27 2011

Popureb.E Rootkit Removal Video

Zero Access Rootkit Removal Video

Released


All News...


Now Google Search is redirected in Windows 64 bit too if you are infected by TDL3++ (also known as TDL4).



RegRun Warrior download (for burning your own CD)


Resolving problem with


Awards
Paul's Picks
Shareware Winner  

More...


Greatis Software Greatis | Security | AppDatabase | Utilities | Delphi/CB | Visual Basic | .NET | Outsourcing

Contacts | Add to Favorites | Recommend to a Friend | Privacy Policy | Copyright © 1998-2012 Greatis Software

tumblr hit counter