How to remove cnprov.sys related to Baidu rootkit

Baidu search toolbar allows using Chinese domain names during browsing web sites.
All information about visited web sites are collected and may be used by the manufacturer of the toolbar.

What's wrong?
The toolbar is useless for non-Chinese users and we don't know why the different web sites offer to download this software.
Baidu software doesn't hide their files and registry keys.

But the Baidu kernel driver "cnprov.sys" prevents the Baidu's files and registry keys from deletion.
A user has a right to uninstall toolbar using included uninstaller.

It looks good but I don't like that the simple toolbar uses the kernel driver that hooks the registry and files operations on the kernel level.

Each kernel driver decreases performance and increases the risk of BSOD. The kernel drivers are good for hardware devices or in the antiviral software. But it is absolutely not allowed for standard Windows software.
Why the Baidu uses the kernel driver in this version of this software?
The answer is one. It's hard in removal and some of the users couldn't do it.
They will be under the Chinese watch or they need to format their computers. Annoying procedure isn't?

UnHackMe detects and removes Baidu software.


UnHackMe detects the "cnprov.sys" driver and it removes the driver from the registry at the next reboot.

But you need to repeat the deletion procedure at next check. This why the driver is already loaded in memory.

We need using reboot to unload the driver.

Also, we need to remove idnsvr.exe and cnprovh.dll from Windows startup.

After that we can simply delete Program Files\OCINS subfolder and the %SysDir%\cnprov.dat.

System requirements

Windows 9x, 2000/2003/XP/2008/Vista/Seven or higher 32 or 64 bit.
512 Mb RAM
CD/DVD drive or USB stick.

Purchase now!

Purchase includes:

  UnHackMe Single License - Electronic Delivery

  Warrior CD Image - Electronic Delivery

More information


Please visit our support center: Ask your question

People say:


This solution works great. Thanks!


Works as advertised. Keep up your good work guys!