title: How to unhook SSDT hooks and make them gat away?
body: <p>I'm working on a rootkit and reversing it.I'm supposing to write my anti-rk specific for this kind of rootkit.The rootkit hooks some kernel-mode functions that can't be unhooked from user-mode, or if I unhook them from user-mode they will not get away and will be back.
  So what's your suggestions? </p>