hooking the LdrLoadDll and LoadLibrary(Ex) APIs to prevent loading DLLs belonging to those products - checking if any of those modules are already loaded - trying to kill their running processes (based on process names) - blocking Diebold Warsaw on the firewall level - trying to break Trusteer by changing its file system path (see Figure 11) - changing ACLs on main Trusteer binary by running this command twice: cacls %PROGRAM_DATA%; Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportGH.dll” /T /E /C /P user:perm with user:perm set to Todos:N and then Everyone:N - - with user:perm set to Todos:N and then Everyone:N