Unloading in-memory DLL's

[mayurvb]

Hello,

I am developing an antispyware program on my own.
I do find some DLL's that are either loaded or in use.

How to unload these DLL's and remove them?
Any idea?
Same with Processess in use. I guess, using TerminateProcess with correct security credentials set to my progam will do the trick.

Anybody aware how good anti-virus or anti-spyware programs handle such situations?

[CHAMPGARY]

You can unload the dlls using

" regsvr32.exe /u "C:\WINNT\system32\.<sampledll>.dll"

if you know the name of the dll,then to remove it from the system.
You can rename them But Be careful .
close your explorer,because if it shares the process space with the dll. and you won't be able to delete.

To rename them you can use command prompt and dos commands
for e.g.
C:> cd \winnt\system32
C:> rename old_dll.dll new_dll.txt

[mayurvb]

The unregistering is successful, but the renaming doesnt work.
I tried this building a COM DLL using VB, loading it(by adding referenece) in other VB project, then unregistering the DLL with regsvr32.

Renaming, even after successful unregistering gives this error:
The process cannot access the file because it is being used by another process.


Remarkably, the other VB program can access the properties of my DLL even though it is unregistered.

[CHAMPGARY]

I think your dll hooked by other applications.
Seems to be no solutions

[mayurvb]

No, my DLL is not hooked by any other application, as i explained, i just created it to check your suggestion for removal.

There must be a solution or else there would be no anti-virus program