The exploit is still deregistering PrependFork. Is it done to disallow the user to change it :?