Malware that bypass user-mode hooks spreads like a virus. Since such hooks are being relied upon by many security products and tools it was only natural for attackers to come up with different shenanigans to bypass them. We’ll review known bypass techniques used in the wild and what makes them effective to this day. We’ll try to understand the attacker’s approach and goals behind implementation of different methods and reveal new techniques of our design.