Hi, i remember GSecur posted once how to disable or bypassing an anti-virus
on a remote machine, i tried to search for it but no luck..

anyone knows how can i make the the anti-virus won't alert
about the files i upload in the remote machine?


thanks in advanced.

I just rename the ext. I am guessing ur trying to put up a ftp and iroffer. And lots of anti-virus will delete it, so just name it iroffer.ex and servu.ex the modify ur bat to read them, if you can get ur ftp up reg just do that, and if you are haveing problems getting ur bat to start the bot just do : site exec iroffer.ex -b xdcc.config
It will start right up
Of course I dont mean for you to do anything illegal, so when trying to bypass your own anit-virus on your own computer, do that

Hi

The way I usually do it is:
1. stop the AV service
2. upload a registry hack that tells the AV to exclude all files in the dir you up your kit to
3. regedit /s patch.reg
4. restart the AV service

Usually works. Only excpetion I found is OfficeScan NT. Thing to do there is modify the exclude filenames to you yourprog1.exe and yourprog2.exe

Hope that helped,
Jeeve5

Use a packer and rename u'r file or kill the AV

net stop Mcshield
net stop "Norton Antivirus Service"
net stop "Panda Antivirus"
net stop "ZoneAlarm"
net stop "Detector de OfficeScanNT"
net stop "McAfee Framework Service"


Greetz Imps2

What is a packer exactly?
what what file are you talking about?

can i just put this "code" that u gave me into a bat file
and run it on the machine?

The most common packer is UPX.

The 'code' he just gave you is to stop the AV services. Problem is that Norton usually recognizes packed files and therefore it is useless.

ok but i didn't understand your method.

what is a registry hack?
where can i find it?

A packer changes the size of u'r proggie and renames it so it's harder to detect by AV software.

You should be able to run the commands from a bat file

Greetz Imps2

link to test your files online:

http://www.kaspersky.com/de/remoteviruschk.html

and the results are horrible:

Zu überprüfende Datei: server_.exe

server_.exe Komprimiert: ASPack
server_.exe Komprimiert: ASPack
server_.exe Komprimiert: Morphine
server_.exe Komprimiert: UPX
server_.exe Infiziert: Backdoor.Winshell.50

kaspersky know all known exe packers and has the depacker i think ...

does anybody has an unknown packer ???

put the following code into av.bat

Usefull list.
I add AVG Antivirus by Grisoft. Services are

packers is agood choise to by pass norton and other antivirus
McAfee and ksv ithink hex edite is the only one
cheers

Your complete answer.

Seems the members completed my post enough , to help ...

i love the esy way:
look at the service list
and stop the anti virus (:

Heya,

@Jeeve5 can you post the registry hack, so the AV will exclude the directory!


thanks