+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [TUT] Bypass avira detection [ TR/Dropper.GEN ] (/showthread.php?tid=1303319)
Pages: Pages
1
2
[TUT] Bypass avira detection [ TR/Dropper.GEN ] - MoonWalker - May 19, 2011
Bypass avira detection [ TR/Dropper.GEN ]
I've seen a lot of members having trouble in bypassing avira detection ( TR/Dropper.GEN ). Well here is a simple trick to fix that. Avira detects the file assembly, Use the following values in your stub and then generate the server. This time it'll be FUD.
Download RESHACKER and the replace the version info of your stub with these values.
This made my server 0/33. It should work for you too.
Download RESHACKER and the replace the version info of your stub with these values.
Code
VALUE "FileDescription", "Hijack This"
VALUE "FileVersion", "2.00.0002"
VALUE "InternalName", "Hijack This"
VALUE "LegalCopyright", "© 2007 Trend Micro Inc"
VALUE "OriginalFilename", "Hijack This"
VALUE "ProductName", "Hijack This"
VALUE "ProductVersion", "2.00.0002"
VALUE "Assembly Version", "2.00.0002"This made my server 0/33. It should work for you too.
* - Volim te - May 19, 2011
Nice TUT mate, is there A way to bypass the detection 'BDS/Backdoor.Gen' ? (Without crypting as it's a DLL lol)
* - wertyl11 - May 19, 2011
Are you sure this is the sollution ?
Because dropper detection pretty much says for itself that it reacts on a file getting dropped. But if this tutorial worked, Great! nice share!
* - Gooples - May 19, 2011
Hijack this worked in 07 not 11.
* - Banksу - May 19, 2011
(May 19, 2011 03:15 AM)PinZ Wrote: Hijack this worked in 07 not 11.
This. Avira isn't stupid, they don't fall for assemblies anymore. Get a new RunPE or find the code that is detected and recode it.
* - MoonWalker - May 19, 2011
(May 19, 2011 03:15 AM)PinZ Wrote: Hijack this worked in 07 not 11.
If you don't know anything about it then please don't post here.
(May 19, 2011 03:39 AM)Banksy™ Wrote: This. Avira isn't stupid, they don't fall for assemblies anymore. Get a new RunPE or find the code that is detected and recode it.
I've tested this. I made a downloader and it was detected as TR/Dropper.GEN. but after doing this its FUD.
* - Sheikh. - May 19, 2011
This is an old trick actually. Btw just use CodeDom and selfmade or undetected RunPE
and its fud too.. Without assembly.
* - Numair - May 19, 2011
Well i think many time ago Soul Collector posted the same thing to bypass Avira but using GUI.
* - Gooples - May 19, 2011
(May 19, 2011 04:29 AM)MoonWalker Wrote: If you don't know anything about it then please don't post here.
I've tested this. I made a downloader and it was detected as TR/Dropper.GEN. but after doing this its FUD.
Kid, I do know. L2 code then come back.
* - GoldenPhe0nix - May 19, 2011
nice tut man. Thanks for the share.
* - Drag00n # The Hacker - May 19, 2011
Cool tutorial and very useful.Thanks.
* - .Astro - May 19, 2011
Like I haven't seen this before ..
* - _E.R.R.O.R_ - May 19, 2011
very old , now it dont work i have been useing another method
* - Ingenuity - May 19, 2011
Doesn't work in the latest version of Avira. They don't fall for shit like this anymore.
* - Doctor Stein - May 19, 2011
This Set off More Avs TR/Dropper.GEN is for your Output