+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Is this a good idea? (FUD Antivirus Disabler) (/showthread.php?tid=5935069)
Pages: Pages
1
2
Is this a good idea? (FUD Antivirus Disabler) - Takehito Morokuzu - Jan 28, 2019
This software I coded can disable any antivirus or antimalware software, while being completely undetected.
The only problem is, the disable process only works in safe mode, so the software needs to reboot the computer in safemode then reboot back to normal mode.
Is this a good idea? I feel like it could be useful for certain targets, but not all.
EDIT: It is currently coded in batch but can be converted to almost any language easily.
RE: Is this a good idea? (FUD Antivirus Disabler) - Goldmouth - Jan 28, 2019
(Jan 28, 2019 03:46 PM)-yuno gasai- Wrote: This software I coded can disable any antivirus or antimalware software, while being completely undetected.
The only problem is, the disable process only works in safe mode, so the software needs to reboot the computer in safemode then reboot back to normal mode.
Is this a good idea? I feel like it could be useful for certain targets, but not all.
EDIT: It is currently coded in batch but can be converted to almost any language easily.
Very nice man. This is diff very useful and even if not successful 100% of the time its still should work. Let me ask you, Does it work with NOD32? 🤗 🤗
RE: Is this a good idea? (FUD Antivirus Disabler) - I.M.P - Jan 28, 2019
I tried making something very similiar specifically for windows defender that used the same values yours does. But we already discussed this :)
RE: Is this a good idea? (FUD Antivirus Disabler) - M2K - Jan 29, 2019
Dude, I can say that that's super amazing really.
Does it work on windows 10 and servers?? if so im willing to pay for that script
RE: Is this a good idea? (FUD Antivirus Disabler) - CapsLo0ck - Jan 29, 2019
(Jan 29, 2019 01:38 AM)M2K. Wrote: Dude, I can say that that's super amazing really.
Does it work on windows 10 and servers?? if so im willing to pay for that script
hello
you need crypter or fud ?
RE: Is this a good idea? (FUD Antivirus Disabler) - Takehito Morokuzu - Jan 29, 2019
(Jan 28, 2019 05:37 PM)⚠️️HOSTAH⚡ Wrote: Very nice man. This is diff very useful and even if not successful 100% of the time its still should work. Let me ask you, Does it work with NOD32? 🤗 🤗
Yes it does. I've only added like 10 av and it works on all of them, I just need to add support for more of them.
(Jan 28, 2019 05:54 PM)Atroxcity Wrote: I tried making something very similiar specifically for windows defender that used the same values yours does. But we already discussed this :)
(Jan 29, 2019 01:38 AM)M2K. Wrote: Dude, I can say that that's super amazing really.
Does it work on windows 10 and servers?? if so im willing to pay for that script
It works perfect on windows 10, no idea if it works on servers but I don't see why it wouldn't.
(Jan 29, 2019 01:44 AM)CapsLo0ck Wrote: hello
you need crypter or fud ?
FUD at the time of writing
RE: Is this a good idea? (FUD Antivirus Disabler) - enmafia2 - Jan 29, 2019
I won't use this personally but I would be interested in the method just for the knowledge.
Would it be possible to know how you achieved this?
Thanks and good job
RE: Is this a good idea? (FUD Antivirus Disabler) - Takehito Morokuzu - Jan 29, 2019
(Jan 29, 2019 03:21 AM)enmafia2 Wrote: I won't use this personally but I would be interested in the method just for the knowledge.
Would it be possible to know how you achieved this?
Thanks and good job
Image File Execution Options ✌
It requires safe mode because the AV drivers don't block it in safe mode for some reason 😏
But this works on every single av i tested on, the exception being malwarebytes, however all I had to do was disable malwarebytes's safe mode boot, which isn't blocked and that allowed me to add it into IFEO. ✌
RE: Is this a good idea? (FUD Antivirus Disabler) - Jacque Fresco - Jan 29, 2019
Hey cool ill approached the same https://hackforums.net/showthread.php?tid=5878369
it also worked by starting up into safemode, displaying a SE message and reboot.
However here is a tip, a couple of Antiviruses have a msi installer, just check the registry HKLM\...\Uninstall for their uninstall string and run it Silently (like MsiExec.exe","/x {FD15FD84-2C5A-4C5F-BE83-79E2459856CA} /passive REBOOT=R) if thats not possible then create a new Account, Log it on and make Mouse clicks trough the uninstaller. Just dont ask me for a script on howto logon a different User (no RunAs doesnt do the job because the Gui will show up on the current user and simple hiding is risky also because some msi uninstaller popup a webpage too ("sadly that you uninstalled 'Antivirus'. State us why")) because i rage quiet google etc. after 2 days of searching for a solution.
Also to counter the suspicion fact, steal the Icon of the Antivirus and implement it into your own application (automatically of course) and let it display. Alot of users just watch for the Icon and think they are safe.
RE: Is this a good idea? (FUD Antivirus Disabler) - Edge of Nowhere - Jan 29, 2019
i personally think that disabling any AV will raise some suspicions.
RE: Is this a good idea? (FUD Antivirus Disabler) - I.M.P - Jan 29, 2019
(Jan 29, 2019 01:23 PM)JSanti13 Wrote: You're a stupid son of a bitch, aren't you?
Disabling AV will only prevent detection, since there's no AV to detect you. It's this think called logig and mayb you should use it.
yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means
RE: Is this a good idea? (FUD Antivirus Disabler) - JSanti13 - Jan 29, 2019
(Jan 29, 2019 01:28 PM)Atroxcity Wrote: yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means
Thanks for the response. We greatly appreciate your feedback and will use it to continue to improve our service. Have a nice day!
RE: Is this a good idea? (FUD Antivirus Disabler) - I.M.P - Jan 29, 2019
(Jan 29, 2019 01:30 PM)JSanti13 Wrote: Thanks for the response. We greatly appreciate your feedback and will use it to continue to improve our service. Have a nice day!
what? 😶
RE: Is this a good idea? (FUD Antivirus Disabler) - Takehito Morokuzu - Jan 29, 2019
(Jan 29, 2019 01:28 PM)Atroxcity Wrote: yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means
I have not gotten that message after disabling it on my end. I can block any exe file I want so I should be able to block that message if its related to an exe file that is running.
RE: Is this a good idea? (FUD Antivirus Disabler) - I.M.P - Jan 29, 2019
(Jan 29, 2019 01:31 PM)-yuno gasai- Wrote: I have not gotten that message after disabling it on my end. I can block any exe file I want so I should be able to block that message if its related to an exe file that is running.
oh intresting now thats pretty good 👍