Just thought I'd write up a quick paper on how AV killers work. I'm not going into detail about how the file is deleted, or how any of the advanced stuff works...because that stuff is private, not a lot of people know that, I think. Not a lot of people know the part I'm telling you, either. This is not meant to bring on a new wave of skid malware that disables your AV, this is to bring common knowledge on how these things work so that they can be stopped. Okay! On to the fun. What is an AV killer? [*]Really? It kills your Anti virus...you knew that. How do they work? Before you learn how they work, let's take a peek at the registry really fast. There's a registry key in HKLM (which means you need admin privileges to write there). It's called: Software\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options What's so special about this? This allows you to set a "debugger" for any program you want (that isn't protected against this, like Avast!). What does this mean? Watch t
