Bypass avira detection [ TR/Dropper.GEN ]
I've seen a lot of members having trouble in bypassing avira detection ( TR/Dropper.GEN ). Well here is a simple trick to fix that. Avira detects the file assembly, Use the following values in your stub and then generate the server. This time it'll be FUD.
Download RESHACKER and the replace the version info of your stub with these values.
Code VALUE "FileDescription", "Hijack This"
VALUE "FileVersion", "2.00.0002"
VALUE "InternalName", "Hijack This"
VALUE "LegalCopyright", "© 2007 Trend Micro Inc"
VALUE "OriginalFilename", "Hijack This"
VALUE "ProductName", "Hijack This"
VALUE "ProductVersion", "2.00.0002"
VALUE "Assembly Version", "2.00.0002"
This made my server 0/33. It should work for you too.
Nice TUT mate, is there A way to bypass the detection 'BDS/Backdoor.Gen' ? (Without crypting as it's a DLL lol)
Are you sure this is the sollution ?
Because dropper detection pretty much says for itself that it reacts on a file getting dropped. But if this tutorial worked, Great! nice share!
Hijack this worked in 07 not 11.
DO NOT DEAL WITH THIS MEMBER
(May 19, 2011 03:15 AM)Gooples Wrote: Hijack this worked in 07 not 11.
This. Avira isn't stupid, they don't fall for assemblies anymore. Get a new RunPE or find the code that is detected and recode it.
May 19, 2011 04:29 AM
(This post was last modified: May 19, 2011 04:30 AM by MoonWalker.)
(May 19, 2011 03:15 AM)Gooples Wrote: Hijack this worked in 07 not 11.
If you don't know anything about it then please don't post here.
(May 19, 2011 03:39 AM)Banksу Wrote: This. Avira isn't stupid, they don't fall for assemblies anymore. Get a new RunPE or find the code that is detected and recode it.
I've tested this. I made a downloader and it was detected as TR/Dropper.GEN. but after doing this its FUD.
DO NOT DEAL WITH THIS MEMBER
May 19, 2011 04:43 AM
(This post was last modified: May 19, 2011 04:43 AM by Sheikh..)
This is an old trick actually. Btw just use CodeDom and selfmade or undetected RunPE
and its fud too.. Without assembly.
Well i think many time ago Soul Collector posted the same thing to bypass Avira but using GUI.
(May 19, 2011 04:29 AM)MoonWalker Wrote: If you don't know anything about it then please don't post here.
I've tested this. I made a downloader and it was detected as TR/Dropper.GEN. but after doing this its FUD.
Kid, I do know. L2 code then come back.
nice tut man. Thanks for the share.
Cool tutorial and very useful.Thanks.
Like I haven't seen this before ..
very old , now it dont work i have been useing another method
Doesn't work in the latest version of Avira. They don't fall for shit like this anymore.
This Set off More Avs TR/Dropper.GEN is for your Output
|
