[Takehito Morokuzu]

This software I coded can disable any antivirus or antimalware software, while being completely undetected.
The only problem is, the disable process only works in safe mode, so the software needs to reboot the computer in safemode then reboot back to normal mode.
Is this a good idea? I feel like it could be useful for certain targets, but not all.

EDIT: It is currently coded in batch but can be converted to almost any language easily.

[Goldmouth]

This software I coded can disable any antivirus or antimalware software, while being completely undetected.
The only problem is, the disable process only works in safe mode, so the software needs to reboot the computer in safemode then reboot back to normal mode.
Is this a good idea? I feel like it could be useful for certain targets, but not all.

EDIT: It is currently coded in batch but can be converted to almost any language easily.

Very nice man. This is diff very useful and even if not successful 100% of the time its still should work. Let me ask you, Does it work with NOD32? 🤗 🤗

[I.M.P]

I tried making something very similiar specifically for windows defender that used the same values yours does. But we already discussed this :)

[M2K]

Dude, I can say that that's super amazing really.


Does it work on windows 10 and servers?? if so im willing to pay for that script

[CapsLo0ck]

Dude, I can say that that's super amazing really.


Does it work on windows 10 and servers?? if so im willing to pay for that script

hello
you need crypter or fud ?

[Takehito Morokuzu]

Very nice man. This is diff very useful and even if not successful 100% of the time its still should work. Let me ask you, Does it work with NOD32? 🤗 🤗

Yes it does. I've only added like 10 av and it works on all of them, I just need to add support for more of them.

I tried making something very similiar specifically for windows defender that used the same values yours does. But we already discussed this :)

Dude, I can say that that's super amazing really.


Does it work on windows 10 and servers?? if so im willing to pay for that script

It works perfect on windows 10, no idea if it works on servers but I don't see why it wouldn't.

hello
you need crypter or fud ?

FUD at the time of writing

[enmafia2]

I won't use this personally but I would be interested in the method just for the knowledge.
Would it be possible to know how you achieved this?

Thanks and good job

[Takehito Morokuzu]

I won't use this personally but I would be interested in the method just for the knowledge.
Would it be possible to know how you achieved this?

Thanks and good job

Image File Execution Options ✌
It requires safe mode because the AV drivers don't block it in safe mode for some reason 😏
But this works on every single av i tested on, the exception being malwarebytes, however all I had to do was disable malwarebytes's safe mode boot, which isn't blocked and that allowed me to add it into IFEO. ✌

[Jacque Fresco]

Hey cool ill approached the same https://hackforums.net/showthread.php?tid=5878369
it also worked by starting up into safemode, displaying a SE message and reboot.

However here is a tip, a couple of Antiviruses have a msi installer, just check the registry HKLM\...\Uninstall for their uninstall string and run it Silently (like MsiExec.exe","/x {FD15FD84-2C5A-4C5F-BE83-79E2459856CA} /passive REBOOT=R) if thats not possible then create a new Account, Log it on and make Mouse clicks trough the uninstaller. Just dont ask me for a script on howto logon a different User (no RunAs doesnt do the job because the Gui will show up on the current user and simple hiding is risky also because some msi uninstaller popup a webpage too ("sadly that you uninstalled 'Antivirus'. State us why")) because i rage quiet google etc. after 2 days of searching for a solution.

Also to counter the suspicion fact, steal the Icon of the Antivirus and implement it into your own application (automatically of course) and let it display. Alot of users just watch for the Icon and think they are safe.

[Edge of Nowhere]

i personally think that disabling any AV will raise some suspicions.

[I.M.P]

You're a stupid son of a bitch, aren't you?
Disabling AV will only prevent detection, since there's no AV to detect you. It's this think called logig and mayb you should use it.

yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means

[JSanti13]

yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means

Thanks for the response. We greatly appreciate your feedback and will use it to continue to improve our service. Have a nice day!

[I.M.P]

Thanks for the response. We greatly appreciate your feedback and will use it to continue to improve our service. Have a nice day!

what? 😶

[Takehito Morokuzu]

yea but notifications to the user "HEY YOUR ANTIVIRUS MIGHT NOT BE WORKING" will cause suspicion I think thats what he means

I have not gotten that message after disabling it on my end. I can block any exe file I want so I should be able to block that message if its related to an exe file that is running.

[I.M.P]

I have not gotten that message after disabling it on my end. I can block any exe file I want so I should be able to block that message if its related to an exe file that is running.

oh intresting now thats pretty good 👍