Page 1 of 1

Anti Virus's block everything

Posted: 09 Sep 2006, 00:24
by r_sole
Antivirus's block every trojan that I've ever tried to use, so can someone answer me please, how your meant to use them? Im not trying to be rude in any way, Im just confused. How are you meant to use a trojan without it being picked up by anti-virus's?

Posted: 09 Sep 2006, 00:32
by Gogeta70
Turn off your antivirus temporarily.

Posted: 09 Sep 2006, 01:30
by r_sole
okay after re-reading my post i realised i worded it completely wrong. I mean the server gets picked up on the other persons anti-virus.

Posted: 09 Sep 2006, 04:22
by bad_brain
you have to bind the server to another file to camouflage it, and you have to use one which has the ability to disable AV-apps. but this will not work for every antivirus-app, only for the ones which don't have the ability of self-protection. Norton for example has self-protection, but no app is 100% secure, so check for vulnerabilities on the usual websites, some antivirus apps exclude certain file-types or directories from beeing scanned for example (on Norton it was (is?) the "Norton Protected Recycle Bin" as far as I remember).
I know, this trojan stuff is very interesting for beginners, but don't waste too much time with it.... :wink:

Posted: 09 Sep 2006, 18:56
by r_sole
Yeah I tried binding aswell, it would still get picked up.
Is it that the trojan I tried to use is specifically known by the antivirus and 'black-listed', or is it that the trojan gets picked up because of the suspicious way in which its written. Im just curious because I've read that you can buy trojans that will go undetected and wondering how theyre any differant.

Posted: 10 Sep 2006, 05:46
by bad_brain
the only difference is that such trojans have not made it into the signature-lists of the AV apps yet because the code is edited in some way, but it's just a question of time until they are found/reported by somebody and will become "detectable"... :wink:

fingerprints and signatures

Posted: 10 Sep 2006, 07:08
by DNR
Think of a virus 'signature' as a fingerprint.
The antivirus app compares the file's code to this fingerprint, the fingerprint is kept in a database of known suspects. If the file's code is a match or even close to a suspect fingerprint, it is red flagged.

Suspects evade detection because they don't have a fingerprint in the database yet, or it's print was modified enough to not be a match to a known fingerprint.

The otherway to evade detection is to not get scanned, i.e. prevent the antivirus app from working! :wink:

Posted: 10 Sep 2006, 16:31
by r_sole
ohh okay. So this means if you made your own trojan things would be all sweet then :D - Not that I would try because I'm much too lazy, but thanks for clearing all that up for me. Say, are there open source trojans you can get somewhere to look at and see how they are coded, just to give an idea of how it is done. If not it doesn't matter, but just wondering.

Posted: 10 Sep 2006, 17:47
by Gogeta70

Posted: 10 Sep 2006, 18:43
by r_sole
Thanks, thats sites pretty cool...Um this is gonna sound really stupid, but how do you turn a .cpp file into an exe. I got something called 'Bloodshed Dev-C++' but it was not was I was looking for. Isnt there some program that will just turn a cpp file into an exe?

Posted: 10 Sep 2006, 19:00
by Gogeta70
Dev C++ is exactly what you're looking for. It's a compiler. This is where the script kiddie part comes in: learn some C++.

Posted: 10 Sep 2006, 19:05
by r_sole
haha okay point taken.