Recent survey report shows, well-known brands of antivirus on the new computer virus killing rate of only 2 0%, and the drain of the kill rate was as high as 8 0 percent. So what is the cause of this situation? What is today the virus is too powerful, or antivirus limited capacity? Today we went through the examples to see what the“thorn blind”the antivirus eyes. Hack name: Qian Hack features: [free to kill]()program production Using the tool: the MaskPE Using the tools: Super flower Controller Use of tools: Private exe Protector **Hack confession:** Since Trojan software there is a“black”feature, so whenever they are released soon, it will be antivirus the killing. In order to avoid this situation, I began to study how to hacker program[free to kill](), so that a variety of antivirus software in front of them to become“blind”to. **How to play[free kill]()** Now Antivirus for any virus killing, is established in the have the virus feature code on the basis of. Hack in order to allow Trojan horse is not antivirus Avira, through a variety of methods for it to be modified or disguised, that is, be[free to kill]()processing. The current common[free kill]()method with shell, flower(instruction), modify the characteristics of the code, the transformation entry point, entry point, encryption, etc. While the current mainstream antivirus software and are using a composite pattern, and therefore a lot of times by a method very difficult to achieve[free kill]()effect, then you need a few ways to play[free kill]()effect. **Combat program[free to kill]()** A, [free to kill]()from within the program to start Ready for us to be[free to kill]()hacker program. The first encryption process, run the encryption program MaskPE, it is automatically modifying the PE file of the software, the program can be the original source code to disrupt, so that we can generate[free kill]()the Trojan or virus. Click on the“Load File”button to select the[free to kill]()program, in the“Select Information”in the list of arbitrarily selected one, and finally click“Make File”button in the pop-up window for the encryption of the file to save to(figure 1). ! [](/Article/UploadPic/2007-4/200742705611385.jpg)**second, the flower instructions confuse antivirus** Run“Super flower”, this is a new flower program. First, the server program directly drag to the program's main interface is released, and then in the“flower instructions”drop-down list, select a flower instructions, click the“flower”button on it(Figure 2). Thus, a section of the spend instruction was successfully added to hack the program code of the front, those from the file header to extract the characteristic Code of the virus also can not do anything. ! [](/Article/UploadPic/2007-4/200742705612931.jpg) **Third, the packers stop the antivirus analysis** Then add the shell process, so you can stop the virus will get the source code and the characteristic code for comparison. Run Private exe Protector this shell program, in the event of the“application”list settings need to be[free to kill]()hacker program. Then the following“settings”option in the“dynamic protection”ticked on, and finally click on the toolbar in the“start protection”button can immediately be added to the shell process(Figure 3). ! [](/Article/UploadPic/2007-4/200742705612539.jpg) **Fourth, the modified entry point 防特 levy code comparison** Finally change the entry point of the processing, its purpose and the packers is similar to the processing that is to get antivirus software and not from the hack program entry point to get the source code. Run PEditor this software to modify the program, click on the“Browse”button select hack program, find the“entry point”of this information option, then the original value plus 1, then click on the“Apply Changes”button to complete the just set to confirm(Figure 4). ! [](/Article/UploadPic/2007-4/200742705612125.jpg) When the hacking process to finish[free kill]()after the processing, the first to use multi antivirus it antivirus detection, not to install antivirus software the user can also be a multi-engine sample virus scanning site(www.virustotal.com)were detected. If you have not antivirus the Avira, but also in the local test through the[free to kill]()after the processing of whether the program can be normal operation. Only for this series of tests later to determine the hack program is[free to kill]()success.

Examples of the operation of how to make the antivirus software to“blind”-vulnerability warning-the black bar safety net