moonlit Posted September 29, 2006 Share Posted September 29, 2006 Project on hold, my hat's getting sun-bleached... URL Removed. AVKill 1.0 by Moonlit ===================== Description: ============ This tool will kill a selection of antivirus applications. The antivirus application will be killed only until the next reboot, no files are modified or destroyed. Usage: ===== Run Esc.exe either manually or via a batch or script. The AV killer (AVKill.exe) will be run under System priviledges and kill the AV software. Todo: ===== Add tray icons to simulate the appearance of the AV being fully functional. One axample would be where AVG might grey out it's tray icon to show something is not working, need to make it show a coloured icon to avoid suspicion. Add more antivirus apps to be killed. Possibly add firewalls and anti-spyware apps to help avoid detection even further. Add options/switches to kill totally (remove AV), use tray icon(s), restart AV when done or after a certain time period. Merge to 1 exe. History/Fixes: ============== V1.0: Fixed 100% CPU usage, removed test forms, fixed 'root dir only' bug. v0.5: Added AVG, Avast, NOD32 and Trend. Greetz: ======= Melodic, Bigbro and Kainchick for testing, #hak5 on irc.hak5.org for help & support. Duped in Switchblade thread for relevance, here for those who don't read aforementioned thread. Edit: Updated versions available, see wiki page for info - will be updating wiki page more regularly than here most likely so keep an eye out :) Quote Link to comment Share on other sites More sharing options...
Darren Kitchen Posted September 29, 2006 Share Posted September 29, 2006 Very sweet. Makes switchblade more powerful. Edit: http://www.hak5.org/wiki/AV_Killer Quote Link to comment Share on other sites More sharing options...
armadaender Posted September 29, 2006 Share Posted September 29, 2006 Tested and worked for me. Very nice work Moonlit Quote Link to comment Share on other sites More sharing options...
cooper Posted September 29, 2006 Share Posted September 29, 2006 Any code for it? Maybe a description of how it does its thing? Quote Link to comment Share on other sites More sharing options...
CaveMan Posted September 29, 2006 Share Posted September 29, 2006 that is 1337... but i still need a u3 memory stick :'( Quote Link to comment Share on other sites More sharing options...
Emilml Posted September 29, 2006 Share Posted September 29, 2006 Thats just 1 mad prog u mixed up there Thx ;D Quote Link to comment Share on other sites More sharing options...
wetelectric Posted September 29, 2006 Share Posted September 29, 2006 You evil evil person Quote Link to comment Share on other sites More sharing options...
armadaender Posted September 29, 2006 Share Posted September 29, 2006 I can't wait for this to be implemented into the switchblade. Having a device that would not only grab the lm hash and other passwords, but also kill the av so you could easily install/infect anything you wanted without anyone knowing. All with just the insertion of a thumbdrive. This could be a very bad thing in the wrong hands. :twisted: Quote Link to comment Share on other sites More sharing options...
DLSS Posted September 29, 2006 Share Posted September 29, 2006 esc doesnt seem to do anything (not even start the avkiller) and so doesnt affect avast , running avkilled does :D <3 ya m8 Quote Link to comment Share on other sites More sharing options...
Emilml Posted September 29, 2006 Share Posted September 29, 2006 Just tested the avkill 1.0 and the 1.1 on 2 computers Running Symantech Corporate Antivirus Editon and it does nothing to it :p Quote Link to comment Share on other sites More sharing options...
moonlit Posted September 29, 2006 Author Share Posted September 29, 2006 Just tested the avkill 1.0 and the 1.1 on 2 computers RunningSymantech Corporate Antivirus Editon and it does nothing to it :p Symantec (expecially Corp) isn't implemented yet, keep an eye on the wiki for future updates :) esc doesnt seem to do anything (not even start the avkiller)and so doesnt affect avast , running avkilled does :D http://home.euphonynet.be/dlss/images/lv3moonlit.png <3 ya m8 Yeah, new method in v1.11, Esc.exe isn't needed any more :) Quote Link to comment Share on other sites More sharing options...
DLSS Posted September 29, 2006 Share Posted September 29, 2006 sorry but it doesnt run as system :,( ... could u try n fix tht ? and could u get it to run less tasks ? Quote Link to comment Share on other sites More sharing options...
moonlit Posted September 29, 2006 Author Share Posted September 29, 2006 Are you on Windows 2k, XP or 2k3 w/Admin priviledges? It relies on the AT command to escalate itself and so requires these... If you have a bug for me to fix I'll need more info I'm afraid like what OS, which AVKill version, level of user rights, method used to run the app and what it runs as... :) Less tasks? I'm not sure I get you, unless you're running version 1.0 in which case I'd recommend you upgrade to v1.11 which uses only 1 process. Quote Link to comment Share on other sites More sharing options...
DLSS Posted September 29, 2006 Share Posted September 29, 2006 Are you on Windows 2k, XP or 2k3 w/Admin priviledges?It relies on the AT command to escalate itself and so requires these... If you have a bug for me to fix I'll need more info I'm afraid like what OS, which AVKill version, level of user rights, method used to run the app and what it runs as... :) Less tasks? I'm not sure I get you, unless you're running version 1.0 in which case I'd recommend you upgrade to v1.11 which uses only 1 process. well it still runs as the user, i am running on a xp pro 64x edition. sorry bout that thing bout lot of task running , my system is now doing it on its own . so i'll ask wot for on another thread ...) also when trying to incorporate it into a switchblade without nircmd it opens 3 windows for a slight second , those shudn't b visible (but i'll run it thru nircmd .... (if it still works tht way) Quote Link to comment Share on other sites More sharing options...
moonlit Posted September 29, 2006 Author Share Posted September 29, 2006 Are you on Windows 2k, XP or 2k3 w/Admin priviledges?It relies on the AT command to escalate itself and so requires these... If you have a bug for me to fix I'll need more info I'm afraid like what OS, which AVKill version, level of user rights, method used to run the app and what it runs as... :) Less tasks? I'm not sure I get you, unless you're running version 1.0 in which case I'd recommend you upgrade to v1.11 which uses only 1 process. well it still runs as the user, i am running on a xp pro 64x edition. sorry bout that thing bout lot of task running , my system is now doing it on its own . so i'll ask wot for on another thread ...) also when trying to incorporate it into a switchblade without nircmd it opens 3 windows for a slight second , those shudn't b visible (but i'll run it thru nircmd .... (if it still works tht way) Yeah it's 32-bit only which could well be why... The 3 windows are NET STOP commands and I've not heard anyone really complain, one or two people have mentioned it but the windows don't appear for long enough to see during mine and others' testing... Quote Link to comment Share on other sites More sharing options...
Emilml Posted September 29, 2006 Share Posted September 29, 2006 Just tested the avkill 1.0 and the 1.1 on 2 computers RunningSymantech Corporate Antivirus Editon and it does nothing to it :p Symantec (expecially Corp) isn't implemented yet, keep an eye on the wiki for future updates :) I played around whit the av killer for a bit and i found out that the hack did something weird to my av after all when i tried to open pwdump or anything listed as a virus or stuff like that it just removed them but there wasn’t a big popup whit warning and stuff. It didn’t remove the av icon from my process bar "And that’s a big Plus" so actually if I got it to run whit fx. the Switchblade, it could copy the stuff and then first l8ter when the computer was restarted give the warnings "when im over all hills" But this makes it a 1 time hack caucus right afther the stuff has ran it deletes them. Quote Link to comment Share on other sites More sharing options...
moonlit Posted September 29, 2006 Author Share Posted September 29, 2006 Yeah I do have some Symantec killer code in there but it's currently unfinished and borked, it's possible it might knock off parts of Symantec but I haven't said it supports Symantec yet since it's unlikely to really do much... Quote Link to comment Share on other sites More sharing options...
a5an0 Posted September 30, 2006 Share Posted September 30, 2006 Good work. I like where this is going. Any chance you could post the source (o the wiki or the forum) so we can see how it works, or maybe help out with dev? Good work! Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 1, 2006 Author Share Posted October 1, 2006 Yeah the code will be up shortly, you'll likely be disappointed at how simple it is ;) Quote Link to comment Share on other sites More sharing options...
anyedie Posted October 1, 2006 Share Posted October 1, 2006 very kewl! yea lets see the code! Quote Link to comment Share on other sites More sharing options...
Deveant Posted October 2, 2006 Share Posted October 2, 2006 T_T downloads are down, so just wondering if u want a mirror? ive got a server free atm and am happy to host small files (anythink under 50mg) if ur interested, please send me out an email to ste03_aus@hotmail.com and ill set u up FTP access. Server is 98% Uptime and hosted in Aus ^^ Quote Link to comment Share on other sites More sharing options...
CaveMan Posted October 2, 2006 Share Posted October 2, 2006 yea i can also provide a mirror, just pm me Quote Link to comment Share on other sites More sharing options...
moonlit Posted October 2, 2006 Author Share Posted October 2, 2006 I actually took them down because I was concerned about misuse. The project will likely continue but I will probably make it a little more difficult (though not impossible by any means) to get hold of the laterst source/binaries. Apologies for the downtime, hope y'all can appreciate my thoughts there and we'll be right back after this short message from our sponsors... ;) Edit: On saying this, I will still keep the wiki updated, just so you all know that's still the place to go to find it all :) Quote Link to comment Share on other sites More sharing options...
Emilml Posted October 2, 2006 Share Posted October 2, 2006 /me cheks wiki now Quote Link to comment Share on other sites More sharing options...
DLSS Posted October 2, 2006 Share Posted October 2, 2006 I actually took them down because I was concerned about misuse. The project will likely continue but I will probably make it a little more difficult (though not impossible by any means) to get hold of the laterst source/binaries.Apologies for the downtime, hope y'all can appreciate my thoughts there and we'll be right back after this short message from our sponsors... ;) Edit: On saying this, I will still keep the wiki updated, just so you all know that's still the place to go to find it all :) k pls do keep us informed bout were to get it tho, cos i really like it . Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.