Setting Backdoor Access To CMD For Further Accesses If You Forgot Windows Password

In this tutorial I am going to teach you how to gain access to cmd.exe on the welcome screen.

What is the use for setting backdoor cmd?
This is for precaution if you have forgottern your windows password.


Follow these easy steps to set backdoor access to cmd.exe:

1) Open "My Computer" then go to your local disk. Then go to WINDOWS > system32
2) Search for "cmd.exe" and copy it to your desktop.
3) Rename the newly copied "cmd.exe" to "sethc.exe"
4) Replace the "sethc.exe" with the original "setch.exe" in system32

Then you have set backdoor access to cmd.exe so you can open it anytime by pressing the SHIFT key 5 times. You can also open it in the welcome screen to hack user passwords.... to know how to hack passwords using cmd read it HERE

Hacking Windows XP User Passswords

With this way you can hack and replace the windows password without knowing the old password.

Once you have access to any account in your computer, go to Start menu > Run... > type in "cmd.exe"

There should be a MS-DOS prompt window popup. Then type in "net user"

It will list all user accounts in your computer, remember the exact name of the user account that you wanted to hack or just hack into the administrator account password

Once you have decided which account you want to hack then type exactly "net user USERNAME *"

Then it will ask you for new password without asking the old password.

Creating Windows Password Reset Disk

Windows is a operating system which is realeased by Microsoft and user account is one of the best feature.There can be many users for a single computer which is installed with windows every one can have their own personal settings and they can maintain their personal files. now if a user wants to log inside another users account then he should be aware of the password of the other user. so every user user has a password for their account and still in this busy world we might even forget the password which we set to our account and if we forget the password then we can’t log inside our account to avoid such situation. we can create a password reset disk by following the below ways :

Windows XP, Vista :

1. Click on Start and then Control Panel.
2. Click on the User Accounts and Family Safety link.Note: If you’re viewing the Classic View of Control Panel, you won’t see this link. Simply double-click on the User Accounts icon and proceed to Step 4.
3. Click on the User Accounts link.
4. In the task pane on the left, click the Create a password reset disk link.
5. When the Forgotten Password Wizard window appears, click NextNote: You will need some kind of portable media before being able to create a password reset disk. This means that you will need a flash drive or a floppy disk drive and blank floppy disk.
6. In the I want to create a password key disk in the following drive: drop down box, choose the portable media drive to create a password reset disk on.Click Next to continue.
7. With the disk or other media still in the drive, enter your current account password in the text box and click Next.
8. Windows Vista will now create the password reset disk on your chosen media.hen the progress indicator shows 100% complete, click Next and then click Finish in the next window
9. You can now remove the flash drive or floppy disk from your computer.abel the disk “Password Reset” and store it in a safe place.

Windows XP :

1. Click on Start and then Control Panel.
2. Click on the User Accounts link.Note: If you’re viewing the Classic View of Control Panel, double-click on the User Accounts icon.
3. In the pick an account to change area of the User Accounts window, click on your Windows XP user name.
4. In the Related Tasks area on the left, click the Prevent a forgotten password link.
5. When the Forgotten Password Wizard window appears, click NextNote: You will need a floppy disk drive and a blank floppy disk.
6. On the next screen, verify that a blank floppy disk is inserted in your floppy disk drive.
   Click Next to continue.
7. With the disk still in the drive, enter your current account password in the text box and click Next.
8. Windows XP will now create the password reset disk.
   When the progress indicator shows 100% complete, click Next and then click Finish in the next window.
9. You can now remove the floppy disk from your computer.
   Label the disk “Password Reset” and store it in a safe place.

APK Edit, Edit Your Own APK

Ever wanted to simply change an icon on your Android phone and found yourself lost in the endless lists of forum posts saying: you have to change heaven and earth to do this...
NOT ANYMORE!!!!

APK Edit is born!
(BTW, APK Edit has a child on its own now... I called him: File To Barcode)
If you like it, celebrate with me

With this little program you can simply change icons of your android application. It even lets you change the applications name.
But wait mike..... there's more.....
It even lets you edit the text used in applications.

Sounds to good to be true...
Well... to be honest.... it is.
But I've come a long way from that initial question to the final answer.
My conclusion so far, it works for most of my applications.
It probably will work on most of yours as well.

Try it out now!



(Caution: when overwriting an existing application you will loose your associated data!!!)

Special thanks goes out to:
Brut.all for creating Apktool, the backbone of this little project.

Requirements:
Java & .Net Framework 3.5 (Why build on one platform if you can build on two? I know, I know....)
For installing system apps - S-OFF

Nice to know:
Clicking on the [Icons:] tag in the General tab will open a browser window and search for icons in "Google images".
Donations will be "forwarded" to fellow developers like Brutt.all and others, reinforcing the greatness of today's world.

How the magic works:
When opening an APK file it first tries to decompile it using APK Tool (with the version selected in the settings tab)
If decompile failed, because of a missing framework file, it tries to find this file on your phone.
Most of the times it will find what its looking for, pull it off your phone and tries to recompile the whole thing again.
If somehow it cannot find the required framework file, it will provide you a list of possible files on your phone. You can then choose the correct file yourself.
Assuming this process finishes without any problem you now can edit the apk file.
When you press Apply it will recompile the apk and then sign the newly compiled file.
- System APK files (APK files that needed an additional framework file) will get a copy of the original signature.
- Other APK files will get a brand new signature.
When you Click the phone animation it will push the APK to your phone
- System APK files will be pushed to /system/app (ADB PUSH)
- Other APK files will be installed the normal way (ADB INSTALL)
If install failed due to some signature failure it will do some additional fancy tricks and try it again.

Upcoming features:
New option in settings tab -> Only allow one instance of APK Edit to open at once.
New option in settings tab -> Add/remove APK file association to registry.
New option on startup -> Option to open up a "Phone Explorer", lets you edit APK files directly from phone.

Known issues:
CarHomeGoogle.apk - Doesn't save changes
Quickoffice.apk - Doesn't show up after installing

DOWNLOAD

Invisible Protector The Best Android App Protector

Invisible Protector protects your private applications by fake crash.When launching a protected app, it will throw a fake crash error which may mislead guest user into thinking that your app has a glitch or something. So it can stop guest from using your protected app in a natural manner.And it is hidden in the app menu. You only can access it by dial #999 followed by the call button.

# Guide

1. Press an application in the list and select 'Protect' or 'Remove protect' context menu item to add/remove protect an application
2. Enable protector, set password and select an unlock mode in Menu > Setting,the default password is empty
3. When launching the protected application, it will popup a runtime error
4. dialog, unauthorized people will be cheated and may click close button to close it
5. For the owner, you can dismiss the error dialog by the mode you selected in
6. Setting menu, please refer to the next section for detail

# Unlock Modes

1. Double tap dialog message: when error dialog pop, double tap the message body of the dialog, then you can get the protected application
2. Five tap dialog message: when error dialog pop, tap the message body five times
3. Rotation: when error dialog pop, do the following motion to dismiss it:
   • Make your mobile screen face up at first
   • Start to rotate your wrist make the mobile screen face down
   • Then rotate your wrist in opposite direction to make the mobile screen face up again
4. Double Rotation: similar to Rotation mode, but continue do it twice
5. Password: click the report button on the error dialog, it will open a report feedback form. Of course, it's a fake form too. Then input password in the feedback text field. It will auto check what you typing and needn't click any button.
6. Proximity: when error dialog pop, put your palm cover on (don't touch any button) the phone screen for 2 seconds; or put phone on your ear just like listening an incoming call for 2 seconds; or put phone screen close to your body for 2 seconds.

# FAQs

• How to protect Locker itself
  Go menu > Setting > Password, to set a password for it, the password is used for password unlock mode and self-protection.
  
• How to lock SMS?
  You need protect all sms apps if you install multiple SMS related applications.
  
• How to lock pictures?
  1) You need protect both Gallery and Camera
  2) Other apps that can access to the pictures, such like file explorer
  
• How to prevent someone from bypassing App Locker
  1) You need to protect Market, Setting and all Task Killers
  2) Don't kill Android Protector process

DOWNLOAD

Bypassing Android's App Protector Using Nothing!

Did your have a friend that is using Android phone and he locked(protect) some of his app with some kind of protector like "Perfect AppLock" or any other utilities. Normally they are protecting by a password or any other special ways. But it doesn't matter, there is a way to let you show off by bypassing the protector.


NOTE: The "Settings" app must be unprotected or he got an unprotected task killer or you will not able to bypass the protector.

If the "Settings" is not locked then go in to the setting, then choose Applications, then Running Process. Look for a process that the name is similar to the protector or it is exactly the same with the protector. Click on it, then choose the "End task" or "Force close" button.... And..................... Tadadada, you had byppassed it!

If he got the "Settings" protected and the taskiller is unprotected then open the following taskkiller. Look for a process that the name is similar to the protector or it is exactly the same with the protector. Click on it, then choose the "End task" or "Force close" button.... And..................... Tadadada, you had byppassed it!

It will not work if both of it is protected. But mostly they will not protect it for easy accesses.

The End Of Facebook... Be Prepared No Matter It Is True Or Not.

PALO ALTO, CA –Mark Zuckerberg announced that Facebook will be shut down in March of 2012. Managing the site has become too stressful.

“Facebook has gotten out of control,” said Zuckerberg in a press conference outside his Palo Alto office, “and the stress of managing this company has ruined my life. I need to put an end to all the madness.”

Zuckerberg went on to explain that starting March 15th of next year, users will no longer be able to access their Facebook accounts. That gives users (and Facebook addicts) a year to adjust to life without Facebook.

“After March 15th, 2012 the whole website shuts down,” said Avrat Humarthi, Vice President of Technical Affairs at Facebook. “So if you ever want to see your pictures again, I recommend you take them off the internet. You won’t be able to get them back after Facebook goes out of business.”

Zuckerberg said the decision to shut down Facebook was difficult, but that he does not think people will be upset.

“I personally don’t think it’s a big deal,” he said in a private phone interview. “And to be honest, I think it’s for the better. Without Facebook, people will have to go outside and make real friends. That’s always a good thing.”

Some Facebook users were furious upon hearing the shocking news.

“What am I going to do without Facebook?” said Denise Bradshaw, a high school student from Indiana. “My life revolves around it. I’m on Facebook at least 10 hours a day. Now what am I going to do with all that free time?”

However, parents across the country have been experiencing a long anticipated sense of relief.

“I’m glad the Facebook nightmare is over,” said Jon Guttari, a single parent from Detroit. “Now my teenager’s face won’t be glued to a computer screen all day. Maybe I can even have a conversation with her.”

Those in the financial industry are criticizing Zuckerberg for walking away from a multibillion dollar franchise. Facebook is currently ranked as one of the wealthiest businesses in the world, with economists estimating its value at around 7.9 billion.

But Zuckerberg remains unruffled by these accusations. He said he will stand by his decision to give Facebook the axe.

“I don’t care about the money,” said Zuckerberg. “I just want my old life back.”

The Facebook Corporation suggests that users remove all of their personal information from the website before March 15th, 2012. After that date, all photos, notes, links, and videos will be permanently erased.

Set An Image As A Folder's Background

You have to have a photo in ur folder for example:sample.jpg.
After that,just open notepad and write:

[{BE098140-A513-11D0-A3A4-00C04FD706EC}] ICONAREA_IMAGE=sample.jpg ICONAREA_TEXT=255
Save it as "desktop.ini"

Make Your Pirated Windows XP Genuine

Windows Genuine Ballon Hack The fix works a treat.

1. C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data

inside you will find a file called Data.dat open that file with notepad and
delete all the stuff in it… now save the file and set it as read only and restart pc but in SAFE mode ** Yes, this step is required ** ** Will NOT immediately solve problem until rest of steps completed **

Now go to c:\windows\system32 folder: MUST be in safemode

wgalogon.dll ** You CANNOT delete this file. RENAME it to wgalogon.bbb ***
spmgs.dll ** This is a spelling error. File is actually spmsg.dll. RENAME it to spmsg.aaa **
wgatray.exe *** DELETE this file ***

Now go to C:\WINDOWS\Software\Distribution\Download and DELETE the following folder

6c4788c9549d437e76e1773a7639582a

REBOOT & all should be resolved

End the process wgatray.exe in Windows TaskManager and restart Windows XP in safe mode. Now delete the following files:

Delete WgaTray.exe from c:\windows\system32
Delete WgaTray.exe from c:\windows\system32\dllcache

Start Windows Registry editor and delete the folder "WGALOGON" located in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\WinlogonNotify. Delete all references in your registry to WgaTray.exe

Another alternative suggest that three files are installed Windows XP System Folder:

\WINDOWS\system32\WgaLogon.dll
\WINDOWS\system32\WgaTray.exe
\WINDOWS\system32\LegitCheckControl.dll

The wgatray.exe process makes the check for genuine windows software. You can disable WGA by removing the execute bit on WgaLogon.dll. That way, winlogon can't call it as a notification package at boot, and since WgaLogon is responsible for running and maintaining WgaTray.exe, no more tray popups either.

To change the execute bit of WgaLogon.dll, first turn off Simple File Sharing. Now right click the file in Windows Explorer and open the Security Tab. Hit the Advanced button, uncheck the Inherit box at the bottom, hit the Copy button, then hit OK. Go through each listed user/group and remove the "Read & Execute" permission for that file, leaving the "Read" permission as-is.

Hit OK to apply the permission changes and close the file properties dialog. Restart the machine. You can now turn "Use simple file sharing" back on, if you want.

A third alternative posted on the internet suggest that users clear the content of file data.dat located in the following directory:
C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage\data

Hide Or Lock Your Drive(s)

Open Registry (go to run command, type "regedit" and press enter)

Then go to this key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Now right click in right side pane and create DWORD Value (blue color)

Rename it as "NoViewOnDrive" (for locking drive)
or
Rename it as "NoDrives" (for Hiding drive)

Double click on it and put some numbers to lock ur desired Drive and click ok.

DRIVE NOS.
FOR A : 1
FOR C : 4
FOR D : 8
FOR E : 16
FOR F : 32
FOR G : 64
FOR H : 128

Finally restart or log-off the computer to take effect.


Keep in mind that "0" is Default Value to Disable or remove this setting..


After locking the drive when u try to open it, u will see a msgbox like this
"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator"

Hide Your User Account In Windows XP

If your parents have recently locked you out of their computer, then there is a way to make your account invisible, so they wont know that your account exists, and you can still log in.

You have to edit your registry for this, so if you dont want to take the risk, then dont do it.

First off, you have to create your account.

1) Turn on computer and keep hitting F8 untill you are at the safe mode screen selection.
2) Log in the administrator account, it shouldnt require a password, if it does, that means that your parents locked that account and you cant create you account.
3) If you are in, then go to control panel and create your account.
4) Restart your computer, and logg in your account. After everything is loaded, go to Start > Run > Regedit. The registry will popup.

Ok, now follow this root to make your account invisible.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\SpecialAccounts\UserList

Now right click, and go to New > DWord Value and name it YOUR EXACT USER NAME, like if your use name is JunglePrince then make it JunglePrince, if its jUNGLEpRINCE, then name it jUNGLEpRINCE.

Now the value should be zero, if it isnt, the right click the value you just made and go to Modify, and make sure Value data is 0.

Now restart, and at the log in screen, you want see your username, now hit CTRL+DEL+ALT twice, and it will switch to a diffrent loggin screen. Once it happens, logg in with your name, and TADA!.

Send Anonymous Emails

Have you ever think about sending emails to someone from any address? It is called email spoofing.

What is the aim of sending anonymous mails? You can:

• Catch a cheating spouse husband or wife.
• Find out if your friend is are real friend
• Give warnings to people
• Inform the police about illegal activities
• Inform the tax office about tax cheaters
• Confess your love to somebody
• Play an email joke with your friends
• When your own email service doesn’t work
• If your private email is banned by the recipient
• Report fraud to your boss or institution
• And many more reasons…

How to?

1) Visit HERE and fill in the form.
2) Done! You had sent the email with the address you choose.

Internet Download Manager 5.12 FULL CRACKED

Internet Download Manager (IDM) is a tool to increase download speeds by up to 5 times, resume and schedule downloads. Comprehensive error recovery and resume capability will restart broken or interrupted downloads due to lost connections, network problems, computer shutdowns, or unexpected power outages. Simple graphic user interface makes IDM user friendly and easy to use.Internet Download Manager has a smart download logic accelerator that features intelligent dynamic file segmentation and safe multipart downloading technology to accelerate your downloads. Unlike other download managers and accelerators Internet Download Manager segments downloaded files dynamically during download process and reuses available connections without additional connect and login stages to achieve best acceleration performance.

Internet Download Manager supports proxy servers, ftp and http protocols, firewalls, redirects, cookies, authorization, MP3 audio and MPEG video content processing. IDM integrates seamlessly into Microsoft Internet Explorer, Netscape, MSN Explorer, AOL, Opera, Mozilla, Mozilla Firefox, Mozilla Firebird, Avant Browser, MyIE2, and all other popular browsers to automatically handle your downloads. You can also drag and drop files, or use Internet Download Manager from command line. Internet Download Manager can dial your modem at the set time, download the files you want, then hang up or even shut down your computer when it's done.

Other features include multilingual support, zip preview, download categories, scheduler pro, sounds on different events, HTTPS support, queue processor, html help and tutorial, enhanced virus protection on download completion, progressive downloading with quotas (useful for connections that use some kind of fair access policy or FAP like Direcway, Direct PC, Hughes, etc.), built-in download accelerator, and many others.

Version 6.07 adds IDM download panel for web-players that can be used to download flash videos from sites like YouTube, MySpaceTV, and Google Videos. It also features complete Windows 7 and Vista support, YouTube grabber, redeveloped scheduler, and MMS protocol support. The new version also adds improved integration for IE and IE based browsers, redesigned and enhanced download engine, the unique advanced integration into all latest browsers, improved toolbar, and a wealth of other improvements and new features.

Download FULL CRACKED Version
Cracked by, ANON.h3 

View Blocked Youtube Videos! Working 2012

How to view any blocked, copyrighted, or 18 rated videos on youtube! This post is updated and works on 2012. I tried it today.

If the video is blocked or requires you to login before viewing the video, then you will probably need to read this post.

1- View the URL of the video:

http://www.youtube.com/watch?v=ayJ_HvFwa0M

2- Edit the URL:

*Remove /watch
*Change ? to / and = to /

http://www.youtube.com/v/ayJ_HvFwa0M

3- Then go to the address and try.

Useful Javascript Codes For Browser

How to use these codes? Copy and paste it the the address bar, press enter and get the effect.

Make your browser move it self -- Click here to see the effect
javascript:function Shw(n) {if (self.moveBy) {for (i = 35; i > 0; i--) {for (j = n; j > 0; j--) {self.moveBy(1,i);self.moveBy(i,0);self.moveBy(0,-i);self.moveBy(-i,0); } } }} Shw(6)

Edit any part in the webpage -- Click here to see the effect
javascript:document.body.contentEditable='true'; document.designMode='off'; void 0

Send A DDOS Attack Using CMD

DoS Attack With Your Home Pc To Any WebSite U Want To Be Killed!!

------------------------
DoS Attack Stands For Denial of Service Attack
------------------------
What Is DoS?

A: Denial of Service (DoS) attackes are aggressive attacks on an individual Computer or WebSite with intent to deny services to intended users.
DoS attackes can target end-user systems, servers, routers and Network links(websites)

Requirments:
1- Command Prompt (CMD or DOS) Which is usually integrated in all Windows.
2- Ip-Address of Targeted Site.

How TO GET IP OF ANY SITE??"
No problem.. here is the solution..
open ur CMD (command prompt).. and type
--------------------------------------------------
nslookup Site-Name
--------------------------------------------------
(e.g nslookup www.google.com)

It will show u ip of the site.

ohk now write this command in CMD For Attack on Any Site/ Server..
---------------------------------------------------
ping SITE-IP -l 65500 -n 10000000 -w 0.00001
---------------------------------------------------
-n 10000000= the number of DoS attemps.. u can change the value "10000000" with ur desired value u want to attempt attack.

SITE-IP= Replace the text with the ip address of the site u want to be attacked..

-w 0.00001 = It is the waiting time after one ping attack.

NOTE: Dont Change or Remove -l, -n and -w in this command.. otherwise u will not able to attack

How To Find IP Address From A Sender

When you receive an email, you receive more than just the message. The email comes with headers that carry important information that can tell where the email was sent from and possibly who sent it. For that, you would need to find the IP address of the sender. The tutorial below can help you find the IP address of the sender. Note that this will not work if the sender uses anonymous proxy servers.

Finding I.P Address In Gmail

1. Log into your Gmail account with your username and password.
2. Open the mail.
3. To display the headers,
* Click on More options corresponding to that thread. You should get a bunch of links.
* Click on Show original
4. You should get headers like this:
Gmail headers : name
Look for Received: from followed by a few hostnames and an IP address between square brackets. In this case, it is

65.119.112.245.
That is be the IP address of the sender!
5. Track the IP address of the sender


Finding I.P Address In Yahoo Mail


1. Log into your Yahoo! mail with your username and password.
2. Click on Inbox or whichever folder you have stored your mail.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on General Preferences
* Scroll down to Messages where you have the Headers option
* Make sure that Show all headers on incoming messages is selected
* Click on the Save button
* Go back to the mails and open that mail
5. You should see similar headers like this:
Yahoo! headers : name
Look for Received: from followed by the IP address between square brackets [ ]. Here, it is 202.65.138.109.
That is be the IP address of the sender!
6. Track the IP address of the sender

Finding I.P Address In Hotmail

1. Log into your Hotmail account with your username and password.
2. Click on the Mail tab on the top.
3. Open the mail.
4. If you do not see the headers above the mail message, your headers are not displayed. To display the headers,
* Click on Options on the top-right corner
* In the Mail Options page, click on Mail Display Settings
* In Message Headers, make sure Advanced option is checked
* Click on Ok button
* Go back to the mails and open that mail
5. If you find a header with X-Originating-IP: followed by an IP address, that is the sender's IP address
Hotmail headers : name ,In this case the IP address of the sender is [68.34.60.59]. Jump to step 9.
6. If you find a header with Received: from followed by a Gmail proxy like this
Hotmail headers : name
Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [69.140.7.58]. Jump to step 9.
7. Or else if you have headers like this
Hotmail headers : name
Look for Received: from followed by IP address within square brackets[].
In this case, the IP address of the sender is [61.83.145.129] (Spam mail). Jump to step 9.
8. * If you have multiple Received: from headers, eliminate the ones that have proxy.anyknownserver.com.
9. Track the IP address of the sender

Making Your Remote Keylogger Or server.exe Undetectable

Hello people. Since I had many people asking me how to hexedit, I decided to write
this little tutorial. I will try to explain how to hexedit your favourite Trojan in order to
make it undetected by certain antivirus programs. I will try to put this as simple as
possible so everyone understands it.

Content:
1. General info about hexediting .
2. What tools you need to get started.
3. How to hex.
-step 1
-step 2

__________________________________________________ ___________________
1. General info about hexediting?
If you want to make your server undetectable, you need to know how AVs work and
how they detect your files, right? There are a few ways that AVs use to detect your
server heuristics, sandboxing, etc., and one of them is using so called "definition files"
that carry information about strings inside your server. Well, that�s the way we�re
going again in this tutorial because hexing is pretty much useless for other methods of
detection. So when AVs scan your files it searches for specific stings on specific parts
in your server, and if strings match with strings in the AV database, your file is
detected.
Let�s say that detected strings are "XX" so we need to change that string to something
else (e.g. "XY","YY") that isn�t in the AV definition database so the file can�t be
matched with any of the AV definitions and that way the file will be undetectable.
There are going to be a few tagged strings in your server - not only one, depending on
what trojan you�re using and how popular is. Less popular trojans tend to have less
tagged parts, and with that they are easier to make it undetectable.
First of all, hexing is not the best method for undetecting files because AVs can
change old tagged parts, and once your AV is updated, new definition files are
downloaded and your once undetected server might become detected again. Also not
all AVs use the same tagged parts - this way you need to hex your server against more
AVs to make it fully undetected. This can be annoying because you need to download
wanted AVs then hex it your server, then download another etc., etc. Sometimes AVs
tag critical parts of the server, and if that part is altered will corrupt the server. Also,
heavily edited servers can become unstable, some functions might not work, or even
you can corrupt your server and make it useless.
That�s why you need to check your server if it�s still working after every single
change you made while hexing it.
Now how to find detected strings in your server?
There are few ways you can do this: Manually cut your server in half adding 00�s to
one half and scanning it until you find the detected string (which is slow and time
consuming); use file splitters like UKSplitter that are going to split your server into
bytes, and after that scan all split files and find out what byte is detected then alter it
in original exe, or you can use an offset finder like AV Devil.
2. What tools we need.
- Unpacked trojan server.
(your favorite trojan server)
- Hex editor.
(I will use Hex WorkShop, you can find it at www.hexworkshop.com)
 

- Offset finder
(AVDevil, you can find it at www.trojanfrance.com)
3. How to hex:
-Step 1.
Turn your AV real-time protection �OFF� . Make your Trojan server and
make sure that is not packed.
Open AV Devil and select your server. After selecting, the server msg will pop up
click OK, and the next msg will popup asking you to turn your AV real-time
protection back �ON�. After you do that just click "OK" and lets AV Devil
search for detected offsets.
During the search your AV will pop up a couple of times. Just click on "Skip" and let
AV Devil finish.
After its done you will see something like this:



As you can see this Trojan server has only two detected offsets.
That means that first detected offset begins at 53F7 and ends at 5476.
Also you can see where the second offset starts and ends. That�s the part that the AV
is checking in this definition database. If the part in the server matches with part in
AV database your server is detected. You can hex beginning and ending offset or in
between.
Step 2.
Now when we have detected offsets, we open our server in Hex WorkShop. Type
"Ctrl+G" and this will come up:



Type the first offset in, select from �Beginning of File,� and make sure that you
selected "hex," because offsets in AV Devil are displayed in that manner. Unless you
save via AV Devil, then they are converted into a decimal. Click �Go� and you will
be sent to that offset location. Now we need to change that �31� to something else, so
we will change it to �32�.



Select �31� right click to it and select fill.



You will see the window below. In �Fill with the following hex byte� we are going to
fill in �32� and hit OK.



After clicking �OK,� the changed hex byte going to be shown in red.


__________________________________________________ __________________
Now repeat this for every offset that you found in AV Devil.


__________________________________________________ ___________________
Going to change it �FE� to �EE� and so on for all other detected offsets.



Once you�ve completed editing all offsets, save your server and scan if it�s UD, and
then you�re done. If the AV still detecting it, repeat steps 1 and 2.
Here�s a little tip on how to change detected bytes: Try to make minor changes like
32 =>31, 22, 42, 33, 34, or FE =>EE ,FF etc., etc. Basically, one character up/down
for each - that�s the best way and will minimize chances to corrupt your server. If that
doesn�t work for some reason, you can try and change it to something completely
different, but always check your server after editing bytes. That way you can see if the
server works or if it�s corrupted (you can keep track of what change caused the
corruption and you can try and edit that byte with some other character).
Another thing in some Trojans servers is that AV Devil can�t find the beginning of the
first offset and will mark it with �0.� Let�s say you�ve hexed all other found offsets
but your server is still detected. Split the file into half and run AV Devil on the first
half. That way you will be able to find the first offset that is missing and finish your
hexing. If some tagged part is a letter, e.g. �Y� change it to �y� or just PlAy wItH
ThE CaPs.
Ex:



So there you have it! Now you know how to hex your server and make it undetected
from wanted AVs.



Note: AV=Anti-Virus

Standard Anti-Virus Test

Make a test for your anti-virus and see if it is a working antivirus.

Open a notepad and paste this:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Save it as:

eicar.com

Your anti-virus will not let you save it or automatically delete it after you save. Then your anti-virus is working greatly.

Dont worry, this is not a virus. This is a test for anti-virus and see if it is working.This is a test manufactured by European Institute for Computer Anti-virus Research
(EICAR). So it is totally harmless.