It's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one. Looking at the poison ivy website

It's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one. Looking at the poison ivy website they have a customer portal, so presumably this is how they did it. There are also methods to pay without leaving a paper trail back to you (pre-paid cards I think). Edit: It's also possible to modify detectable executables to make them undetectable if you don't want to pay. Virus scanners for the most part work by reading a few bytes from an executable at a particular point, hashing those bytes and if they match a known virus, report it as one. By finding those parts of the executable (there are often multiple signatures, and different vendors will have different signatures too) and modifying them slightly, the resultant hash will be different and the executable undetected.