There are near fullproof methods for doing this, but I won't post them here since malware authors seem to be doing just well on their ownn by using much worse methods like writing their own metamorphic packers. AVs work by code pattern/signature detection and the few good ones can work by emulation and some more advanced heuristics. If you understand how each of those strategies work, I'm sure you can define simple ways to defeat them.