I was testing the CIA trojan.
I had binded it in a mail and was attempting to send via gmail to a friend.
My friend has configured gmail on Outlook Express 6.
The mail reached and when he clicked on the attached pic (to which I had configured and binded the trojan), he is able to see the pic, however I dont get any notification about the trojan.

Kindly educate about bypassing the antivirus or firewalls.

I cant stress enough about having a lab.  Ethical hackers have them and so do the unethical. Dont test blind. Put a little effort in your tests and so much will be answered.