Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?

share|improve this question

2 Answers

up vote 4 down vote

how can an executable delete itself while is running?

Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.

Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses mmap() to load executables (you can verify this with strace). It turns out what happens when you overwrite such executables is quite complicated but it comes down to how you do the overwriting. Since Unix uses inodes, as I understand it the reference count to that inode would decrease, but one is held (for the executing program), hence self deletion is possible - the reference for the dentry (disk path) disappears, but not for the mmap().

Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:

  • Batch file to delete the program.
  • Move the file to nowhere, delayed until reboot (via MoveFileEx)
  • DELETE_ON_CLOSE via CreateFile.

and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.

share|improve this answer
up vote 0 down vote

I haven't looked at Duqu itself, but the usual procedure to do this is to spawn a process which deletes the running executable - so something like exec("rm " + argv[0]") would do the trick.

share|improve this answer
1  
What you propose would work on Linux and a lot of Unixes (older, weirder versions wouldn't allow you to delete the executable file of a running process), but would it work under Windows, the Duqu target? – Bruce Ediger Oct 7 '12 at 16:25
I found new process will be created due to calling _exec function. I have to test it. – n1kita Oct 7 '12 at 16:30
There might be another method to do this, Creating new process and loading it in memory via CreatePorcess and VirtualAlloc and execute it, Correct me if I'm wrong. – n1kita Oct 7 '12 at 16:40
2  
Under windows, you'd execute something like (depending on programming language!) `system("cmd /C del " + argv[0]). You'd need your program to exit before the delete actually happened, so you'd need to pause your batch script/whatever for a few seconds while that happened. A more robust way might be to add a Scheduled Task (windows) to delete the process in, say, a minute, and then exit. – randomdude Oct 7 '12 at 16:57
1  
exec() is unix specific - it's only any good because you also have fork(). So if you have exec(), then you likely don't need it: you can just use something like unlink(argv[0]). The inode&data will stay live until the last user finishes with it - i.e. until your process exits. Whereas on Win32, you can't delete running executables. So there's an API which can be used by uninstallers, which schedules files for deletion (or renaming) after the next reboot. – sourcejedi Oct 7 '12 at 18:14
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.