I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
I haven't looked at Duqu itself, but the usual procedure to do this is to spawn a process which deletes the running executable - so something like
|show 2 more comments|
Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.
Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses
Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:
and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.