3

Theoretical question, I'm just interested in how could this be done. I remember I had a virus on Windows7/8 (can't quite remember which one tho) which made Windows BSOD upon entry of a folder which had a file that the AV recognised as a virus. It made Windows BSOD when entering the folder using Windows Explorer and using cd in command line.

To my knowledge, in Windows XP you could change the extension of a file to ".folder" and Windows hides the extension and shows it as a folder, but I read that the "feature" got removed by Microsoft, since it was considered as a bug some exploits later. Tho I don't think this is the case, since I had this happen to me in Windows7/8.

My WinApi experience isn't vast, but I was thinking that maybe using some hacky API calls one could monitor where the user is navigating in cmd/explorer. Tho again, don't think this is the case (why would Microsoft give a developer such powers?).

So, any ideas?

  • I think the more likely reason is that the virus exploited some bug in your antivirus option that scans files in open folders. – Nzall Oct 14 '15 at 16:43
2

Yes this is possible. One way to do this would be to create a shared folder and share it with a mangled version of your own computers localhost. When cmd.exe tries to list the files in the folder, it will "look them up" over the mangled localhost and you should be able to intercept that network trafic. I don't think this would be possible without Administrator permissions however.

1

An old trick used by viruses to reinfect and execute malicious code would be to replace the directory with a shortcut that both executes your script and opens explorer to the correct path. This of course would only work in the UI, accessing the directory through console would not activate the shortcut as it is technically a file (.lnk) not a directory.

This is specific to a windows instance.

1

Depending on how deep the virus managed to embed itself, it could just patch Explorer.exe and trap the appropriate function calls to throw an exception when that particular directory was accessed.

Explorer going tits-up would almost certainly be enough to bluescreen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.