3

Theoretical question, I'm just interested in how could this be done. I remember I had a virus on Windows7/8 (can't quite remember which one tho) which made Windows BSOD upon entry of a folder which had a file that the AV recognised as a virus. It made Windows BSOD when entering the folder using Windows Explorer and using cd in command line.

To my knowledge, in Windows XP you could change the extension of a file to ".folder" and Windows hides the extension and shows it as a folder, but I read that the "feature" got removed by Microsoft, since it was considered as a bug some exploits later. Tho I don't think this is the case, since I had this happen to me in Windows7/8.

My WinApi experience isn't vast, but I was thinking that maybe using some hacky API calls one could monitor where the user is navigating in cmd/explorer. Tho again, don't think this is the case (why would Microsoft give a developer such powers?).

So, any ideas?

Improve this question
1
  • I think the more likely reason is that the virus exploited some bug in your antivirus option that scans files in open folders.
    – Nzall
    Oct 14, 2015 at 16:43

3 Answers 3

Reset to default
2

Yes this is possible. One way to do this would be to create a shared folder and share it with a mangled version of your own computers localhost. When cmd.exe tries to list the files in the folder, it will "look them up" over the mangled localhost and you should be able to intercept that network trafic. I don't think this would be possible without Administrator permissions however.

Improve this answer
1

An old trick used by viruses to reinfect and execute malicious code would be to replace the directory with a shortcut that both executes your script and opens explorer to the correct path. This of course would only work in the UI, accessing the directory through console would not activate the shortcut as it is technically a file (.lnk) not a directory.

This is specific to a windows instance.

Improve this answer
1

Depending on how deep the virus managed to embed itself, it could just patch Explorer.exe and trap the appropriate function calls to throw an exception when that particular directory was accessed.

Explorer going tits-up would almost certainly be enough to bluescreen.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .