2

I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?

Improve this question

2 Answers 2

Reset to default
4

how can an executable delete itself while is running?

Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.

Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses mmap() to load executables (you can verify this with strace). It turns out what happens when you overwrite such executables is quite complicated but it comes down to how you do the overwriting. Since Unix uses inodes, as I understand it the reference count to that inode would decrease, but one is held (for the executing program), hence self deletion is possible - the reference for the dentry (disk path) disappears, but not for the mmap().

Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:

  • Batch file to delete the program.
  • Move the file to nowhere, delayed until reboot (via MoveFileEx)
  • DELETE_ON_CLOSE via CreateFile.

and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.

Improve this answer
0

I haven't looked at Duqu itself, but the usual procedure to do this is to spawn a process which deletes the running executable - so something like exec("rm " + argv[0]") would do the trick.

Improve this answer
7
  • 1
    What you propose would work on Linux and a lot of Unixes (older, weirder versions wouldn't allow you to delete the executable file of a running process), but would it work under Windows, the Duqu target?
    – Bruce Ediger
    Commented Oct 7, 2012 at 16:25
  • I found new process will be created due to calling _exec function. I have to test it.
    – n1kita
    Commented Oct 7, 2012 at 16:30
  • There might be another method to do this, Creating new process and loading it in memory via CreatePorcess and VirtualAlloc and execute it, Correct me if I'm wrong.
    – n1kita
    Commented Oct 7, 2012 at 16:40
  • 2
    Under windows, you'd execute something like (depending on programming language!) `system("cmd /C del " + argv[0]). You'd need your program to exit before the delete actually happened, so you'd need to pause your batch script/whatever for a few seconds while that happened. A more robust way might be to add a Scheduled Task (windows) to delete the process in, say, a minute, and then exit.
    – randomdude
    Commented Oct 7, 2012 at 16:57
  • 1
    exec() is unix specific - it's only any good because you also have fork(). So if you have exec(), then you likely don't need it: you can just use something like unlink(argv[0]). The inode&data will stay live until the last user finishes with it - i.e. until your process exits. Whereas on Win32, you can't delete running executables. So there's an API which can be used by uninstallers, which schedules files for deletion (or renaming) after the next reboot.
    – sourcejedi
    Commented Oct 7, 2012 at 18:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .