I'm curious to know how Duqu deletes itself. From technical point of view and generally, how can an executable delete itself while is running? Does Duqu use a specific procedure to do this?
how can an executable delete itself while is running?
Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.
Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses
mmap() to load executables (you can verify this with strace). It turns out what happens when you overwrite such executables is quite complicated but it comes down to how you do the overwriting. Since Unix uses inodes, as I understand it the reference count to that inode would decrease, but one is held (for the executing program), hence self deletion is possible - the reference for the
dentry (disk path) disappears, but not for the
Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:
- Batch file to delete the program.
- Move the file to nowhere, delayed until reboot (via
and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.