2

I want to delete a suspected malicious file from a server. For the purposes of this question assume that the infected machine is Windows Server 2003 or later.

Is there any risk in deleting such a file? Specifically, are there any logic-bombs that are known to execute when a file is deleted, i.e. the triggering condition is that a user attempts to delete the file?

Aside from updating my virus database, are there any precautions I should take?

Improve this question

2 Answers 2

Reset to default
6

If the machine is already infected, it is very difficult to know what is going on with it. You can never trust it anymore.

The malware itself could be sitting in the memory and watching its files. It's certainly plausible that a malware would do that, specifically so it can regenerate the deleted files. Remember those autorun malware? Whenever you deleted them from your disks they magically appeared again? Yup, it's pretty much like that.

The only way to clean your machine and be sure is to "nuke it from orbit".

Improve this answer
3
  • 1
    Thank you Adnan. I was more interested specifically if it was possible to make the delete action itself the trigger, rather than making the absence of the file a sentinel value for some other program. For example, I have heard of a 4kb 'zip bomb' which expands to a multiple terabyte file when expanded automatically by an email firewall to scan its contents. I was concerned that the action of deleting the file could trigger some unanticipated event.
    – Aaron Newton
    Feb 16, 2014 at 11:52
  • 2
    @AaronNewton If the action would trigger a reaction, then somebody must be listening to that action. When a file is deleted, the operating system unlinks it and that's it. It doesn't inform the application itself that it's being deleted. Either the application in the memory checks for its absence, or infection has batched the operating system in a way to completely modify the deletion behaviour. In that case, your server is way beyond doomed. Practically speaking, your fears of the deletion action triggering something are unsubstantiated.
    – Adi
    Feb 16, 2014 at 11:58
  • Thank you Adnan. Your two answers have addressed my question.
    – Aaron Newton
    Feb 17, 2014 at 3:35
0

There's a mechanism in Windows that hooks the boot process to load certain drivers or other critical system processes at startup. If the computer is infected with a rootkit, it likely does something of this nature to reconfigure the Windows kernel to do the rootkit's bidding.

Depending on how this is set up, deleting the associated files doesn't cleanly remove the malware, but instead leads to a STOP error (blue-screen) at boot-up resulting in an non-booting system. Most likely, this malware will inject itself into the "last known good" and "safe mode" configurations as well, meaning the only way to "clean" the system would mean using an alternate boot disk and painstakingly untangling the resultant mess. The level of expertise this requires to do correctly is somewhere on par with "highly experienced Windows kernel developer."

While it's not, strictly speaking impossible to properly clean a heavily infected system, it is extraordinarily difficult, error-prone, and usually far more expensive then just starting over from scratch.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .