1

I found a post about how to kill the program itself one year ago. It suggested writing some values in registry or windows directory or a location in disk when it runs first time. When it tries to run for the second time, the program just check the value in that location, if not match, it terminates itself.

This is simple and a little naive as any realtime anti-virus application would easily watch what value and where your program wrote in a disk. And in a true sense, that method did not 'kill' itself, the program just lies thare and sleeps intact and complete, only because of lack of trigger.

Is there a method that, in true meaning, kills itself such as deleting itself permanently, disemboweling itself, disrupting classes or functions or fragmenting itself?

Thank you.

Warren
  • 795
  • 1
  • 10
  • 19
  • 1
    Why don't you write an uninstall program? – David Heffernan Feb 01 '12 at 12:24
  • @David Thanks so much. What is uninstall program? Please give me a link to have a look? – Warren Feb 01 '12 at 12:28
  • You know what an uninstall program is. It's the thing that runs when you go to Add/Remove Programs in the control panel and elect to remove a program. – David Heffernan Feb 01 '12 at 13:05
  • Its really unclear what you want here. It almost sounds like you're wanting to add some kind of "protection system" to your executable. That's a long and pointless road, IMHO. – Warren P Feb 01 '12 at 14:52

2 Answers2

1

An application cannot delete itself off the disk directly, because while the application is running the disk file is 'open' - hence it cannot be deleted.

See if MoveFileEx with the MOVEFILE_DELAY_UNTIL_REBOOT fits your requirement.

If you can't wait for a reboot, you'll have to write a second application (or batch file) that runs when the first application closes to wait for the first application to complete closing and then delete it.

It's chicken and egg though - how do you delete the second application/batch file? It can't delete itself. But you could put it in the %temp% directory and then use MoveFileEx() to delete it next time the machine is rebooted.

Ian Goldby
  • 5,609
  • 1
  • 45
  • 81
  • 2
    The reason for using a batch file is that [batch files *can* delete themselves](http://stackoverflow.com/a/2889684/33732). The command interpreter closes and re-opens the file for each line it executes, so the file isn't locked during the deletion command. – Rob Kennedy Feb 01 '12 at 14:40
  • Wouldn't be easier to load the entire batch once and interpret it as a whole? MS can be strange... ;-) – Fabricio Araujo Feb 01 '12 at 18:01
  • Maybe I'm wrong about that detail, @Fabricio. I thought I learned it from Raymond Chen, but I can't find the reference now. – Rob Kennedy Feb 01 '12 at 18:21
  • @IanGoldby Thanks for your possible solution and a way to delete itself. – Warren Feb 02 '12 at 13:17
  • @RobKennedy: I don't arguing against, just find it... a little weird.. ;-) I'll test it using Process Monitor and discover if is true ;-) – Fabricio Araujo Feb 02 '12 at 16:33
1

+1 to this question. It is so unfortunate that people often tend to vote down, if somebody asks questions that are related to tricky ways of doing things! Nothing illegal but at times this qustion may sound to other people that this method is unnecessary. But there are situations where one wants to delete itself (self) once it is executed.

To be clear - it is possible to delete the same exe once it is executed.

(1) As indicated in the earlier answer, it is not possible for an exe to get deleted once it is executed from disk. Because OS simply doesn't allow that.

(2) However, at this point, to achieve this, what we need to do is, just execute the EXE in momory! It is pretty easy and the same EXE could be easily deleted from disk once it is executed in memory.

read more on this unconventional technique here:

execute exe in memory

Please follow above post and see how you can execute an exe in momory stream; or you can even google it and find out yet another way. There are numerous examples that shows how to execute an exe in memory. Once it is executed, you can safely delete it from disk.

Hope this throws some light into your question.

Community
  • 1
  • 1
jimsweb
  • 1,082
  • 2
  • 17
  • 37
  • 2
    Thank you for link and answer and understanding. i was just asking a question to confirm if it is theoretically and technically impossible task, though it may not be pragmatic or utilitarian. Must a question be useful? – Warren Feb 02 '12 at 13:30
  • I don't see how this can delete the EXE program which executes an EXE resource in memory. – kobik Feb 03 '12 at 00:20
  • @kobic, The example shown above doesn't seem to have code to self delete. On the other hand it speaks about how you can execute an EXE into a memory stream. Once you have executed it, the running exe is no way related to the one that is residing in disk. You can safely delete it. :) I have a working version of code with me. let me see if i can post a stripped down version of the same code. – jimsweb Feb 03 '12 at 04:29