[Virus Trojan] File self-deleting

Delete files when the program exits

void DeleteApplicationSelf()
{
    
    
	char szCommandLine[MAX_PATH + 10];

	// 设置本进程为实时执行，快速退出。
	SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
	SetThreadPriority(GetCurrentThread(), THREAD_PRIORITY_TIME_CRITICAL);
	
	// 通知资源管理器不显示本程序，当然如果程序没有真正的删除，刷新资源管理器后仍会显示出来的。
	SHChangeNotify(SHCNE_DELETE, SHCNF_PATH, _pgmptr, NULL);

	// 调用 cmd 传入参数以删除自己
	sprintf(szCommandLine, "/c del /q %s", _pgmptr);
	ShellExecute(NULL, "open", "cmd.exe", szCommandLine, NULL, SW_HIDE);

	// 必须要有，否则程序在被结束时文件会再生
	ExitProcess(0); 	
}

The illusion that the manufacturing process has been deleted

In fact, a hidden tmp file was created in another place, replacing the original exe

BOOL DelSelf()
{
    
    
	BOOL ret = FALSE;
	TCHAR FileName[MAX_PATH] = {
    
     0 };
	TCHAR NewFileName[MAX_PATH] = {
    
     0 };

	// 获取自身文件路径
	if (0 == GetModuleFileName(NULL, FileName, MAX_PATH))
	{
    
    
		goto end;
	}

	// 尝试使用修改文件属性的方式删除
	SetFileAttributes(FileName, FILE_ATTRIBUTE_NORMAL);
	if (DeleteFile(FileName))
	{
    
    
		ret = TRUE;
		goto end;
	}

	// 再次尝试删除
	wsprintf(NewFileName, "%c:\\RECYCLER\0", FileName[0]);
	CreateDirectory(NewFileName, NULL);
	if (0 == SetFileAttributes(NewFileName, FILE_ATTRIBUTE_HIDDEN))
	{
    
    
		goto end;
	}
	wsprintf(NewFileName, "%c:\\RECYCLER\\%x.tmp\0", FileName[0], GetTickCount());
	if (0 == MoveFileEx(FileName, NewFileName, MOVEFILE_REPLACE_EXISTING))
	{
    
    
		goto end;
	}
	if (0 == SetFileAttributes(NewFileName, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM))
	{
    
    
		goto end;
	}

	ret = TRUE;
end:
	return ret;
}

Drive forcibly delete files

Refer here