Yes. It is. One way to do it is to save its own copy as an ADS (Alternate Data Stream) and run it from there. Once executed from ADS, the host file will be able to self-delete itself. So, technically it is a bit of cheating :), yet it works – see the screenshot for details.
Author Archives: adam
Forensic Riddle #6
Many malware authors use external .bat/.cmd files to delete the .exe dropper, because it is non-trivial to self-delete while the malware is still running. In the past it was possible to use Gary Nebbett’s famous self-deleting executable trick and it worked for Windows NT and Windows 2000. However, it doesn’t work under newer versions of Windows.
Question:
Is it possible to create a self-deleting executable for newer version of Windows?
Answer here
