Forensic Riddle #7 – Answer

The answer is pretty straightforward to anybody who is a programmer. Registry is just a configuration data that is read at some stage. The way the configuration affects OS or application (or DLL) depends on whether it has been read during the system-wide initialization (one off initialization that sets some flags only once after system restart), process/module-specific initialization (that is a one-off for a specific process or module), or is read anytime certain function is executed (thus, changing registry has an immediate effect).

It’s 2012 and time for something new, so I am suspending riddles for the time being. I still have a few more to post, yet from now on it won’t be that frequently.

Forensic Riddle #6 – Answer

Yes. It is. One way to do it is to save its own copy as an ADS (Alternate Data Stream) and run it from there. Once executed from ADS, the host file will be able to self-delete itself. So, technically it is a bit of cheating :), yet it works – see the screenshot for details.