2

Let's say a program is contained entirely in a jar or exe. Is it possible for this program to propagate itself such that the user can't possibly remove it from the machine? I'm wondering how much trouble I could get in to with an arbitrary file I download. (Which isn't to say that I'm stupid enough to run any code someone gives me. I just want to know the risks.)

  • This can only be used for good.. It is an interesting question from a non-malicious standpoint, though. – user49841 Mar 24 '11 at 23:46
  • I'd heard of some creating a scheduled task to test for the presence of the jar/exe. If it was missing, the task would download it from the internet again. – OMG Ponies Mar 24 '11 at 23:47
  • 3
    It depends what you mean by "can't possibly". You can always reformat the drive, which would effectively remove the program (along with all others on that drive). I think you need to refine this question. – Adrian McCarthy Mar 25 '11 at 0:03
  • @Adrian: Anything can be removed, but formatting a drive isn't guaranteed to do it, if e.g. the BIOS got reflashed (either system BIOS or extension BIOS in any of the peripherals). – Ben Voigt Mar 25 '11 at 0:48
2

jar or exe are just containers and may contain anything, so yes, you should be careful ... I wouldn't say that it's impossible to remove afterwards, but if you don't trust the publisher run some tests before you touch it ...

2

If someone really wanted to do something like this, they could theoretically use the exe to install and start multiple services, all of which check for the existence of all the rest in an endless loop while performing whatever maliciousness they desire. If any of the others are stopped or removed, the remaining would repopulate the one that was missing. These services could do things like prevent the task manager from opening, prevent the services window from opening, or anything else you would need to stop them. You'd have to stop and remove all of them simultaneously. It is very difficult to make them completely uninstallable, but you could easily make it a real headache.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy