Listing 1 Source for MagicDel.dll a self-deleting DLL
#include <windows.h> HMODULE g_hmodDLL; extern "C" BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD reason, LPVOID) { if (reason == DLL_PROCESS_ATTACH) g_hmodDLL = hinstDLL; return TRUE; } extern "C" __declspec(dllexport) void CALLBACK MagicDel(HWND, HINSTANCE, LPTSTR lpCmdLine, int) { // delete the executable file that created this process Sleep(2000); DeleteFile(lpCmdLine); // delete ourself char filenameDLL[MAX_PATH]; GetModuleFileName(g_hmodDLL, filenameDLL, sizeof(filenameDLL)); __asm { lea eax, filenameDLL push 0 push 0 push eax push ExitProcess push g_hmodDLL push DeleteFile push FreeLibrary ret } }