the following asm and c++ code is from http://freespace.virgin.net/james.brown7/tuts/selfdel.htm
Can anybody let me know how it can delete itself. I mean how it works

thanks in advance

==============================================================================
The Ultimate Self-Deleting Executable!
I thought I'd save the best until last. This inline assembly snippet is short and simple. I can't claim credit for this code - I found it posted on usenet some time ago. The author's name is Gary Nebbett.

#include <windows.h>

int main(int argc, char *argv[])
{
char buf;
HMODULE module;

module = GetModuleHandle(0);
GetModuleFileName(module, buf, MAX_PATH);
CloseHandle((HANDLE)4);

__asm
{
lea eax, buf
push 0
push 0
push eax
push ExitProcess
push module
push DeleteFile
push UnmapViewOfFile
ret
}

return 0;
}

===============================================================================
Posted on 2004-03-09 09:42:37 by catman123ok
You can't delete your image file while it's running. Or, more
specifically, you cannot delete it while it's mapped.
This code is rather tricky - it puts everything needed on the
stack, and then calls (well, RETs) to UnmapViewOfFile, which
unmaps your executable. Returning from UnmapViewOfFile it goes
to DeleteFile, deleting your executable, and returning from
DeleteFile to ExitProcess - all of this executing on the stack,
so you don't get a GPF from trying to reference your program code
which has been unmapped.

I would advise pretty strongly against using this, though - it
depends on a whole bunch of things that could change. What exactly
is handle #4, and why would you depend on it being the same thing
for all future windows versions? Why depend on module==imagebase
(unlikely to change, but it could happen), and why depend
on windows letting you unmap your executable?

Consulting the FAQ...
http://www.asmcommunity.net/board/index.php?topic=1152
and (better)
http://www.asmcommunity.net/board/index.php?topic=4190
Posted on 2004-03-09 10:34:57 by f0dder