SelfDel plug-in - Revision history

Mplabs: SelfDel plugin was recognized as virus. Kaspersky cannot fix this detection

2013-10-11T17:54:09Z

SelfDel plugin was recognized as virus. Kaspersky cannot fix this detection

â† Older revision		Revision as of 17:54, 11 October 2013
Line 37:		Line 37:
	FunctionEnd		FunctionEnd
	</highlight-nsis>		</highlight-nsis>


			== Note==
			The nsis setup with the SelfDel plugin was recognized as virus ''HEUR:Trojan.Win32.Invade'' by Kaspersky Lab.

			<blockquote>
			"The Kaspersky product is detecting not on the NSIS installer, but what the NSIS installer is doing. It calls a subfunction Del inside of SelfDel which starts explorer.exe as a suspended process, writes memory into it, and then executes it. If you stay away from using SelfDel and its Del function, the detection would stop occurring. We cannot fix this detection. Attempting to fix it would also allow a large amount of malware to go undetected. ''The NSIS plugin authors are encouraged to look for other alternatives for deleting the installer after execution.''"
			</blockquote>

	[[Category:Plugins]]		[[Category:Plugins]]

Afrow UK: /* Tested on */

2013-06-28T09:56:06Z

Tested on

â† Older revision		Revision as of 09:56, 28 June 2013
Line 11:		Line 11:

	== Tested on ==		== Tested on ==
	Windows XP 32-bit		* Windows XP 32-bit
	Windows Vista 32-bit/64-bit		* Windows Vista 32-bit/64-bit
	Windows 7 32-bit/64-bit		* Windows 7 32-bit/64-bit
	Windows 8 32-bit/64-bit		* Windows 8 32-bit/64-bit

	== Syntax ==		== Syntax ==

Afrow UK: /* Description */

2013-06-28T09:55:44Z

Description

â† Older revision		Revision as of 09:55, 28 June 2013
Line 10:		Line 10:
	Plug-in launches hidden Window Explorer, it waits installer (uninstaller) to finish and deletes exe. Optionaly removes exe' directory. After this Explorer exits as well.		Plug-in launches hidden Window Explorer, it waits installer (uninstaller) to finish and deletes exe. Optionaly removes exe' directory. After this Explorer exits as well.

	~~'''Now works~~ on ~~x64 (~~Vista/7) - ~~Afrow UK; 17th July 2011'''~~		== Tested on ==
			Windows XP 32-bit
			Windows Vista 32-bit/64-bit
			Windows 7 32-bit/64-bit
			Windows 8 32-bit/64-bit

	== Syntax ==		== Syntax ==

Afrow UK: /* "del" DLL function */

2013-06-28T09:54:04Z

"del" DLL function

â† Older revision		Revision as of 09:54, 28 June 2013
Line 15:		Line 15:
	=== "del" DLL function ===		=== "del" DLL function ===
	<highlight-nsis>		<highlight-nsis>
	SelfDel::del [/RMDIR] [/REBOOT] </highlight-nsis>		SelfDel::del [/RMDIR] [/REBOOT \| /SHUTDOWN] </highlight-nsis>
	: Creates remote thread in the hidden Windows Explorer process, it waits parent process to exit and deletes it's file.		: Creates remote thread in the hidden Windows Explorer process, it waits parent process to exit and deletes it's file.
	; RMDIR		; /RMDIR
	: if exe directory is empty after file deletion, removes directory as well with this option.		: if exe directory is empty after file deletion, removes directory as well with this option.
	; REBOOT (added by Afrow UK)		; /REBOOT (added by Afrow UK)
	: reboots the machine after installer deletion.		: reboots the machine after installer deletion.
			; /SHUTDOWN (added by Afrow UK)
			: shuts the machine down after installer deletion.

	== Example ==		== Example ==

Afrow UK: /* "del" DLL function */

2011-08-10T11:08:33Z

"del" DLL function

â† Older revision		Revision as of 11:08, 10 August 2011
Line 15:		Line 15:
	=== "del" DLL function ===		=== "del" DLL function ===
	<highlight-nsis>		<highlight-nsis>
	SelfDel::del [/RMDIR] </highlight-nsis>		SelfDel::del [/RMDIR] [/REBOOT] </highlight-nsis>
	: Creates remote thread in the hidden Windows Explorer process, it waits parent process to exit and deletes it's file.		: Creates remote thread in the hidden Windows Explorer process, it waits parent process to exit and deletes it's file.
	; RMDIR		; RMDIR
	: if exe' directory is empty after file deletion, removes directory as well with this option.		: if exe directory is empty after file deletion, removes directory as well with this option.
			; REBOOT (added by Afrow UK)
			: reboots the machine after installer deletion.

	== Example ==		== Example ==

Afrow UK: /* Description */

2011-07-17T21:33:49Z

Description

â† Older revision		Revision as of 21:33, 17 July 2011
Line 8:		Line 8:

	== Description ==		== Description ==
	Plug-in launches hidden Window Explorer, it waits installer (uninstaller) to finish and deletes exe. Optionaly removes exe' directory. After this Explorer exits as well.~~<br>~~		Plug-in launches hidden Window Explorer, it waits installer (uninstaller) to finish and deletes exe. Optionaly removes exe' directory. After this Explorer exits as well.

			'''Now works on x64 (Vista/7) - Afrow UK; 17th July 2011'''

	== Syntax ==		== Syntax ==

Takhir at 09:21, 10 February 2007

2007-02-10T09:21:36Z

New page

{{PageAuthor|Takhir}}

Plug-in for setup in place deletion without exe copy or reboot.

== Links ==
Download:<br>
<attach>SelfDel.zip</attach><br>

== Description ==
Plug-in launches hidden Window Explorer, it waits installer (uninstaller) to finish and deletes exe. Optionaly removes exe' directory. After this Explorer exits as well.<br>

== Syntax ==
=== "del" DLL function ===
<highlight-nsis>
SelfDel::del [/RMDIR] </highlight-nsis>
: Creates remote thread in the hidden Windows Explorer process, it waits parent process to exit and deletes it's file.
; RMDIR
: if exe' directory is empty after file deletion, removes directory as well with this option.

== Example ==
Setup deletion:
<highlight-nsis>
Function .onInstSuccess

SelfDel::del

FunctionEnd
</highlight-nsis>

[[Category:Plugins]]