0

I am using Ubuntu 12.04.

There are some weird files appears in my desktop,

enter image description here

I googled some file names, and I found dghv.exe appeared in a list of virus.

http://www.linhadefensiva.org/forum/arquivado/topicos/3/43343-meu-primeiro-virus.html

enter image description here

Does anyone know what virus cause this situation? And how to solve this problem?

Improve this question
4
  • 1
    Wow. Wine is now even compatible with malware! :) So yeah, just be as careful as in Windows.
    – gertvdijk
    Jul 11, 2013 at 8:48
  • 1
    @gertvdijk It's not really breaking news, isn't it? :)
    – LiveWireBT
    Jul 11, 2013 at 8:52
  • 1
    @LiveWireBT In "my time" most if not all malware just simply crashed because it relied on specific Windows implementations. It surprises me, because I thought most "malware in Wine" reports were more based on theory.
    – gertvdijk
    Jul 11, 2013 at 8:59
  • nah, ive seen malware on wine running just fine since 2007 or so. Hey OP, why are you running wine anyway? There might not be malwarebytes for linux yet, but there is clamAV.
    – j0h
    Jul 11, 2013 at 19:37

2 Answers 2

Reset to default
9

It's not a virus just malware with unexpected or unwated behaviour that can run on Wine like every other Windows software, therefore:

  • Do NOT execute software from untrusted sources (applies to all software and software packages; is not limited to Windows software; also includes tarballs, debs/rpms and shell scripts).
  • Think before executing Windows software, even if you trust the source.
  • To get rid of the nagging behaviour:
    • Remove Wine entirely or...
    • Remove the ~/.wine folder, which is equal to reinstalling Windows.
    • Backup your home folder and start with a clean one (or just create anoher user).
Improve this answer
5
  • 2
    Yep, just delete the ~/.wine folder and remove all those pesky files from the Desktop folder, that should solve the issue. Would not expect anything else in the Linux system to be affected.
    – Bruno Pereira
    Jul 11, 2013 at 8:13
  • 1
    I'd also look in all folders in your home dir for stuff that the malware might have installed. Use find to look for .exe, .com, .pif and .lnk files and if they seem suspicious, remove them (maybe make a backup for the case that they turn out to be important). Remember, wine links some windows folders to the corresponding ones in your home dir (for instance the desktop, documents, pictures,...)
    – soulsource
    Jul 11, 2013 at 8:29
  • @soulsource Instead of searching and cleaning the entire home folder I think it's better to backup/archive the home folder and start with a clean one. Good point, added to the answer.
    – LiveWireBT
    Jul 11, 2013 at 8:44
  • @LiveWireBT Surely, though, in the process of backing up/archiving the home folder, he'd have to clean it out anyway - or at least take care not to archive the infected files too. So really there'd not be much difference between cleaning it out and "starting again with a clean home folder"...
    – Jez W
    Jul 11, 2013 at 9:05
  • @JezW You can just tar the whole folder and prevent executables from running again. Thats how administrators handle this: Archive data, ensure that it's consistent and restore when needed. You won't see an admin scanning backups for malicous files in environments with 100+ users. Scanning infected files just increases the risk of another infection.
    – LiveWireBT
    Jul 11, 2013 at 9:56
0

This must be some of your wine software which is pricking your desktop like that, install Malwarebytes and run a scan.

Improve this answer
3
  • 1
    There is no Malwarebytes for Linux. It's just crazy to run some sort of "desinfecting" software on an infected/infested system and think that everything is okay when the software is done with its job. It's even more crazy when the host runs another OS than the software expects to run. The correct procedure is: Nuke entire the system and start all over. If more people would think like this and act carefully, we wouldn't have these topics. Anti-Malware doesn't help, it makes it worse.
    – LiveWireBT
    Jul 11, 2013 at 8:06
  • @LiveWireBT I assume he meant under Wine. Not sure how well it would actually work under Wine but it seems a fair enough call. Don't quite see your other points, though. Sure, apply common sense of course, but I don't see how antimalware software makes anything "worse". Trusting a single program would be a mistake of course, as each catches different things - but the trifecta of MBAM/Spybot S&D/Avast that I usually recommend to people tends to work well.
    – Jez W
    Jul 11, 2013 at 9:11
  • @JezW It makes things worse, because people that believe in that Anti-Malware always works flawlessy and gets rid of all the symptoms act careless because they can rely on Anti-Malware. Anti-Malware doesn't clean the internet from data you didn't want to be published on the internet. Some of these programs also aren't really trustworthy. Spybot S&D e.g. had some issues years ago. Another interesting fnord are ad-blockers acting as gatekeepers. Search for AdBlock Plus and Sascha Pallenberg. Different topic, but same scheme and result.
    – LiveWireBT
    Jul 11, 2013 at 9:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .