Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there any way that I can run this program on my Linux system without possibly getting a virus?

share|improve this question
    
You would have to tell us what virus. It could potentially run in wine, in which case it could "infect" any file your user has rw access to ( most anything in /home/your_user ). If you do not run it (or wine) as root it is unlikely to affect system files. –  bodhi.zazen Jan 23 '12 at 3:24
    
Can you tell us exactly what the program is you're trying to run and where you got it from? As bodhi.zaen said, you could simply have a false positive, though it is hard to tell unless we know exactly what you have. –  WarriorIng64 Jan 23 '12 at 4:08
    
This is what I'm trying to run: virustotal.com/file/… its a modifier for a custom IOS for the wii - the guy has insisted its not a virus but 3/42 virus scanners said its a trojan –  Alex Poulos Jan 23 '12 at 7:16
3  
Great question! :) –  Bruno Pereira Jan 23 '12 at 7:18
1  
@AlexPoulos To that, all I can say is that you can't be sure without actually trying it. This is true regardless of any random file or piece of software one gets from the Internet that's not directly from a reputable organization. You could read and compile the source code yourself if it's provided, or set up a test machine with Wine installed and see what the effects are there. But as I said before, I don't think it should be an issue this time around, although that judgment's based on probability. –  WarriorIng64 Jan 23 '12 at 7:38

2 Answers 2

up vote 7 down vote accepted

Be aware please that even tough this will work probably fine, running a virus inside any live system is never a good idea, even if you are sure that you can revert / eliminate the effects of the virus. For a safer approach the answer from bodhi.zazen is recommended. This is the safest steps to run something that is not really safe.


Any program running inside a wine prefix has only access to the virtual bottle in that .wine prefix folder in your home and nothing else. They are closed inside that bottle.

That said it is also true that a default created bottle also creates standard links in to your home folder and root file system, you need to make sure that those are deleted before running the executable. Some pesky trojans will scan drivers for executable or other specific file type and try to infect those.

A better option is to create a new bottle and thus isolating it from your normal bottle, for that you need to run the .exe file on a separate prefix, do that by following this example:

export WINEPREFIX=~/wine_possible_trojan
wine winecfg

At this point look for the mounted points created for the bottle, they should be on the drives tab, remove any letters that are not c:\, that will prevent the trojan of fiddling with any files inside your home or the root file system:

enter image description here

After removing the drivers from the bottle you can run the executable using the bottle you just created with using something like

WINEPREFIX=~/wine_possible_trojan wine path_to_exefile.exe

After that deleting ~/wine_possible_trojan will delete the bottle from your system eliminating the modifications done by the trojan inside that bottle.

If you are unsure you can also install a virus scanner in your Linux system and run that after )and maybe before to see if it picks anything up) deleting the .wine prefix. Have a look at this post for options available:


The other option would be, as bodhi.zazen said, to install VirtualBox from the Ubuntu Software Center, install Ubuntu or Windows (if available) in to a new virtual system in VirtualBox and run the .exe inside that virtual system.

For more information about VirtualBox please visit the Wikipedia page, the official VirtualBox page and have a look at How to install VirtualBox in AskUbuntu.com.


I can see from the AV scan report you added to the comments that only 1 engine picked it up out of all of those on the list, I would say false positive.

share|improve this answer
    
how do I run this in an isolated environment? –  Alex Poulos Jan 23 '12 at 7:15
    
The wine bottle is a sort of isolated environment, delete ~/.wine and that environment is gone. Other then that do what @bodhi.zazen tells you and run it on a virtualbox system. –  Bruno Pereira Jan 23 '12 at 7:21
    
what are some virtualbox applications I can download and run for ubuntu? –  Alex Poulos Jan 23 '12 at 7:22
    
is there any sure shot way that I can make sure that I won't get infected if I run this? –  Alex Poulos Jan 23 '12 at 7:29
    
So its almost similar to a sandbox then? –  Alex Poulos Jan 23 '12 at 7:39

You would need to run it in an isolated test system, such as a VM and investigate what it does.

What exactly is it ?

It is hard to believe you "need" to run an infected .exe.

It is possible you have a false positive as well (depending on how you detected the virus and what, if any, investigation you have done).

share|improve this answer
    
Its a program someone made for help with modifying a custom IOS for the Wii. virustotal.com/file/… –  Alex Poulos Jan 23 '12 at 7:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.