42

I heard Linux can get viruses through Wine,and I was curious if the viruses work only while Wine is running.

In other words, could I stop a virus from doing it's thing by just quitting Wine?

  • Anything can happen. I even noticed a wine virus that prevented launching of linux task manager. It's possible for a wine virus to reach your login session and rewrite itself for example a bash script that puts itself in startup processes. – kenn Jun 22 '15 at 14:09
  • If you find that any of these answers, answered your question, please accept one as such. The check mark, next to the answer. – blade19899 Nov 18 '15 at 14:52
50

Do Wine Viruses only work while Wine is running?

Yes, if it is a trojan, rootkit, worm program specifically designed to infect Windows machine.

(Viruses through wine has already happened.)

could I stop a virus from doing it's thing by just quitting Wine?

Yes, and no.

Yes

If It's a Windows virus, kill the Windows Environment(wine), and it won't have a leg to stand on. The Virus is still installed, but its not doing any harm. If you remove wine - to the best of my knowledge - it just removes its binaries. Reinstalling wine later, will show that the applications are still installed.

Removing the ~/.wine folder completely, however, will give some sense of safety. Mind you that if it did not copy it self somewhere else then the ~/.wine folder. In which case, you have a Windows binary somewhere, that possibly can cause harm to your system.

No

If the virus is targeting Linux with Wine environment. Although the chance for you specifically to catch this rare virus is pretty slim, I would still urge you to read an article by the Wine community on how to Secure wine.

How rare the virus may be, its still advised to secure Wine as much as possible. Especially if your on a business side of things.


My preferred graphical front-end for Wine is PlayOnLinux, with that you have more control over your Wine environment, and there is a separate environment per application. So, if you happened to get infected by using Safari, use the Configuration options to examine and/or restore, or just delete the entire Safari Volume.

PlayOnLinux - Configuration Excerpt image from here: PlayOnLinux Explained: Wine Configuration | GamersOnLinux

Note:

It's a small chance, but, even after securing wine, you still might get infected by a virus or even viruses specifically designed to hack/infect Linux through wine. Just for security reasons, I have installed Malwarebytes, and SuperAntiSpyware. Also note that the custom explorer.exe - or other wine software - created by the wine team, might be considered as malicious by the aforementioned security software.

IMHO: PlayOnLinux is a safer alternative, because you have more control over wine, with the Configuration tools. Whilst installing only wine, installs a Windows environment in your Linux system without any way of monitoring it.

PlayOnLinux doesn't need wine pre-installed. It creates a Wine Prefix(a separate working environment) with wine. Then it will install the software in the separate Wine Prefix. Meaning, the software cannot access other environments. Thus making it harder to infect other parts of Windows software installed in a different Wine Prefix.

Further reading:

  • If the virus was specifically built for infecting Linux trough Wine, you are only a bit less vulnerable when using Playonlinux. Also antiviruses are important, but they mostly protect against common, run-of-the-mill viruses. If someone wrote a virus attacking Linuxes trough wine, antiviruses would only start detecting it after some time (or never). – user31389 Dec 17 '14 at 15:05
  • one should not that it would be EXTREMELY difficult to create a virus which uses WINE in order to infect a linux host with linux-specific code. That'd only be possible if the PE-binary or windows-script has ELF payload - executing that ELF is also not easy ... since such a virus would need to be pretty complex one can safely assume that an infection like this is extremely unlikely - these kinds of attack vectors are specific, created by paid hackers - and these people most likely will use different methods of intrusion, all of which are much easier. – specializt Dec 18 '14 at 17:47
25

Maybe. There's no short answer for this.

I'll start by saying your introduction makes it sound like you think Linux can't get viruses (and/or malware). That may just be my inference but it's important to note that malware is just software and you can run bad software on Ubuntu just as easily as on Windows as long as it's compatible. Linux isn't invulnerable.

As for malware running under Wine, if it was literally an active application (like a trojan RAT), stopping Wine (wineserver -k to be sure) would stop it from running.

However... It's comically easy to detect if the environment is Wine. There is little sandboxing between Wine and Ubuntu by default so malware could detect a Wine environment and then could do pretty much anything you can do to your Ubuntu system. That includes running native commands, interfacing with Ubuntu systems, standard local privilage exploit stuff, downloading native malware and scripting into user-based auto-start mechanisms (~/.config/autostart/ et alii) to load itself back up after rebooting.

Is that likely? I don't know. Most Windows malware will probably not bother probing for Wine environments but that's just my hunch. I have no idea whether any such malware exists but either way, with the rise in popularity of Linux, OSX and Wine, I doubt it'll be long before many malware droppers probe their environment. We're only talking a few lines of code for a much better infection.

9

I think that the above answers answer the question well, but I would also like to add that running a virus in wine WON'T stop any viruses that access/modify/delete files on the system.

For instance, the dreaded CryptoLocker ransomware will encrypt all your documents, then will demand payment to decrypt them. The virus could still easily access the Z:\ drive and encrypt all your files. (Actually, it wouldn't even need to do that; in wine's virtual C:\ drive, the Desktop, Documents, Downloads, My Pictures, My Music, and My Videos folders are symlinked to the folders in your home directory.) On Windows, CryptoLocker has even been known to encrypt Google Drive files if you have the desktop Google Drive app installed.

(Luckily, if you were infected with CryptoLocker, and it was the original CryptoLocker virus, not one of the numerous clones, you can now decrypt your files for free.)

  • 1
    Hi -- I think your comment adds some important details to the answer. You might want to fix your Wikipedia link, however -- here's one that works: en.wikipedia.org/wiki/CryptoLocker You might also want to re-word your last parenthetical statement to say "if you were affected by the original Cryptolocker," because the released decryption tool will work only on the original keys, not on a later "clone." – Tommy Trussell Dec 25 '14 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.