5

This question already has an answer here:

The Story

I installed wine some time ago, and after trying out some versions of Cinema 4D that were "free", I looked in the comments of the videos, and saw some people complaining about viruses. I got worried, downloaded and installed MalwareBytes, and scanned my "system". Of course, since MalwareBytes was runnning through Wine, it only scanned ~/.wine/C:. It found many viruses/trojans and I opted to delete them. I did so.

Questions:

  1. Assuming there is any malware left, can this malware spread into my OS? Tell me the entire truth on what can happen.

  2. I deleted my entire .wine directory and am planning to uninstall wine later. I am the only user out of the three on this system that runs wine programs, but wine is installed for all. Is that enough, or must I do more? Please be specific on what I should do because I want to be 100% sure that there are no viruses.

I am sure that many others have these questions too, so please answer this question to the point.

Additional information:

Wine was installed with sudo-apt get. The exact commands can be found here: https://www.youtube.com/watch?v=_cQW70dsVsM

Commands:

sudo add-apt-repository ppa:ubuntu-wine/ppa -y
sudo apt-get update
sudo apt-get install wine1.6 -y

I did try to install a font that was a ttf font. I tried to convert it to otf with no success. Then, I placed it in the fonts directory directly. I then saw that some people said it was malicious, and I removed it.

This question was flagged as a duplicate of this question: Risks/Disadvantages associated with Wine
It is not the same. This question is more precise, as it specifies two scenarios involving viruses, not risks of viruses. The other question talked about Internet Explorer; this one does not mention the installation of any programs.

Note: wine was installed with sudo privileges, so does that mean it runs with sudo privileges?

marked as duplicate by Alvar, muru, Eliah Kagan, Eric Carvalho, Mitch Apr 12 '15 at 8:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • >One question per post, please. - muru Why? – Distant Graphics Apr 11 '15 at 11:19
  • 1
    @DistantGraphics, It is confusing. – A.B. Apr 11 '15 at 11:20
  • Is it confusing now? – Distant Graphics Apr 11 '15 at 11:24
  • 1
    If you want to be 100% sure, there's only one way: nuke the system. Format, overwrite with zeros, reinstall. – muru Apr 11 '15 at 11:27
  • 1
    The linked video in the question is in Portuguese, so I'll provide a synopsis of it in English. It's a walkthrough desktop recording of installing Wine in Ubuntu 13.10 from the PPA (not the latest version of Wine) followed by installing Adobe Photoshop CS6. – karel Apr 11 '15 at 11:48
5

No, Windows malware can't "spread" to the host Linux system.

No, Windows malware doesn't "spread" across Wine prefixes.

For both questions, a theoretical possibility is not to be ruled out, but it would mean that the malware writers would deliberately attempt to target Wine systems, which is extremely unlikely - unless you are a security researcher you don't care about this.

By nuking your .wine you should be okay.

Nota bene: Windows malware in Wine can do all sorts of bad things to files it has permissions to access, which includes your home directory. Windows malware can't spread to the Linux host, but it can nuke files in your Linux home directory.

EDIT: Of course, the likelihood of having false positives if you scan an entire Wine installation with a Windows antimalware tool is probably greater than everything else.

  • 1
    This partially answers my question. However this brings up a new question: do I need to deinstall wine entirely, for the entire system? – Distant Graphics Apr 11 '15 at 11:48
  • 1
    As I said, by removing your .wine directory you should be okay. If you want to play it really safe check the rest of your home folder and your /tmp folder for suspicious .exe files and zap them too. In practice, by doing this, I think, we cover basically all realistic possibilities. – Tobia Tesan Apr 11 '15 at 11:51
  • I found a bunch of things in /etc/alternatives called "fakeroot". Does anybody know what that is? They are all .gz files. I also found a random .ttf "fonts-japanese-gothic.ttf" – Distant Graphics Apr 11 '15 at 11:56
  • As I mentioned, remove your .wine, remove any *exe files from /tmp and your home directory and stop. /etc/alternatives/fakerootin particular is a legit file used by update-alternatives, leave it alone. – Tobia Tesan Apr 11 '15 at 12:01
  • Ok. Thanks, so just /tmp? – Distant Graphics Apr 11 '15 at 12:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.