1

I (stupidly) ran a .pif file attached in a spam email that I can assume was containing some malware. Basically I double clicked on it and it was opened with Mono. I didn't see anything running and after a while I reboot the system.

I understand a .pif file can contain a windows executable, but I have no idea about the effect of running a malicious .pif with mono under Ubuntu. Should I assume my Linux system is compromised?

Thanks

Edit: Good idea scanning with VirusTotal! This is the result

It seems indeed a fresh malware targeting windows. Is there the risk that Mono executes its malicious commands in a way that something like "delete c:\*.*" becomes "rm /* -rf" in linux? Even if I am not root, many user files should be at risk.

Improve this question
2
  • If you ran it as a regular user it is extremely unlikely to affect anything outside of your $HOME directory, but without analyzing the file, who knows ???
    – Panther
    Jul 14, 2015 at 17:34
  • I edited my answer to reply to your added question.
    – mdd
    Jul 15, 2015 at 1:41

1 Answer 1

Reset to default
0

As @bodhi.zazen mentioned, if you executed the file as a normal user, it is very unlikely to infect your system. It may affect the files you store in your home folder (such as deleting them or uploading them to a remote server), but apart from that, no other impact is likely.

What you could do is to upload your .pif file to an online virus scanner such as VirusTotal to determine if it actually is a virus and its mode of operation.

But again, it is unlikely to have affected your system. If it was a virus that targeted something specific in your Linux home folder (for example, your ssh keys), it would not have been distributed as a Windows-based .pif file.

EDIT:

Regarding your added question: Yes, it is possible that that mono will execute such a delete command. However, from the description in the VirusTotal link, it seems it is more an adware trojan than something that destroys your data. If you didn't notice any missing files, I think you are quite safe.

Improve this answer
1
  • As you're a reputation 6 user: If this answer helped you, don't forget to click the grey ☑ at the left of this text, which means Yes, this answer is valid! ;-)
    – Fabby
    Jul 16, 2015 at 20:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .