I (stupidly) ran a .pif file attached in a spam email that I can assume was containing some malware. Basically I double clicked on it and it was opened with Mono. I didn't see anything running and after a while I reboot the system.

I understand a .pif file can contain a windows executable, but I have no idea about the effect of running a malicious .pif with mono under Ubuntu. Should I assume my Linux system is compromised?


Edit: Good idea scanning with VirusTotal! This is the result

It seems indeed a fresh malware targeting windows. Is there the risk that Mono executes its malicious commands in a way that something like "delete c:\*.*" becomes "rm /* -rf" in linux? Even if I am not root, many user files should be at risk.

  • If you ran it as a regular user it is extremely unlikely to affect anything outside of your $HOME directory, but without analyzing the file, who knows ??? – Panther Jul 14 '15 at 17:34
  • I edited my answer to reply to your added question. – mdd Jul 15 '15 at 1:41

As @bodhi.zazen mentioned, if you executed the file as a normal user, it is very unlikely to infect your system. It may affect the files you store in your home folder (such as deleting them or uploading them to a remote server), but apart from that, no other impact is likely.

What you could do is to upload your .pif file to an online virus scanner such as VirusTotal to determine if it actually is a virus and its mode of operation.

But again, it is unlikely to have affected your system. If it was a virus that targeted something specific in your Linux home folder (for example, your ssh keys), it would not have been distributed as a Windows-based .pif file.


Regarding your added question: Yes, it is possible that that mono will execute such a delete command. However, from the description in the VirusTotal link, it seems it is more an adware trojan than something that destroys your data. If you didn't notice any missing files, I think you are quite safe.

  • As you're a reputation 6 user: If this answer helped you, don't forget to click the grey at the left of this text, which means Yes, this answer is valid! ;-) – Fabby Jul 16 '15 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.