Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Might be a silly question, but I was wondering... WINE has permission to edit certain (profile) folders and provides Windows based software to run under Linux. Could it also provide Windows viruses an environment to run? Like running Windows based botnet connectors, spam senders, infect other (WINE) programs or folders, etc.

Furthermore, what could be the dangers to your Linux system that would allow such things to run?

share|improve this question
Wine comes with it's own DLLs, which usually don't have the same security holes than the ones provided by Microsoft. That means a Virus that targets vulnerabilities in the system DLLs is most likely unsuccessful. – Georg Schölly Nov 4 '10 at 12:25
up vote 6 down vote accepted

It is possible.

I have recently been testing a few scenarios on Ubuntu on a virtual machine running trojans and similar. Due to the way WINE gets run, it is easy to see and kill the process, but it can run malware - even as services.

However, it is usually invisible to the end user as most target Internet Explorer or registry keys that simply do nothing.

Even with the above being said, I never looked far enough in to the files to actually discover what they were doing - I am sure it was waiting for a command or similar.

The bad news is, without good Linux experience it is hard to remove. I tried uninstalling and reinstalling WINE, but the configuration and various stored files still remain - you have to do a complete manual delete of the WINE config and drive (Located in '~/.wine'), and various other configuration scripts.

I know it was infected as whenever I restarted the machine after deliberately infecting, services.exe (I think it was called) and various WINE processes automatically started with the machine and took huge CPU time where as it never did anything like that in the past.

share|improve this answer

It is possible, provided the viruses are compatible with WINE :)

The big thing about viruses is dependencies and how they propagate. In WINE, not all Windows features will be available, and you will probably get dependency (dll) errors when trying to run some.

I recall an old article that tested a few of the most popular viruses in WINE, and the end result was disappointing as the system was never severely affected.

Edit: Running Windows viruses with Wine - a good read.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .