Advanced

Of WINE and Viruses

Posted by tracyanne on · 11 comments
LXer Linux News; By Tracyanne 		Mail this story
Print this story


LXer Feature: 22-Mar-2010

I turned to him and said "you've been surfing the porn sites, haven't you."

I got a call from one of my clients last night, he's running SuperOS, SuperOS it seems comes with WINE installed by default.

His complaint was that he was getting these icons appearing on his system tray, and when he clicked on them they opened a control panel - he sent me an email with a snapshot of the control panel, and the multiple icons on his system tray. Si emailed him back to say stop clicking on the icons and I'll be there later.

I arrived at his place, sat in front of the computer, clicked on one of the icons, and watched while the control panel informed us that his computer had 4000 + viruses. I turned to him and said "you've been surfing the porn sites, haven't you."

Like a naughty boy caught smoking behind the bike sheds, he agreed that this was true, "but" he added, "who doesn't".

I laughed and asked him to show me what he had been doing to get the control panel on his system, so we spent a few minutes scrolling through images of young ladies in poses that can't be described on this family site. He paused at an image of one particular young lady, that bore a caption inviting him to view a movie, and said "then I clicked here". "Ok do it now", I replied. "Are you sure", he said, "this is porn". "I know all about porn", I told him, "just click on it". So he did.

We waited a few moments, then he said "it's gone somewhere now", I grabbed the mouse and located the windows .exe file in his Downloads directory, along with about another 20 others. He told me "They just download and when I double click on them that control panel opens".

I turned to him and said, "That's the point. The control panel is designed to make you think a Windows computer has lots of viruses, and convince you to download the anti virus software it offers, only the anti virus software IS the virus, and it looks like WINE is now quite capable of hosting windows viruses."

I un-installed WINE, and removed the .wine directory, for good measure. I said to him "Right now those Windows programs won't run on your computer", and showed him, "You're now safe to go back to watching your porn".

  Nav
» Read more about: Story Type: Editorial, LXer Features

» Get new stories by e-mail: nightly or as they are published

« Return to the newswire homepage

  Related stories
» More like this

Comments (11)

Nice to see its compatibility improving

jhansonxi ·
This is the type of cross-platform capability that Linux needs in order to entice the third-party security software advertisement subsidies that help offset the price of Windows laptops.

Really though - you can't fix stupid.
techiem2 ·
lol. "Norton Antivirus - Wine Edition! Keeps your bottles safe!"
tuxchick ·
Safe Surfing with prOnBuntu!
twickline ·
ClamAV Antivirus software running in Wine howto :

http://www.burghardt.pl/2007/11/wine-with-on-access-clamav-s...

Now go back to watching your porn.
jacog ·
Although, I think removing WINE from his puter was not the right solution - well, overkill anyway. I suspect that the way he got the infections in the first place was because he was running IE. I presume he was using IE because the sites he was surfing claimed to only work in IE.

At least he learned a lesson. Well, one hopes. :)
tracyanne Story submitter ·
no he was using Firefox. The site work quite well in Firefox. He was downloading the .exe, then running it, by double clicking on it. Super OS, like the rest of the Ubuntu clan, allows Windows applications to run from the double click, just like they do in Windows, when WINE is installed. He didn't actually have any viruses, just the precursor... the fake control centre that scams people into downloading a fake Anti Virus, which is actually a trojan, and I suspect it would have run quite well.
jacog ·
Silly sausage. I usually have my Desktop set up so I can run Windows exes from the double-click also. But then I don't run any old dodgy software, and certainly nothing gotten from dodgy web sites such as the subject of the post. ;)

This is an interesting read though: http://media.codeweavers.com/pub/crossover/case_studies/Wine...
tracyanne Story submitter ·
Removing WINE altogether,was, I think, the best solution. He is a happy clicker, and has probably download lots more of those windows exes (only now they won't run). Additionally the software the control panel encourages you to download isn't a virus, in that it exploits some weakness in Windows to install itself, it's a trojan, that does it's job, probably creating a back door for a bot net controller to access. In other words it's just a standard Windows program, that should run, if WINE is at all any good..... the weakness it exploits is the silly sausage behind the mouse. Unfortunately there is no technical solution to that, other than the one I used.
jacog ·
Me, I'm one for letting the child touch the hot stove plate. :)

Congrats WINE devs

amenditman ·
Fantastic work you guys. If only Redmond would be as thorough in their development efforts, we might all still use their products.

WINE ROCKS

Alternatives (?)

hkwint ·
Some things 'one' might consider:

-You can change extention-behaviour in FF, though it seems a bit buggy. In FF Goto Edit --> Preferences --> Applications and probably if you delete .exe the problem might be gone.

-You can run opera -private or for FF look at this: https://addons.mozilla.org/en-US/firefox/addon/12710

if pr0n ehr I mean privacy is a concern for you.

Post a comment

A free account is needed to post. Write your comment here first: your text is kept in this browser while you sign up or log in, and is waiting for you when you come back.

Your message:
|||||
10
Markdown: **bold**, *italic*, [text](https://link), - lists, > quotes, $x^2$ for math. Formatting help

Sign up and post (it is free)  or  Log in and post