Month: March 2009

Running Windows malware programmes in Linux in Wine

Wine is program that you can use to run some Windows applications under Uinux like OSs.  Many GNU/Linux users it run unavoidable Windows software.

McAfee Avert Labs’ Lokesh Kumar did an interesting research, finding out whether it is possible to run viruses that was originally written for running in Windows in Wine windows emulator.

Although running Windows applications in Wine has its advantages, it also comes at a price: bringing Windows malware into Linux. I’m aware that it isn’t Wine’s responsibility to distinguish between a malicious and a nonmalicious file, and that Wine shouldn’t have any problem running a malicious file; however, I had this morbid curiosity to see how well today’s malware would fare running on Wine, and so began an experiment ……

McAfee Avert Labs

My intial thought was that it won’t rune perfectly. I based my assumption that Wine is not good for running all Windows softwares, we can run only minimal ones there.

But, how wrong I was.

Three times the malware ran, as it should, under native Windows. At one time it failed also.

He also gives some tips that you can use to prevent anything like this happening to you, but I believe the chances are minimal..

  • Never run Wine applications as root.
  • Wine maps the root directory, the user’s home directory, CD ROMs and removable devices found, and these mappings are listed in “~/.wine/dosdevices/”. Consider deleting these except the link to your drive_c.
  • Do not set the file association for Windows executables with Wine. This would enable the running of Windows executables in Wine by simply double-clicking them.
  • Administrators should think twice before installing Wine on a Linux server. These machines are seldom turned off, and so the problem that a malware faces in Wine with respect to autostarting its code when the machine boots up, I mentioned this earlier, would become void.