Slashdot Mirror
Running Windows Viruses Under Linux
ResQuad writes "Everyone loves Windows viruses, right? Well, the crazy people over at NewsForge (owned by the same people that own Slashdot) decided to try running Windows viruses with Wine. So next time you receive an email virus, strike up Wine and see what you can do (or not)."
Now the question is...can AVG run with WINE??
"The Matrix has you."
Will this run on a Lexus?
Lets see just how non emulator wine is... If the virii own it, its an emulator, if not, its telling the truth.
Bwhahahh...
Roses are red
Violets are blue
In Soviet Russia
Poems write you!
fred ~ $ wine win.com
Oh my god, how many times do we have to say it? People, running Windows software under WINE is not a solution. I say all Slashdotters should boycott these software vendors until we get a serious commitment from them to do true, native Linux ports of their products.
And for that matter, why aren't their open source alternatives to this software already? The open source community won't stay competitive by resting on its laurels.
Breakfast served all day!
*Pulls out Stealth-C*
"Now *THAT'S* a virus!"
I like my viruses to run on my HARDWARE, not just my OS.
Brilliant work guys!
When things get complex, multiply by the complex conjugate.
Programmers these days, don't they even CARE about cross-platform compatability!?
True AV and AT (anti-trojan) SW engineers uses VMWARE for their studies and dissemination of malacious flotsam of codes floating around the internet.
But the article is "A Good Thing" because it shows EITHER that Wine isn't 100% Microcrap or is more robust against viruses.
Take your pick.
This is one of the reasons why Linux has a hard time to catch up with Windows. Viruses are one of the Windows applications that need to be ported to Linux.
Retarded waste of time Department
Why?!
I must say, it was a joy to read this article, particularly since it's the day after getting two wisdom teeth out, and then having to write a test less than twenty-four hours later. It REALY made my day - I needed that.
Robert B. Marks
Author, Demonsbane in Diablo Archive
i for one won't be satisfied until there is complete binary compatibility. damnit.
Someone finally found some use for WINE...
The point being its not a zip file to begin with. its simply disguised as one.
I have accepted Provolone into my life!
Its nice to see someone finally exploited this long missing aspect of linux. What better way to make a windozer user feel more at home than with their old virus friends.
Nice article, and congrats matt on your first article.
-Craig
Lovgate simply exited without doing anything. Mydoom actually crashed WINE into its debugger. The Netsky variant, as the article describes (SomeFool is Netsky) actually ran. Moreover, it did a passel of DNS queries and actually tried to send e-mail (which was rejected). So, if that e-mail had been accepted, Netsky would have been able to propagate under WINE. As in the article, Ctrl-C proved necessary and effective.
To make a long story short, yes, some Windows viruses do run under WINE. Of course, you have to tell WINE to run them -- not exactly the social engineering that viruses are intended to do. However, as WINE gets more popular and reliable, I would expect that this will be more of a problem for people who choose to (e.g.) run Outlook in WINE.
(For what it's worth, WINE isn't the only way to run Windows viruses and worms on your non-Windows system. I've had to explain to users that yes, their VMware or Virtual PC system is quite capable of getting wormed, and that yes, they did need to do their Windows Update on that "virtual" Windows system, too.)
Solitare. It's the only game I care about.
"Who are in control, they are not in control of anything - they don't even control themselves!" - Glen Beck
I tried clicking on the link and got a 404 out of it. Wondering if Timothy decided to check out that whole wine thing on a slashdot server.
I guess it would be interesting to see if a virus/worm would work under WINE but in the end, what would it really mean if it does?
Compatibility jokes aside, it would mean that the way the operating system handles things is inherently insecure. It really couldn't be blamed on a WINE implementation because the virus/worm worked on the original OS. (If it didn't work on windows but worked on WINE, then that's completely different).
It's definitely a bizarre practice and not one I'd personally try -- but for those who want to decompile and make sandboxed studies of viruses, it may be worth something. Not as much as studying it live on a controlled win32 network but I bet it has its merits.
The wine developers get a non-compliance notice from Bill forcing them to comply??
Now, how can you claim full compliance unless you run my viruses too..goddamn it!!
Rapid Nirvana
I run Linux on my desktop and I was feeling a bit left out.
- Greg
Start a happiness pandemic
I run Windows spyware under Wine. I also emulate IE6 so I can use CoolWebSearch and other cool searchbars! I have this cute Bonzi Buddy and a system tray icon which tells me the weather!
I'll be impressed when people can run Windows viruses on QNX or Plan 9!
Elmo knows where you live!
...to stop Wine-ing
Geeze!
It's such a fine line between stupid and clever.
It's simple. A lot of specialty software is very boring, and there just isn't any interest in the OSS community in developing similar software.
Many businesses, especially real estate, banking, auto repair, fast food, and hotel management, rely on software written for windows many years ago that, for them, functions just fine.
They're not techies: computers are not their business. Their business is their business. They're not going to invest resources in developing what they already have just so it can run on "another kind of computer." WINE is the perfect solution for these applications.
Maybe, years from now, when they're running -ALL- of their software under WINE, they might realize that there's a better way.
Until then, good luck finding good programmers who are psyched to write hotel reservation management software that will interface an archaic database platform for free.
Projects like Open Office and The GIMP don't suffer from this problem largely because they're applications that Linux users need on a regular basis. When was the last time you needed to track your fast food orders?
GeekNights!
Late Night Radio for Geeks!
I run Grisoft's AGV AntiVirus under wine, so this wouln't even be an issue.
Funny how I have to run an AV app when running under Linux...
The Kai's Semi-Updated Website Thingy
What would RMS say?
Is that virus Free Software?
LedgerSMB: Open source Accounting/ERP
Seems like it should be illegal to knowingly and willingly run a virus or worm that is known to affect more than just your own system. After all, it's illegal to reformat someone elses hard drive without their consent.
When a zip file on Linux is not a zip file, you get an error.
When a zip file on Windows is not a zip file, you get some system enhancemnets you may not have wished for (or would even wish on your worst enemy).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Running Microsoft programs is the hardest for Wine because they use secret function calls. The Virus writers (presumably) aren't insiders so don't know about the secret APIs. Should be easy for Wine.
Now Windows users have no excuses for not switching to Linux, they can even run they favorite viruses on it!
I know the viruses didn't run great yet, but that's only a matter of time...
a couple years old? I'm sure I've seen it before, and I'm pretty sure it was on slashdot.
These guys really need to step up their efforts to improve compatability.
love is just extroverted narcissism
Linux kernel now supports foriegn binaries. IIRC, some patches are available to enable support for PE binaries (Windows native binaries). If dependencies are kept low, with some clever programming, virii that run on multiple platforms are possible without something like wine or java.
WINE is a "contained" platform to let the virus roam free... just like the jurassic park was supposed to be for the re-created dinasaurs... but soon enough, the windows virus will mutate and infect the rest of the machine... taking over linux... ;)
A lot of geeks can't even get far to get a female mate. :P
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Though it's good to know that WINE will do what it's supposed to do--execute code written for Windows, it's kinda silly to think it wouldn't.
/ to see what happens!"
Maybe they'll post a story about, "Why do dumb users get to have all the fun? Why shouldn't Linux admins get in on all the insanity, too? Today we'll be doing rm -rf
Let's not go to Camelot. 'Tis a silly place..."
I might know what I'm talkin' about, but then again, this is Slashdot...
...if viruses wouldn't work?
Solitare. It's the only game I care about.
...but obviously not enough to spell it correctly.
This was discussed a few years ago in the article "WINE: A new place for KLEZ to play", although the original site is now defunct (the article was also covered on Slashdot).
This article ran fine under firefox and delivered interesting content. The methodology was fundimentally flawed as viruses use obscure problems in Windows. Nevertheless, I'll give this article four meta-penguins, for a score of 4/5.
Since when has this country used intellectual elite as a pejorative term?
I can believe all the people complaining that this is a waste of time. Don't you know how much FUN viruses can be?
Take Magistr: I'd spend HOURS chasing my icons all over the desktop. Or what about the one that would crash my system every time I shot a rocket into a wall in Quake 2 (I'm not joking, I really had one that did this)?
Come on, this is quality entertainment!
"Sometimes you have fun, and sometimes the fun has you"
Weren't you supposed to make a goat.cx link out of this random bit of text?
I'm still waiting for the e-mail telling me to launch the attached jar file.
[Insert pithy quote here]
Right before Y2K, there was a worm/virus/whatever called Happy99.exe. If you secured your wine installation prior execution, you could watch the pretty fireworks it produced without harming your installation.
Life is just nature's way of keeping meat fresh.
oh great, next thing you know people will be porting over spy ware and i wil have to run adaware in wine. seriously, tho people need to start writing portable code so they don't get vendor trapped. i'm not saying microsoft is bad, but im not going to depend on their os just because it is the most popular, things change.
From the article:
Oh sure, I could manually forward these viruses to the folks in my address book, but where's the fun in that?
This reminds me of the old standby text-based, system agnostic viruses, some of which can be seen here.
That green slime had it coming.
At the last WineConf (almost exactly one year ago) some of the Wine developers were testing the hot mail virus of the day to make sure it ran. That was the one that activated as a DDoS on www.sco.com. It ran, and after putting making www.sco.com resolve to 127.0.0.1 in /etc/hosts it attempted to take down the local machine.
We also found the back door, and came close to getting arbitrary programs to run from it, but supper came before we got that part working. We think it would have worked if a free meal hadn't gotten in the way.
So now you know. If a windows virus doesn't run under wine you can thank CodeWeavers for buying everyone a meal before we got it implimented.
I have submitted entries into the DB for various other viruses that have happily found their way into my inbox, but they haven't accepted anything other than Sircam. This is a shame because Sircam is very out of date. We now have a whole bunch of much nicer, better viruses. I hope that this article will correct this problem with the app db. They need to fix this policy. Just because some of us use Linux doesn't mean we should be excluded from receiving whatever benefits these small applications may have to offer.
Note that when I do run viruses, I make sure that things are set up so that they can't possibly get out to anyone else' computer. This is pretty easy because I don't use Outlook so the viruses have no way to spread. But I am careful because I don't want to spread these things or otherwise be a "bad netizen". Wine is the perfect way to explore the features and benefits of these little applications without causing harm to myself or others.
Whine is Hazardous, even If Not and Emulator
"Flyin' in just a sweet place,
Never been known to fail..."
So, if WINE fails to properly run a Windows virus under Linux, is it considered a bug or a feature?
"Provided by the management for your protection."
So next time you receive an email virus, strike up Wine and see what you can do (or not)."
I suppose the first thing that comes to mind is...why?
No matter how much you think it is, it's not.
no you can't. you can only blame the article for wasting 30 seconds of your time. the other 4.5 minutes are your fault for not clicking the back button.
You know, some dimwit is going to read this thread and/or the article and go running to his boss saying, "See? SEE?! Linux has Windows viruses too!"
Just you wait and see....
To put a witty saying into 120 characters, jst rmv ll th vwls.
Right now I use a sacrificial lamb VMWare instance running under Windows to disect viruses or suspected trojan horses. Being able to do that under Wine running on Linux might be quicker and minimize the chance of an unintentional host infection.
Isn't this like a double negative? You install one virus on top of another virus (Windows) don't they cancel each other out??
Almost as sick as compiling KDE to run under Cygwin so that you could have a KDE desktop on your windows box.. Just 'cause you can do it, just dont make it right! Ugh.
Cool, maybe it can enable the turn signals on those Lexuses. Lexus: So insulated from the road, you can forget you're driving!
...only on Slashdot (& it's Newsforge affiliates) do we see nerds enough to TRY AND GET A VIRUS! I fear for the rest of the world, and lead them in saying that, I, for one, welcome our new nerd overlords!
...Had this been an actual emergency, we would have fled in terror, and you would not have been informed.
How is this newsworthy? They ran a bunch of windows crap under wine, and as per usual, it didn't work anything like it should. Sounds like someone had a slow newsday.
Side note: I think we need to stop pushing for things to be cross-platform when they wern't designed to be in the first place. Portability is "neat" and that's about it.
What? No MS Office? Use Open office, K-office, Abiword, etc.
What? No Photoshop? Use a Mac.
What? No Games? go back to windows (for now)
...are those viruses digitally signed?
u r a sillee bytch
YES!!! Linux is finally ready for the desktop!
This isn't the sig you're looking for...
To not run wine or windows in any form on linux.
||| I still can't believe Parkay's not butter.
Kindly Leave The Stage!
Of course wine is an emulator, it is just a much higher level emulator than Bochs, Vmware, Win4lin or even UltraHLE. Many people claimed UltraHLE wasn't an emulator because it interpreted video/audio list data rather than emulating the N64 hardware, but it is still considered an emulator.
Do we see any link supporting your statement? No. Sorry, try again later.
Oh my god, how many times do we have to say it? People, running Windows software under WINE is not a solution. I say all Slashdotters should boycott these software vendors until we get a serious commitment from them to do true, native Linux ports of their products.
And for that matter, why aren't their open source alternatives to this software already? The open source community won't stay competitive by resting on its laurels. Jeez.
just in case...
I coded up a perl Mass mailing email worm that sent itself as an attachment to every email address it can find in $HOME/Mail/* etc. It also came with a handy text message saying how to run it etc.
I never tested it though.
Why the hell would you want to do this... Well, I suppose you might if you have an unwanted linux machine.,..
When will O'reilly jump in with, "Performance tuning viri for Windows on Wine"?
Obviously work is still needed on Wine to make it more Windows compatible :-)
Yup, I run VPC on my Mac; I *only* fire it up to double-check website code on IE for compatibility, then shut it down again. Don't do ANYTHING else with it.
Today, out of curiousity, I installed AdAware and ran it through. Sure enough, at least 19 spyware doo-dads scattered around.
Jeeezus...I know I'm biased as a Mac guy, but Windows has truly become COMPLETELY toxic at this point; it's like plutonium, infecting *anything* that it comes near.
And, how do you spell "cunt"?
http://www.genmay.com/showthread.php?t=492963&page =4
probably not, coincidence is probably more likely.
lose != loose
it's a standard way to test virus checkers.
sheesh.
The Kruger Dunning explains most post on
pictures of a petrified Natalie Portman, and a big steaming bowl of grits.
The Kruger Dunning explains most post on
Hello, fellow Slashdotters,
I use Microsoft Windows XP, Professional Edition, Service Pack 2; yet my computer is missing the viruses mentioned in this article. Where did I go wrong? My Web browser is Mozilla Firefox 1.0, and my e-mail client is Mozilla Thunderbird 1.0. Should I change these? Microsoft Internet Explorer 6.0 SP-2 is resident on my computer for testing my websites in this popular program. Should I browse more freely with it? I prefer to use open-source-licensed software on my computer when possible (except the OS itself, although I do have an underutilized Debian partition). Should I start downloading random programs without being sure they do not contain any kind of malware?
I just want to get along better with my fellow Windows users! Please, help!
On vit, on code et puis on meurt.
I'm sure crossover has some kind of patch to that stops outlook executing other programs...
Tried that. It worked pretty well. Most programs don't run all that well on WINE. But it is nice to place klotski and minesweeper now and then.
Maybe, years from now, when they're running -ALL- of their software under WINE, they might realize that there's a better way.
Yeah... like... booting Windows?
I suspect I may have a virus on my Linux system. The other day I switched the computer on, and it took a very long time to boot - and kept spewing out all this cryptic text as it did. After I logged in, I noticed that my desktop menu had a lot of strange, poorly documented programs in it, some of which didn't seem to do anything useful. The configuration system was strangely flakey, popping up tabbed windows that wouldn't go away when I clicked on other options. Various programs worked partially, but in some of them the clipboard didn't work properly and in others the windows widgets and controls looked wrong. A few would randomly open shell windows when I tried running them, even though they were GUI programs. The windows theming/skinning system worked partially, at best. I tried running a graphics program, but it just opened up lots of windows all over the screen and I couldn't get it to do anything reasonable, so I gave up. I suspect it was the cause of the virus infection, in fact, because it was called some insulting and childish name that had nothing to do with Graphics or Image Manipulation Programs or anything else. Oh, and there's this picture that shows up everywhere, of some kind of anatomically improbable cartoon bird with an eating disorder, which is either a symptom of virus infection or else a failed attempt at coordinated branding by a lot of uncoordinated programmers.
In general, my Linux system seems to be totally hosed. I think I'll go back to Windows.
I have discovered a truly remarkable
its really fun when people try their best to infest a linux computer and they fail
Of the many different applications I've tried to run in Wine, only viruses seem to work (mostly) as intended. On the bright side, at least they're truthful about their development status -- every release email has the standard disclaimer: "This is still a developers only release. There are many bugs and unimplemented features. Most applications still do not work correctly."
Loading...
he wont object to me walking his glorious ways :)
So are Linux and Windows more able to be Compatible, or are they more able to duke it out now?
I caught some kind of virus while trying to download a software update for a friend. It was called the "Windows Genuine Advantage" or somesuch thing. It runs nicely under wine but refuses to give me a validation key.
Meh.
lizardb0y
http://www.vintage8bit.com/
Ah, all those times that my friends have sent me chain letters warning of a vicious virus pillaging and raping their bits and bytes (respectively), I broke out in tears beacuse my linux wont support said viruses. Woe is me.
Stupid linux... First it doesn't support Windows Media Player, then viruses too? If there wasn't a minesweeper clone, I'd have to go back to Windows!
- shazow
Well if wine won't run the winblows virii wonder if win4lin will??
Heck win4lin now has a home version for sale here
Now where did I put that win 98 disc?
"Do not meddle in the affairs of wizards, for you are crunchy and good with ketchup."
wasn't this done like 3 or 4 years ago with sircam???
i just don't understand why one wants to run wine or similar softawre on an otherwise clean OS, please do your self a favour, and keep your dirty laundry were they belong...
Virus is a Latin second-declension neuter noun.
Dictionary entry from William Whitaker's Words:
Both nominative and accusative cases of the second neuter plural have the ending -a. Therefore, the correct plural form of virus is vira....People mostly associate the -us ending with words which are non-neuter second-declension nouns (pl nom ending of -i), however, and logically transfer this to virus - in which case it should be viri (one i)
Speaking of running Windows viruses... is there an existing tool to run VBS scripts under Linux?
I know, the last thing Linux needs is another scripting language, and VBS is such a horrible abomination.
The one non-viral use of VBS scripts I have seen is Visual Pinball.
There has been some talk of making a similar pinball simulation for Linux, but one of the major obstacles is that there are already hundreds of pinball games already simulated in Visual Pinball, by dozens of authors, and they all use VBS scripting (as required by Visual Pinball). This is required to interact with the PinMAME emulator (for modern games) or to implement the entire logic of the game (for old games that did not use a computer). It would be nearly impossible to get everybody to rewrite their tables again from scratch!
If Visual Pinball is ever ported to Linux, it would be necessary to write a VBS script interpreter for Linux (assuming one doesn't already exist). Heavily sandboxed, of course!
Dr. Demento On The 'Net!
That's interesting info!
- David A. Wheeler (see my Secure Programming HOWTO)
True Story!! I tried to install Bonzi Buddy under WINE a few years ago. The machine locked hard eventually. Couldn't find all neccessary files to corrupt. Sure as heck was funny trying though.
There's a Windows guy and a Mac guy in a bar talking up the merits of their favourite operating systems.
Win guy: "OSX is hopeless! Nobody supports it, nobody writes applications for it. You can't get any decent software on the Mac."
Mac guy: "Yeah, well at least we don't get viruses!!"
Win guy: "You see!? Not even the virus writers support Macs!!"
~
~
~
-- INSERT --
When I was finished backing up and installing on fresh hardware and had the backup for that hardware installed properly, I did this. I started off with disconnecting the hard drive. FreeBSD didn't seem to care. Apache kept on running as did ftp, ssh, and my firewall routing. I thought that nature would take its course and just left. A couple days later I came back, and to my suprise the damn system was still live and functioning. Kinda pissed off, I ssh'd in and rm -rf /'d as root and the damn system still didn't die.
The console collected a whole lot of error messages, but at 25 lines I could only have 25 at a time and since /var was no longer present, I only had to deal with an error for 25 lines before it dealt with itself. Eventually, I just pulled the plug. FreeBSD 4 really is unkillable. It might complain when you try to kill it but lack of hardware doesn't seem to make a difference to FreeBSD.
Nice.
You're welcome, grandparent.
Most people don't believe everything they hear from Anonymous Cowards on Slashdot, so if you're going to scream about "truth", be ready to provide links to back up your impudent statements.
What a pointless and inconsequential story. This isn't even interesting from a hobbyist's perspective -- it's sheer mental masturbation, crafted solely for a chuckle or two on the part of the people involved. This is not newsworthy in the slightest bit, even on a forum dedicated to nerdy news. Please use more discretion in the future, slashdot!
When a zip file on Windows is not a zip file, you get some system enhancemnets you may not have wished for (or would even wish on your worst enemy).
Uhhh... no. File associations are based on extensions. It's probable that you've forgotten to turn off the Explorer "feature" of hiding extensions for known filetypes. This way, you get sexygirls.jpg.exe which appears as sexygirls.jpg, or xxx.zip.scr which appears as xxx.zip. Most people are ignorant enough to leave that "feature" enabled as per Microsoft's negligent default; furthermore, most users who are pseudo-capable with computers will click on it with the flawed reasoning that, "Well, it's a JPEG, so it can't be a virus".
Furthermore, years ago I ranted on my website that it was *very* possible to run Windows e-mail viruses, etc. under Wine. So easy that, with Red Hat 7.2's default associations which launch Wine to run DOS/Windows apps, I accidentally infected my Wine directory while demonstrating Linux freedom from virii... "Moving right along, you can see how well Linux can emulate Windows well enough to run many programs..."
Fire and Meat. Yummy.
I'm pretty sure I remember it using a buffer exploit somewhere in WinZip, so even if it seems like a valid Zip file a directory entry is corrupted (or something along those lines).
The Linux zip utilities just generate an error at that point.
Which is not to say a Linux utility could never have an overflow either (though I think chances are less likley with greater scrutiny of the code) but that any epxloit would be limited as to what it could do, unless you did something like "sudo unzip" (which there is no reason to ever do).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
"News" .. means new :)
1 9&tid=125
http://slashdot.org/article.pl?sid=02/10/23/18532
Demand native viruses: http://www.lwfug.org/~abartoli/virus-writing-HOWTO /_html/
It's viruses.
...WINE is supposed to do what the API call should be doing, with "normal" bug-for-bug compatibility. If Windows has a buffer overflow, race condition or similar WINE shouldn't reimplement it, because it is not something Windows programs rely on either. That means that most worms (exploitable services) shouldn't work. That means most viruses should work (PEBCAK).
Kjella
Live today, because you never know what tomorrow brings
I would have though that you were serious without those.
someone just sent me the Win32/Bagle.19731. It is a control panel applet. I'm runnig Suse 9.2, wine 20040813 Can you help me!!!!