Solved Virus in Wine and Mizutamari?

BingHelloMan

BingHelloMan

I don't know where to send possible Virus results from programs, so I am gonna send it here

I copy all my directories and files that are in $HOME to my local QNAP NAS and one of its features is that it scans all the files for any viruses and it gave this output

JobName = Scan
Reveal LogLastScanTime = 2024/09/15 00:00:02
AntivirusEngine = ClamAV
WARNING: /share/****/: Can't access file
/***/@Recycle/Main-DesktopPC/BSD/.i386-wine-pkg/usr/local/lib/wine/i386-windows/msiexec.exe: Win.Trojan.Malwarex-9888050-0 FOUND
/***/Main-DesktopPC/BSD/.local/share/Mizutamari/Games/GOG-Galaxy/drive_c/windows/system32/msiexec.exe: Win.Trojan.Malwarex-9888050-0 FOUND
/***/Main-DesktopPC/BSD/.local/share/Mizutamari/Games/GOG-Galaxy/drive_c/windows/syswow64/msiexec.exe: Win.Trojan.Malwarex-9888050-0 FOUND
---------------SCAN SUMMARY------------------
Known viruses: 8697522
Engine version: 0.102.2
Scanned directories: 50236
Scanned files: 844421
Infected files: 3
Data scanned: 612657.98 MB
Data read: 2171898.96 MB (ratio 0.28:1)
Time: 79137.189 sec (1318 m 57 s)
Click to expand...

( **** is a place holder for my name and family members name and the reason why .i386-wine-pkg directory is in Recycle instead of the rest is because it took too much space so i trashed it and thats where all the trash goes)

I scanned all 3 of those threw my ClamAV 1.3.2 where those files are stored and found no threats

So I put them threw virustotal.com and got those results (msiexec.exe from wine/i386-windows and GOG-Galaxy/drive_c/windows/syswow64 were treated the same, when I tried to drop GOG-Galaxy/drive_c/windows/syswow64/msiexec.exe in to the scanner it redirected to the wine/i386-windows and GOG-Galaxy/drive_c/windows/syswow64
results )

VirusTotal

VirusTotal
www.virustotal.com www.virustotal.com

VirusTotal

VirusTotal
www.virustotal.com www.virustotal.com

I also downloaded the results as PDFs if you want to read offline the basics, but if you want to go to more detail follow the link
 

Attachments

I tried ClamAV a while back, and it returned so many false positives to be practically useless. I'm sure it has its place, but as a normal desktop computer AV program, it is not the right tool for the job.
 
cracauer@ said:
Not if a previous run of the malware modified the install mechanism.
Click to expand...
Then it means that we all have problems. ;) msiexec.exe is a part of Wine (wine, wine-devel, wine-proton, etc.) packages, build from the source on FreeBSD infrastructure. The file is copied from /usr/local/depends_on_package directory.

I'm voting for false positive in this situation. Antiviruses sometimes mark an old (use of a deprecated Windows API) code as viruses.
 
cracauer@ said:
Not if a previous run of the malware modified the install mechanism.
Click to expand...

I think I didn't explain myself well.

What I'm saying is that even the default and initial installation of the package triggers the alarm. I know this, because less than a week ago I got the same false alarm when installing Wine for a game.

The problem is long known as a false alarm, in fact, VirusTotal itself confirms it, since the "virus" only appears in 4 or 6 tests out of almost 80, and as I said, the community has already marked it as a false alarm since 2021.

Second, the installation mechanism is protected by root, because it is the command:

Code: 
/usr/local/share/wine/pkg32.sh

Which is used (in amd64) with

Code: 
/usr/local/share/wine/pkg32.sh install wine mesa-dri

Or

Code: 
/usr/local/share/wine/pkg32.sh install wine-proton mesa-dri

And the packages in question are brought from FreeBSD Packages. In fact, if you install Wine on your machine and scan this file, you will surely find the surprise

Code: 
/usr/local/lib/wine/x86_64-windows/msiexec.exe

And the same goes for its i386 version.
 
You must log in or register to reply here.
Back
Top