Could Autorun Virus, affect my PC via Wine?

Question

I have installed wine and I am afraid that viruses will affect my PC now. I will not open any other .exe file other than mine one (which I use everyday)

Answer 1

Full disclosure: I'm not a WINE user but found this question interesting so I did a bit of digging. Apparently malware has been found to run inside of WINE, but what is the potenial for it to affect the host system?

I would assume WRT normal windows viruses, there is no meaningful context for them to do their real work in. They'll just think they are, or not work. But, e.g., if there is a way to write to the boot sector of your hard drive in a transparent way from WINE (by "transparent way" I mean, whatever way it is a virus would do this via Windows), then that's a serious risk, because some of them do that.

Since WINE isn't a real emulator (a good thing) and wasn't created from actual windows source, exploits based on real windows flaws/backdoors probably cannot work. However, a virus that targets WINE specifically -- i.e., one which can tell it is running in WINE on *nix -- could presumably do things with the privileges of the WINE process.

The last question in the WINE FAQ addresses the issue a bit, which I'll reproduce part of here:

11.1. Wine is malware-compatible

Just because Wine runs on a non-Windows OS doesn't mean you're protected from viruses, trojans, and other forms of malware.

There are several things you can do to protect yourself:

• Never run executables from sites you don't trust. Infections have already happened.
• In web browsers and mail clients, be suspicious of links to URLs you don't understand and trust.
• Never run any application (including Wine applications) as root (see above).
• Use a virus scanner, e.g. ClamAV is a free virus scanner you might consider using if you are worried about an infection; see also Ubuntu's notes on how to use ClamAV. No virus scanner is 100% effective, though.
• Removing the default Wine Z: drive, which maps to the unix root directory, is a weak defense. It will not prevent Windows applications from reading your entire filesystem, and will prevent you from running Windows applications that aren't reachable from a Wine drive (like C: or D:). A workaround is to copy/move/symlink downloaded installers to ~/.wine/drive_c before you can run them.
• If you're running applications that you suspect to be infected, run them as their own Linux user or in a virtual machine (the ZeroWine malware analyzer works this way).

So, it appears that there are reported cases of malware appearing inside of WINE, but none reporting that they are somehow affecting stuff outside of WINE. However, the potential obviously exists, if someone wrote malware that targeted WINE specifically, or if WINE gives transparent access to certain hardware. You can guard against the nastiest potentials there by never running WINE as root.