Testing for Windows malware under Wine

MikeF · Post by **MikeF** » Thu Oct 16, 2008 10:51 pm

After using Linux for some time, I realized that this might be another good use for wine.

I've been seeing the commercials for PC SpeedScan by Ascentive and have even been asked about it by non-techie friends. Since my Ubuntu system isn't real mission critical, I decided to throw caution to the winds and installed the 'product'.

One behavior of malware is that it purposely does not uninstall cleanly or at all. Sure enough, the wine uninstaller could not remove any of the Ascentive crap. Just for grins, I installed CCleaner and Revo Uninstaller - they could remove evidence from the wine Uninstall dialog but the app menus still remain. Looks like apt-get autoremove wine, install wine, here we come.

Has anyone else tried this?
Any hints for removing orphan menus?

Daniel Kasak · Post by **Daniel Kasak** » Thu Oct 16, 2008 11:14 pm

On Thu, 2008-10-16 at 22:51 -0500, MikeF wrote:

After using Linux for some time, I realized that this might be another good use for wine.

I've been seeing the commercials for PC SpeedScan by Ascentive and have
even been asked about it by non-techie friends. Since my Ubuntu system
isn't real mission critical, I decided to throw caution to the winds
and installed the 'product'.

One behavior of malware is that it purposely does not uninstall cleanly
or at all. Sure enough, the wine uninstaller could not remove any of
the Ascentive crap. Just for grins, I installed CCleaner and Revo
Uninstaller - they could remove evidence from the wine Uninstall
dialog but the app menus still remain. Looks like apt-get autoremove
wine, install wine, here we come.

Locate and delete ( or rename ) your wine profile folder ( ie ~/.wine ).
Everything that you install *should* be confined to this, unless you
specifically set up links between wine and the rest of your filesystem.
Note that when I delete my .wine folder and run wineconf, it sets up a
'Z:' drive which points to my root ( / ) folder, so in theory something
could write to Z:/home/dkasak/ and put stuff elsewhere, but it's pretty
unlikely.

Has anyone else tried this?
Any hints for removing orphan menus?

Use gnome's menu editor ( sorry, the name escapes me, and I'm running
'gnome-light' at the moment ). Or alternatively use a gconf2 editor.

Dan

MikeF · Post by **MikeF** » Fri Oct 17, 2008 12:46 am

Thanks for responding so quickly, Daniel!

Removing the .wine folder didn't make any difference.
Removing the files (can't remember exact names) under .config/menus did!

I think that the default Gnome menu editor is bizarrely named 'Main Menu' (in Ubuntu) with package name 'alacarte', but I could be wrong. An annoying deficiency of Gnome or Ubuntu IMO. C'mon GUI designers, tell us wtf is going on.

austin987 · Post by **austin987** » Fri Oct 17, 2008 1:35 am

On Fri, Oct 17, 2008 at 12:46 AM, MikeF <[email protected]> wrote:

Thanks for responding so quickly, Daniel!

Removing the .wine folder didn't make any difference.
Removing the files (can't remember exact names) under .config/menus did!

I think that the default Gnome menu editor is bizarrely named 'Main Menu' (in Ubuntu) with package name 'alacarte', but I could be wrong. An annoying deficiency of Gnome IMO. C'mon GUI designers, tell us wtf is going on.

How is this a Wine bug?

--
-Austin

vitamin · Post by **vitamin** » Fri Oct 17, 2008 8:41 am

MikeF wrote:Sure enough, the wine uninstaller could not remove any of the Ascentive crap.

http://wiki.winehq.org/FAQ#head-9893ae5 ... af2e69b391