I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute itself in Windows?
Normally a program cannot execute itself, but must be launched from something else(*). That something else is normally:
- a command line shell (
/bin/sh(or bash, zsh, etc.) )
- a GUI explorer (Windows explorer, gnome file manager, etc.)
Those can only start programs in a standard executable format.
But a program can also be started by another program that starts it as a child subprocess. Here almost everything is possible, because it depends how that other program was designed. Anyway, on common operating system (at least Windows and Unix or Unix-like), the system can only execute an uncompressed file, so in that case, the launcher program should first unzip the file in a temporary one and then execute the temporary. That means that the zipped file should not be kept open, because the system does not use it directly.
TL/DR: A zipped file could probably be executed via a specialized laucher, but even in that case, it is very unlikely that it would be kept open all its execution time: it should be kept open only for being uncompressed.
(*) beware, the launcher could be a normal program such as a mail reader or a browser, through an exploitable vulnerability