I have a malicious file zipped in .gz which was not opened. However, when I tried to delete the folder containing the file, I wasn't able to due to running processes. Can a zipped malware execute itself in Windows?

  • 7
    More likely your AV is quarantining the file? – CᴴᵁᴮᴮʸNᴵᴺᴶᴬ May 15 '17 at 10:37
  • 2
    Try lsof to see which process is using the file – licklake May 15 '17 at 11:14
  • @Chubby, dont think my AV scans within zipped file – George May 16 '17 at 4:24

Unless you have some program that is able to run compressed programs from archive, no it can't.

You inability to suppress the file is more likely due to the fact that the file itself is being used or access restricted by some program (e.g. antivirus quarantine).

| improve this answer | |

Normally a program cannot execute itself, but must be launched from something else(*). That something else is normally:

  • a command line shell (command.exe, /bin/sh (or bash, zsh, etc.) )
  • a GUI explorer (Windows explorer, gnome file manager, etc.)

Those can only start programs in a standard executable format.

But a program can also be started by another program that starts it as a child subprocess. Here almost everything is possible, because it depends how that other program was designed. Anyway, on common operating system (at least Windows and Unix or Unix-like), the system can only execute an uncompressed file, so in that case, the launcher program should first unzip the file in a temporary one and then execute the temporary. That means that the zipped file should not be kept open, because the system does not use it directly.

TL/DR: A zipped file could probably be executed via a specialized laucher, but even in that case, it is very unlikely that it would be kept open all its execution time: it should be kept open only for being uncompressed.

(*) beware, the launcher could be a normal program such as a mail reader or a browser, through an exploitable vulnerability

| improve this answer | |
  • You mentioned launcher and mail reader - does outlook thick-client pre-download attachments and store in local machine without user opening the attachment? – George May 16 '17 at 5:32
  • 1
    @George An attachement is included in the mail body, and AFAIK all desktop mail readers always download and store the full mail including all attachements as a whole. – Serge Ballesta May 16 '17 at 6:05
  • Thanks. Do you know if the attachment is wrapped? Because if the mail gateway doesnt block executables, and mail client downloads them, then it's really dangerous. – George May 16 '17 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.