I installed Ubuntu on my computer a year ago (dual booting) but I created partitions that are exclusively for Ubuntu.

This is how some Ubuntu partitions look on Disk Management.

enter image description here

On Windows I have installed Faronics Deep Freeze long ago, so everything gets deleted after restart. Although whenever I use Ubuntu, the files there, stay on it. So I'm not sure whether Faronics Deep Freeze covers Ubuntu Partitions too because they are not visible when running Windows besides on Disk Management.

So my question is that, recently, I downloaded a 3MB rar file, which I scanned through Hybrid Analysis site which also uses Virustotal site. It showed it completely clear. When I unzipped it, there was a setup file of 600 MB and I thought it was the program so I run it but it didn't do anything, and then I thought would be a good idea to upload it on Virustotal, surprisingly 4-5 antiviruses found that the file was malicious. I immediately deleted it and restarted my computer because everything would get deleted. Now I'm worried if that file infected those Ubuntu Partitions that are not visible (and also maybe not covered by Deep Freeze) and that every time I'm running Windows it can infect windows again by jumping on windows partitions by itself. Can anyone tell me if that could happen?

The analysis https://www.hybrid-analysis.com/sample/f986d36db1c558d42978111528a29a53ac3c44321875b964b0566c66f2402136



If anyone want to download at their own risk. The link is

https://cdn.discordapp.com/attachments/977113873578614806/980759184654090240/File_Pass__1234.rar pass:1234

  • To explain why the 3MB file didn't detect anything - it's a known method by malware to add 000 bytes in the files to make the file bigger when uncompressed so that most antivirus engines reject the file due to its big size. There are quite a few red flags that you got infected and even the software you're using might've been compromised if you're a high value target May 30, 2022 at 17:01
  • @SirMuffington what do you suggest me to do?
    – Seihalli
    May 30, 2022 at 18:11
  • I have some questions. 1. Why the virustotal didn't show the viruses when I scanned that rar file? 2. Even if it's a malware, it still is not recognizable as malware by the most popular antiviruses on virustotal.com like Kaspersky and Bitdefender (the file limit on virustotal.com is 650 MB so antiviruses engines wouldn't reject it) 3. What are the red flags? I guess you don't really know how Deep Freeze works, it already deleted all the data I had on browsers and files, (it restored my computer to an earlier version)
    – Seihalli
    May 30, 2022 at 18:34
  • it depends on your threat model. 1. because it's "encrypted" with the password 1234. 2. maybe it's fairly new malware? 3. red flags were mentioned in your question May 31, 2022 at 19:13
  • @SirMuffington what do you mean? after restarting my computer everything got undone and i havent noticed anything unusual
    – Seihalli
    May 31, 2022 at 20:15

2 Answers 2


Can malware run on Windows affect Ubuntu partitions?

Yes, this is possible. Windows has access to the entire "raw disk" as one would say, and thus malware could search for Linux partitions and insert itself there.

The Disk Management tool merely shows partitions, which Windows understands. It doesn't mean Windows cannot write to the disk where these partitions store their data.

Did Deep Freeze protect me from malware?

Possibly, possibly not. Judging by the VirusTotal reports, the malware is designed to steal passwords. By running it, it could already have stolen credentials and session tokens stored on your PC. It does not need to persist in order to be malicious.

Does Deep Freeze protect Ubuntu partitions?

Hard to say, but the answer is likely "no". Finding good technical specifications on the website of the vendor is difficult, as they are naturally interested in selling you their product, and thus don't want to tell you what it can't do.

However, their website specifically mentions Windows and MacOS, thus I would say it's safe to assume that Linux is not covered.

Can the malware infect my Windows OS again through Ubuntu?

Yes and no. Merely existing on the Ubuntu partition does not give the malware the ability to infect your system.

[...] it can infect windows again by jumping on windows partitions by itself.

Malware is not sentient and cannot act by itself. A process has to actively load the malware and execute it. By merely existing on the Ubuntu partition, the malware does not pose a threat.

However, if it did in fact infect your Ubuntu partition, it is possible that, when running Ubuntu, you also run the malware (e.g. it could set itself up as a boot task), which in turn could infect your Windows OS again. Furthermore, while running Ubuntu, Deep Freeze would be inactive, so the malware could modify Deep Freeze to either ignore the malware or even help it remain persistent in the Windows OS.

What should you do now?

Whether or not you reinstall your OS is up to you. You have to weigh the chances of having persistent malware on your computer versus the inconvenience of reinstalling both operating systems. Changing your passwords and monitoring your accounts for unusual activity would be a good thing to do as well.

  • Thank you for your answer. It's very complete though i still have a question. I almost never use Ubuntu system. At the time, I run that EXE, I came from a restart so everything was deleted already (computer crashed). I remember I was logged on only on one account Gmail on browser and as soon as I found out about the virus I restarted. my computer, and haven't used Ubuntu until today. I'm not sure whether I'm still at risk or not. as I didn't use, Ubuntu. What I don't understand, why the big brand antiviruses names like Kaspersky and Bitdefender didn't show it's a malware?
    – Seihalli
    Jul 1, 2022 at 13:48

Yes, yes, yes, and yes, especially if you opened the file with admin access to the files/folders/drives allocated from your c:\ partition. Code can be converted and programmed to duplicate or replicate and to run each startup even if you were to take safety precautions and delete %appdata% and such.

There are also exploits that can run and save via random access memory integrity, BIOS/UEFI root privileges and even guest access (which are a little harder to maintain or execute).

Unless it’s mentioned to be a persistent threat then you shouldn’t be as concerned.

  • This was very difficult to read and interpret. Please make sure that you write in proper sentences. Your ideas seemed to bleed into each other.
    – schroeder
    May 31, 2022 at 8:13
  • What about Deep freeze? It does plays a big role. So Basically my question is, if the virus could save itself in a partition that you can't access through the windows and then run again in Windows (after it was restored to an earlier image before infection because of Deep Freeze)
    – Seihalli
    May 31, 2022 at 10:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .