Is it possible for a Windows virus to jump in partitions that are for ubuntu and are not visible in "This Pc"?

Question

I installed Ubuntu on my computer a year ago (dual booting) but I created partitions that are exclusively for Ubuntu.

This is how some Ubuntu partitions look on Disk Management.

On Windows I have installed Faronics Deep Freeze long ago, so everything gets deleted after restart. Although whenever I use Ubuntu, the files there, stay on it. So I'm not sure whether Faronics Deep Freeze covers Ubuntu Partitions too because they are not visible when running Windows besides on Disk Management.

So my question is that, recently, I downloaded a 3MB rar file, which I scanned through Hybrid Analysis site which also uses Virustotal site. It showed it completely clear. When I unzipped it, there was a setup file of 600 MB and I thought it was the program so I run it but it didn't do anything, and then I thought would be a good idea to upload it on Virustotal, surprisingly 4-5 antiviruses found that the file was malicious. I immediately deleted it and restarted my computer because everything would get deleted. Now I'm worried if that file infected those Ubuntu Partitions that are not visible (and also maybe not covered by Deep Freeze) and that every time I'm running Windows it can infect windows again by jumping on windows partitions by itself. Can anyone tell me if that could happen?

The analysis https://www.hybrid-analysis.com/sample/f986d36db1c558d42978111528a29a53ac3c44321875b964b0566c66f2402136

https://www.virustotal.com/gui/file/f986d36db1c558d42978111528a29a53ac3c44321875b964b0566c66f2402136/detection

https://www.virustotal.com/gui/file/86e763b727beb81cfd555e825ea4cda763c38cb930349eef075bc745e4daae12?nocache=1

If anyone want to download at their own risk. The link is

https://cdn.discordapp.com/attachments/977113873578614806/980759184654090240/File_Pass__1234.rar pass:1234

Answer 1

Can malware run on Windows affect Ubuntu partitions?

Yes, this is possible. Windows has access to the entire "raw disk" as one would say, and thus malware could search for Linux partitions and insert itself there.

The Disk Management tool merely shows partitions, which Windows understands. It doesn't mean Windows cannot write to the disk where these partitions store their data.

Did Deep Freeze protect me from malware?

Possibly, possibly not. Judging by the VirusTotal reports, the malware is designed to steal passwords. By running it, it could already have stolen credentials and session tokens stored on your PC. It does not need to persist in order to be malicious.

Does Deep Freeze protect Ubuntu partitions?

Hard to say, but the answer is likely "no". Finding good technical specifications on the website of the vendor is difficult, as they are naturally interested in selling you their product, and thus don't want to tell you what it can't do.

However, their website specifically mentions Windows and MacOS, thus I would say it's safe to assume that Linux is not covered.

Can the malware infect my Windows OS again through Ubuntu?

Yes and no. Merely existing on the Ubuntu partition does not give the malware the ability to infect your system.

[...] it can infect windows again by jumping on windows partitions by itself.

Malware is not sentient and cannot act by itself. A process has to actively load the malware and execute it. By merely existing on the Ubuntu partition, the malware does not pose a threat.

However, if it did in fact infect your Ubuntu partition, it is possible that, when running Ubuntu, you also run the malware (e.g. it could set itself up as a boot task), which in turn could infect your Windows OS again. Furthermore, while running Ubuntu, Deep Freeze would be inactive, so the malware could modify Deep Freeze to either ignore the malware or even help it remain persistent in the Windows OS.

What should you do now?

Whether or not you reinstall your OS is up to you. You have to weigh the chances of having persistent malware on your computer versus the inconvenience of reinstalling both operating systems. Changing your passwords and monitoring your accounts for unusual activity would be a good thing to do as well.

Answer 2

Yes, yes, yes, and yes, especially if you opened the file with admin access to the files/folders/drives allocated from your c:\ partition. Code can be converted and programmed to duplicate or replicate and to run each startup even if you were to take safety precautions and delete %appdata% and such.

There are also exploits that can run and save via random access memory integrity, BIOS/UEFI root privileges and even guest access (which are a little harder to maintain or execute).

Unless it’s mentioned to be a persistent threat then you shouldn’t be as concerned.