Arch Linux

Ypixcm

Member

Registered: 2024-07-11

Posts: 35

Website

[SOLVED]Automatically created by the wine program . _cache_*.exe

Hi guys, I noticed that my wine program directory automatically creates . _cache_Synaptics.exe.

As an example, I have a program ~/test/A.exe.
I tried to start it using wine ~/test/A.exe, But I don't know why, but under the path of the A program appeared . _cache_Synaptics.exe and . _cache_A.exe , Program A.exe is also not starting properly

Now any program I start using wine automatically generates the . _cache_ file

I have confirmed that this is malicious software.

Last edited by Ypixcm (2025-08-25 12:36:36)

---

My new name: RethLibc

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 14,962

Re: [SOLVED]Automatically created by the wine program . _cache_*.exe

I have confirmed that this is malicious software.

How ?

Please post the output of pacman -Qs wine

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

Ypixcm

Member

Registered: 2024-07-11

Posts: 35

Website

Re: [SOLVED]Automatically created by the wine program . _cache_*.exe

pacman -Qs wine

local/wine-gecko 2.47.4-2
    Wine's built-in replacement for Microsoft's Internet Explorer
local/wine-mono 10.1.0-1
    Wine's built-in replacement for Microsoft's .NET Framework
local/wine-staging 10.13-1
    A compatibility layer for running Windows programs - Staging branch
local/winetricks 20250102-1
    Script to install various redistributable runtime libraries in Wine.

The Synaptics virus is specifically designed for Windows, but due to the particularity of the files it generates, it is even more difficult to detect under Linux.
（I played some pirated Windows games, and they had this virus. In fact, it is due to my own reasons.)
The core files of this malicious software are usually located in ProgramData and Users directories.
Malware will create a "Synaptics" folder.

---

My new name: RethLibc

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 14,962

Re: [SOLVED]Automatically created by the wine program . _cache_*.exe

create a new linux user for testing, perform minimal configuration and create a wine prefix for that user .
Does it also have this malware ?

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

Ypixcm

Member

Registered: 2024-07-11

Posts: 35

Website

Re: [SOLVED]Automatically created by the wine program . _cache_*.exe

As long as I don't run any infected exe programs in the new wine prefix, there will be no problem（Nor will this malicious software appear out of nowhere.）. Now I have removed this malicious software. It is highly contagious.

(By the way, a side note: The bbs.archlinux.org website is not very stable in China or in Asia. It's not clear whether this is related to the recent cyber attacks.)

Last edited by Ypixcm (2025-08-25 12:38:59)

---

My new name: RethLibc