Update

After the file in question was moved to quarantine, I fully restarted steam.

Result

No further request attempts were made to connect to port 631. Seems like a strong correlation.

Firewall shows I was ALSO seeing the suspect DNS-SD attempts as well from the same.

Note: I am not willing to put the offending process back in play to retest and see the attempt happens again
If this IS related, then anyone experiencing it should disable CUPS immediately until they can verify their local build isn't vulnerable, see below

Remediation

• Disable and remove the cups-browsed service if you don’t need it (and probably you don’t).
• Update the CUPS package on your systems.
• In case your system can’t be updated and for some reason you rely on this service, block all traffic to UDP port 631 and possibly all DNS-SD traffic (good luck if you use zeroconf).

Credit: https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/#Summary

Original

@aguamole

Seeing the same thing

[storage path redacted]]/SteamLibrary/steamapps/common/Proton 8.0/dist/lib/wine/i386-windows/wbemprox.dll: Win.Dropper.Malwarex-10037125-0 FOUND
traverse_rename: Failed to rename: [storage path redacted]/SteamLibrary/steamapps/common/Proton 8.0/dist/lib/wine/i386-windows/wbemprox.dll
	to: [redacted]/quarantine/wbemprox.dll
Error:Invalid cross-device link
[storage path redacted]/SteamLibrary/steamapps/common/Proton 8.0/dist/lib/wine/i386-windows/wbemprox.dll: moved to '[redacted]/clamav/quarantine/wbemprox.dll'

Additionally, seeing wine-preload trying to call out to the CUPS port (631) whenever I start steam on my firewall.

This may be not related, but does definitely feel like something trying to exploit a recent vulnerability in that particular stack.

https://censys.com/understanding-the-cups-vulnerability-whats-important-to-know/
https://nvd.nist.gov/vuln/detail/CVE-2024-47176

Request details:

Process: [storage path redacted]/SteamLibrary/steamapps/common/Proton 8.0/dist/bin/wine-preloader
Protocols: tcp,tcp6
Dst IPs: 127.0.0.1, ::1 (loopback)
Command: [storage path redacted]/steamapps/common/Proton 8.0/dist/bin/wine-preloader [storage path redacted]/SteamLibrary/steamapps/common/Proton 8.0/dist/bin/wine C:\windows\syswow64\rundll32.exe setupapi,InstallHinfSection Wow64Install 128 \\?\[storage path redacted]\SteamLibrary\steamapps\common\Proton 8.0\dist\share\wine\wine.inf

@trie-me I have a positive detection on a version of this DLL that is much older than the CVE mentioned.

Also you can print from wine applications. I would guess this is just enumerating printers on startup, unless it never did that before?

Still, would be nice if the devs could look into this soon.

@trie-me I have a positive detection on a version of this DLL that is much older than the CVE mentioned.

Also you can print from wine applications. I would guess this is just enumerating printers on startup, unless it never did that before?

Still, would be nice if the devs could look into this soon.

That's correct. Details of the CUPS remote execution vulnerability here:
https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/#Summary

Yeah I know that vulnerability.

But the file installed was two months earlier than the public disclosure, that doesn't add up 🤨

Last Proton 8 was released in January 24, so if the file hashes match from that version, it's either a false positive or we have a Dropper in there since January (unless the DLLs are sideloaded from somewhere else).

Fair, here's hoping valve gives it a look :crossed_fingers:

crabcraft ivyl ~ % sha256sum /home/ivyl/SteamApps/common/Proton\ 8.0/dist/lib/wine/i386-windows/wbemprox.dll 
f251da908d4a919a86871a205953046d5423e31aa3e40ac70be3d35c57400d84  /home/ivyl/SteamApps/common/Proton 8.0/dist/lib/wine/i386-windows/wbemprox.dll

crabcraft ivyl ~ % winedump /home/ivyl/SteamApps/common/Proton\ 8.0/dist/lib/wine/i386-windows/wbemprox.dll 
Contents of /home/ivyl/SteamApps/common/Proton 8.0/dist/lib/wine/i386-windows/wbemprox.dll: 438190 bytes

*** This is a Wine builtin DLL ***

File Header
  Machine:                      014C (i386)
  Number of Sections:           9
  TimeDateStamp:                67324E31 (Mon Nov 11 20:34:25 2024)

AFAIU Win.Dropper.Malwarex-10037125-0 is a heuristic-based detection which seems to be a false-positive in this case.

The file in question is compiled from the source available here https://github.com/ValveSoftware/wine/tree/proton-wine-8.0-5d/dlls/wbemprox and even when I've compiled it locally clamav flags the file. I do not see anything suspicious in the code or git history.

As of CUPS interaction - Wine has support for printing. The enumeration happens on start and you can easily test that:

crabcraft ivyl ~ % rm -fr .wine

crabcraft ivyl ~ % wine cmd
wine: created the configuration directory '/home/ivyl/.wine'
Microsoft Windows 10.0.19043

Z:\home\ivyl>exit

crabcraft ivyl ~ % grep LaserJet .wine/system.reg  
[System\\CurrentControlSet\\Control\\Print\\Environments\\Windows 4.0\\Drivers\\Version-0\\HP_LaserJet_MFP_M28-M31] 1731945835
"Data File"="HP_LaserJet_MFP_M28-M31.ppd"
[System\\CurrentControlSet\\Control\\Print\\Environments\\Windows ARM\\Drivers\\Version-3\\HP_LaserJet_MFP_M28-M31] 1731945835
"Data File"="HP_LaserJet_MFP_M28-M31.ppd"
[System\\CurrentControlSet\\Control\\Print\\Environments\\Windows ARM64\\Drivers\\Version-3\\HP_LaserJet_MFP_M28-M31] 1731945835
"Data File"="HP_LaserJet_MFP_M28-M31.ppd"
[System\\CurrentControlSet\\Control\\Print\\Environments\\Windows NT x86\\Drivers\\Version-3\\HP_LaserJe_MFP_M28-M31] 1731945835
"Data File"="HP_LaserJet_MFP_M28-M31.ppd"
[System\\CurrentControlSet\\Control\\Print\\Environments\\Windows x64\\Drivers\\Version-3\\HP_LaserJet_MFP_M28-M31] 1731945835
"Data File"="HP_LaserJet_MFP_M28-M31.ppd"
[System\\CurrentControlSet\\Control\\Print\\Printers\\HP_LaserJet_MFP_M28-M31] 1731945838
"Name"="HP_LaserJet_MFP_M28-M31"
"Port"="CUPS:HP_LaserJet_MFP_M28-M31"
"Printer Driver"="HP_LaserJet_MFP_M28-M31"

As you can see on a fresh prefix of a new upstream wine packaged in Arch my LasterJet was discovered via CUPS even if the only thing I've started was cmd.exe.

Thanks for the throughout reply! :)

Maybe this information should be submitted to ClamAV / Cisco as a false positive: https://docs.clamav.net/faq/faq-malware-fp-reports.html

Edit: 9.0 (Beta), 9.0.2 and Experimental are also flagged falsely then.

I already reported the malware detection in wbemprox.dll to ClamAV 3 days ago, it's still detecting so I came here to see if anyone else was getting this ... I also noticed that it's only the syswow64 version triggering the malware warning, and the version in wine 9.0 itself is coming back clean though the file size is 1.3MB compared to proton's 424.7kB, so I'm not trying a swap out test.
This is the ClamAV report if it helps https://pastebin.com/b4Ym5TvV

Edit: Maybe the title should be changed to "Malware Detected in wbemprox.dll" to make it more clear to the dev team or moderator.

Funny, if I scan on Proton Experimental it's only triggering on the i386 version (the 64-bit version is also in the ~420kb range).
ClamAV signatures up-to-date.

/debian-installation/steamapps/common/Proton - Experimental/files/lib/wine/i386-windows/wbemprox.dll: 
Win.Dropper.Malwarex-10037125-0 FOUND

415kb
sha256sum: 0fe95c50eb841b8dec1314d27467d44235a4ebfa40598ae2d8b196eeaf1356b7

Can confirm wine-staging libs come back clean (1.4MB i386 / 1.6MB x64), though the size difference may be explained with different linking strategies / compiler flags.

took another look at my pastebin log, in the proton folders it is the i386 path, but in the compatdata game prefixes it's the syswow64 path ... odd.

Just checked and my scans are coming back clean now with today's signature update.

took another look at my pastebin log, in the proton folders it is the i386 path, but in the compatdata game prefixes it's the syswow64 path ... odd.

That how it works. System32 is 64bit and SysWoW64 is 32bit.

Just checked and my scans are coming back clean now with today's signature update.

Thanks. Closing!