1

I have a ubuntu shared folder in my network using samba. but recently when I try to access the folders, I noticed almost 90% of all my .doc/.ppt/.xls file changed to .exe file.

I tried to list all the files in the folder using the command: ls-la

-?????????  ? ?    ?          ?                ? text1.doc
-r--r--r--  1 crm  users 705312 2008-07-20 01:42 text1.exe

However in windows, I only saw the text1.exe file. I tried to change the file permission for text1.doc using chmod, however it shows me (input/output error)

Any ideas?

Improve this question

2 Answers 2

Reset to default
2

Hey are you sharing with windows OS ?

The behavior you described is peculiar of viruses.You should use an ANTIVIRUS. If you are working on windows do

1.Open start menu --->RUN

2.type cmd A commmand prompt window appear.

3.type drive_name:

4.type dir this will list all the files now check the output and please post the result

Improve this answer
3
  • Out of curiosity - how does the virus manage to hide the corresponding .doc file? By setting hidden attribute? Then he needs to use dir /ah to show hidden files.
    – Sergey
    Nov 8, 2011 at 11:58
  • ok the virus does as follows first make the file hidden for the windows explorer by setting the hidden attribute
    – coder
    Nov 8, 2011 at 12:08
  • the vrus makes copies of itself and changes the icon to the .doc icon
    – coder
    Nov 8, 2011 at 13:04
0

This is a symptom of the W32.Blebla worm. This is a very old one, so I wonder how did you manage to get this infection or if this is a new variant.

See the Symantec page on this worm for more information.

Unfortunately it seems that all (document, media, archive) files are replaced by executable virus files, thus the original data is lost. (Do you really have these hidden doc files in the same directory?). To be more precise, the virus description says:

When a file with any of these extensions is launched, the worm will move the file into C:\Recycled under a random file name and replace the original file with itself, adding .exe to the suffix. For example, song.mp3 will become song.mp3.exe, and this file will be the worm. The original file is not executed.

I think at least one of your windows clients have been infected by the worm, so on this machine there might be some remnants of data in the Recycled folder.

You should remove all parts of the virus first on all the windows clients, then try to recover the data if possible. Although it would be wise to create a full backup of the offline system to minimise data loss if something goes wrong.

Finally make sure to remove the infected files from any network shares that were accessible by the windows clients.

Improve this answer
1
  • It looks similar, but not exactly the same - as you can see, the worm doesn't move the original file to Recycled folder. There are millions of worms and viruses in some other OSes... wouldn've happened in Ubuntu :)
    – Sergey
    Nov 9, 2011 at 0:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .