Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ubuntu shared folder in my network using samba. but recently when I try to access the folders, I noticed almost 90% of all my .doc/.ppt/.xls file changed to .exe file.

I tried to list all the files in the folder using the command: ls-la

-?????????  ? ?    ?          ?                ? text1.doc
-r--r--r--  1 crm  users 705312 2008-07-20 01:42 text1.exe

However in windows, I only saw the text1.exe file. I tried to change the file permission for text1.doc using chmod, however it shows me (input/output error)

Any ideas?

share|improve this question

Hey are you sharing with windows OS ?

The behavior you described is peculiar of viruses.You should use an ANTIVIRUS. If you are working on windows do

1.Open start menu --->RUN

2.type cmd A commmand prompt window appear.

3.type drive_name:

4.type dir this will list all the files now check the output and please post the result

share|improve this answer
Out of curiosity - how does the virus manage to hide the corresponding .doc file? By setting hidden attribute? Then he needs to use dir /ah to show hidden files. – Sergey Nov 8 '11 at 11:58
ok the virus does as follows first make the file hidden for the windows explorer by setting the hidden attribute – coder Nov 8 '11 at 12:08
the vrus makes copies of itself and changes the icon to the .doc icon – coder Nov 8 '11 at 13:04

This is a symptom of the W32.Blebla worm. This is a very old one, so I wonder how did you manage to get this infection or if this is a new variant.

See the Symantec page on this worm for more information.

Unfortunately it seems that all (document, media, archive) files are replaced by executable virus files, thus the original data is lost. (Do you really have these hidden doc files in the same directory?). To be more precise, the virus description says:

When a file with any of these extensions is launched, the worm will move the file into C:\Recycled under a random file name and replace the original file with itself, adding .exe to the suffix. For example, song.mp3 will become song.mp3.exe, and this file will be the worm. The original file is not executed.

I think at least one of your windows clients have been infected by the worm, so on this machine there might be some remnants of data in the Recycled folder.

You should remove all parts of the virus first on all the windows clients, then try to recover the data if possible. Although it would be wise to create a full backup of the offline system to minimise data loss if something goes wrong.

Finally make sure to remove the infected files from any network shares that were accessible by the windows clients.

share|improve this answer
It looks similar, but not exactly the same - as you can see, the worm doesn't move the original file to Recycled folder. There are millions of worms and viruses in some other OSes... wouldn've happened in Ubuntu :) – Sergey Nov 9 '11 at 0:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.