.doc files change to .exe files when copied

February 14, 2011 at 01:38:11
Specs: Windows XP
When I copy important .doc files to my memory stick it turns into .exe files which my anti virus picks up as trojan threats. I've changed file names, I formatted my memory stick and it keeps happening. How do I stop this from happening?????

See More: .doc files change to .exe files when copied

Report •

February 14, 2011 at 05:03:12
How are you copying them?

Report •

February 14, 2011 at 05:16:59
Drag and drop

Report •

February 14, 2011 at 05:29:56
I asked because some backup progs have a "self-executing archive" setting.

What file system did you format the stick with? It generally wants to be FAT32.

When you click on the .exes, what happens?

Does this happen with other file formats?

Report •

Related Solutions

February 14, 2011 at 06:03:46
Thanks for taking the time to try and assist!!

It's only the .doc files. I've been working like this for 3 years and all of a sudden about 2 weeks ago I started to get this problem. I eventually bought a new m/stick last week and copies "fresh" files from my hard drive and it keeps doing it.

What's interesting is that ALL my .doc files change to the same size of 709kb on the m/stick, without fail. (While the actual file size is about 34kb)

I've now opened one of them, and it gives a message can't open file because a dialog box is open. Click ok. When I do that, it says "installing: microsoft word feature" and then it opens the file perfectly. When I close it, it goes back to the "application" and big size. The icon is also a different icon to the normal Word icon

To format I right cliecked on the stick drive on format. It's set on FAT32.

When I scan with Avast, it comes up with threats on all my .doc files on the m/stick as win32:mirc-x (trj)

Report •

February 14, 2011 at 06:15:54
Yeah, I think you have a pervasive virus infection. Remember, MS, in an act of utter stupidity, ships every single copy of Windows with "hide known file extensions" enabled - a setting that shouldn't even exist. The virus is counting on the user not even seeing the file extension.

The viral payload is when you click for the addon to Word. You're giving the virus permission to do something nefarious. It then lets you see your file as a cover for its covert actions.

I bet you could directly save a doc to the stick with no problem, but I might be wrong. In any case, you need to get rid of this virus, quickly. And I would detach from the internet as much as possible until you do. And then reset all your passwords.

Report •

February 14, 2011 at 13:09:53
To set to see all file extensions go to:

Control Panel > Folder Options > View.
Put the blob in "Show hidden files and folders".

It is so stupid of MS not to do this by default.

We all live on the same ball.

Report •

February 14, 2011 at 14:02:57
I would also download and scan with the drive with Malwarebytes Anti-Malware: http://download.cnet.com/Malwarebyt...

Before that though, scan with Rkill first: http://download.bleepingcomputer.co... (this will kill any malicious process that's currently running). Do not reboot your computer after Rkill runs though, as this will cause the malware to respawn.

Helpful tips before getting started: http://www.computing.net/howtos/sho...

Report •

February 15, 2011 at 01:07:16
I think I've got 3 hairs left on my head!!!!!

This problem does not exist on either of my two pc's. It's ONLY on the memory stick, which is brand new, has been formatted, scanned, the above malwarebytes run on it, It's EMPTY.... next second one of the deleted .exe word files reappear on it. When I then want to delete it again, it refuses, saying someone is using it.

Whenever I take a "healthy" .doc file from pc to save on stick, it changes to .exe again.


Report •

February 15, 2011 at 05:50:16
When you ran MBAM, the stick was plugged in?

Go to Explorer, Tools, Folder options, and uncheck hide system files. Now check the stick for content.

Also try super anti-spyware.

OK, I found this. It's called the doc.exe trojan. Give it a try. Remember, you may have a variant of the one he describes here, so think broadly. Also, it may be that you've lost the doc files that have been affected.

Statement_January-October.doc.exe is a Trojan that is typically spread via email. The email message may contain a zipped file attachment called Statement_January-October.zip or Statement_JAN-OCT.zip. Once unzipped, an executable file called "Statement_January-October.doc .exe" is extracted. Note that the file has multiple spaces after .doc in an attempt to trick the user into thinking that the file is a document instead of an executable. In the following simple solution, I'll show you how to remove this Trojan.

How to remove Statement_January-October.doc.exe:

Disable System Restore (Press the Windows + Pause Break keys symotaniously, then navigate to the system restore tab and check the box to Turn off System Restore)

Reboot your computer and (Hold down F8 during system post) to boot in SafeMode

Once you up and running in Safe Mode, (Press Ctrl + Alt + Del) and End "STATEMENT_JANUARY-OCTOBER.DOC.EXE" process if found in your task list

Locate and remove any "STATEMENT_JANUARY-OCTOBER.DOC.EXE" virus files

Click Start > Run and type cleanmgr.exe then press enter, then check the Temporary Internet Files and Temporary files boxes and click Ok to proceed with cleanup

Report •

February 15, 2011 at 09:44:20
Once you get rid of the trojan, if you have valuable documents that were wrapped in its .exes, with no backups, before you nuke them post back (quarantine them rather than delete). I may have a way to rescue them.

Report •

February 21, 2011 at 02:42:48
Hi there,
Ok, I am totally FREAKED OUT now.!!! I have done everything suggested. I initially lost all my word files and Avast picked them up as Trojan and they couldn't be repaired so outof desperation I just deleted the lot of Word docs I had on my stick.

I moved all my other type files, ie. xcel, pdf etc. and FORMATTED the stick from top to bottom.

In explore I highlighted my stick drive and then made sure under folder options that all file extensions are shown, even system folders etc. etc. These specific word files won't show any extension.

I tried a brand new word page and saved it directly onto the stick as a test, and it converted immediately to the 709kb application file. When I delete it, it asks whether I want to delete the "read only" file, to which I say "yes". 5 secs later it's back, although I deleted it.

I have now even tried a completely different memory stick which hasn't been close to my pc at all, copied a word doc to it, and exactly same things happens.

I'm so frustrated I can put the country alight all on my own!!!!!

Report •

February 21, 2011 at 08:47:02
Are you saying that the Word files on the system show the extension doc but when you put them on the stick the extensions vanish?

We all live on the same ball.

Report •

February 21, 2011 at 09:33:30
Yes, but the problem is not just that you can't see an extension.... it changes the .doc file into an "application" and my antivirus pics it up as a Win32:mirc-X [tjn] and no matter how many times I delete the files, format the stick, it keeps happening to any word file I copy or save to the stick

Report •

February 21, 2011 at 12:26:52
If you right-click on those files, then click Properties, you will see the full name of the file, including the extension. Chances are the name includes spaces that are pushing the extension out of sight.

One more trick that might work is System Restore, if it's activated and you have a restore point back far enough. Here are instructions: http://support.microsoft.com/kb/306084

It's hard to know what to do without seeing what's going on. The trojan has a hook in the system somewhere, probably a root kit, which is hard to get to. The scanners like MBAM and SAS, which I mentioned above, are better than most at getting at them. If I were in your shoes I would go HERE and run down the list of online trojan scanners. One of them might pick up what's affecting you.

Actually, before doing that, I would run System file checker. Go Start /Run/ cmd and then enter SFC.EXE /SCANNOW . Since the hook involves copying, which I suppose is normally an explorer function, it may have replaced a basic system file. You'll need an XP disk in case SFC finds a file that needs restoration.

Or if you're near southern NY, bring the machine by. <smile> Good luck.

Report •

February 21, 2011 at 20:00:13
Hahahaha, trust me, if I were around the corner, I WOULD bring it around. South Africa is just tad too far to pop in.
I'll try what you said above.... the thing is, all my .doc files on my PC's are 100% and I have no problem and my virus scan finds no problem on the PC files..... Only once they're on my memory stick.
I have right clicked on the files and then properties and that's when I see that it has .exe extension which doesn't show on the stick no matter what you do.

So, the thing that confuses me is that both my pc's are fine and don't have the problem but I've tried 3 different memory sticks now and the same things happens as soon as a .doc file gets copies or saved to the sticks.

Report •

February 22, 2011 at 02:34:07
Sorry if I've missed it but did you scan the whole computer with MalwareBytes (as well as the sticks)?

We all live on the same ball.

Report •

February 22, 2011 at 02:44:42
I scanned both pc's with Avast, it doesn't pick up a thing, and all my .doc files are 100%.

It's only on the stick that I have the problem. Soon as I put a .doc file on any of the sticks it changes to application .exe file and Avast picks it up immediately as the file I mentioned in previous note [tjn] which can't be repaired

Report •

February 22, 2011 at 04:12:13
Yes, I understand that it is only showing on the sticks but I would still scan the whole machine with MalwareBytes if you have not already done so. One of the reasons for saying this is that the stick might have reinfected the computers before you formatted it.

We all live on the same ball.

Report •

August 15, 2011 at 12:07:16
I am stuck I have the same problem. When I open a file and save on my flash stick the original *.doc file becomes *.exe. I tried all that was said above but stuck - no success please help

Report •

August 15, 2011 at 13:08:04

It would be best to start your own new post. Few (if any) helpers will visit this post as at has not been active since February 2011. Zelna never came back so we've no idea of the outcome.

All I can suggest is scanning the whole computer and the flash stick with MalwareBytes then formatting the flash stick. Seems like you've already done all or most of this.

Always pop back and let us know the outcome - thanks

Report •

Ask Question