| | |
RECYCLER in hard disk
Thread Solved |
•
•
Join Date: Sep 2008
Posts: 25
Reputation:
Solved Threads: 1
I accidentally installed a software but it contains trojan. However, i have KIS 2009 which detected but was unable to remove it.
Also it seems that the RECYCLER folder is created in each disk partition and whenever i delete it, the folder still exists as it is regenerated. Any solution to this????and it's making my computer run sluggish.
I think Kaspersky Internet Security is a good antivirus software but is there any other thing that i could detect it and remove the trojan program???
Also it seems that the RECYCLER folder is created in each disk partition and whenever i delete it, the folder still exists as it is regenerated. Any solution to this????and it's making my computer run sluggish.
I think Kaspersky Internet Security is a good antivirus software but is there any other thing that i could detect it and remove the trojan program???
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
RECYCLER is your recycle bin... there is a bin for each partition. May I suggest that you go into explorer, tools, folder options, view, and Hide Protected OpSys files?
Next:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebyt...are_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].
Next:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebyt...are_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].
Deep, deep in the woods, but walking about.
•
•
Join Date: Sep 2008
Posts: 25
Reputation:
Solved Threads: 1
I understand what you're saying......but this is different from the RECYCLE bin thing. Obviously, my anti-virus software detected while installing the software but remained inactive while scanning the RECYCLER folder.
Here are the details of the folder:
Size: 18.0 KB
Size on Disk: 20.0 KB
But the folder is empty???
Certainly seems to be a malware,
also there seems that MalwareBytes' update failed although i have internet connection. I then found that the update can be directly installed (mbam-rules.exe) and installed it.
I've run throughout the computer but did not find any malware.
Any other options???
Here are the details of the folder:
Size: 18.0 KB
Size on Disk: 20.0 KB
But the folder is empty???
Certainly seems to be a malware,
also there seems that MalwareBytes' update failed although i have internet connection. I then found that the update can be directly installed (mbam-rules.exe) and installed it.
I've run throughout the computer but did not find any malware.
Any other options???
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
And if I am on the wrong track still, let me know?
Deep, deep in the woods, but walking about.
•
•
Join Date: Sep 2008
Posts: 25
Reputation:
Solved Threads: 1
•
•
•
•
The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
Actually there must be recycle bin in each of the disk partions named as $RECYCLE.BIN. This RECYCLER thing shows up something is there and I did what you've said(showing OS files) and here is the file name:
S-0-0-75-100020897-100014327-100022846-4120.com
this is what the actual file/malware is. Many of the anti-malware/anti-virus software didn't seem to detect it.
I'm not sure whether this is a malware or not since it is found in all the disk partitions similar to that of recycle bin. Also I haven't found it since the installation of that software.
What else do I have to tell you???You're right at this moment.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
S-0-0-75-100020897-100014327-100022846-4120.com
.COM??!! Yep, you found a pest, there should be no .com on the end of that S- folder name.
Trust me, the Recycle Bin shows as RECYCLER in explorer partitions, one per partition [and if your sys is set to show it, Recycle Bin at the bottom of your folder view tree].
RECYCLERs contain maybe more than one S- folder, and the folder names are just S- numbers, but should NOT contain any VISIBLE files. So open all your RECYCLERs and delete any folders that you can [you cannot delete the one from the current day], but you can empty it. Rid your sys of those S-....com folders. Update and retry MBAM.
Nice work.
When you do a normal deletion the file is left on disk where it was and renamed, its position on disk marked as available; the new coded name plus old name are put into a RECYCLER folder; windows can then find it to restore it. But you cannot see it in that RECYCLER, normal third party software cannot either. eg photoshop, or a music player.... However the RECYCLER is just another folder, albeit a bit special. Nothing to stop you dragging files into it, and you can see those. And it is a place that can be used by malware for just that reason. Cos funnily enough, emptying the bin will not remove files you dragged into it, and looking in the Recycle Bin will not show them. But they can be accessed lilke any other file in another folder. Again, ask Bill Gates.
.COM??!! Yep, you found a pest, there should be no .com on the end of that S- folder name.

Trust me, the Recycle Bin shows as RECYCLER in explorer partitions, one per partition [and if your sys is set to show it, Recycle Bin at the bottom of your folder view tree].
RECYCLERs contain maybe more than one S- folder, and the folder names are just S- numbers, but should NOT contain any VISIBLE files. So open all your RECYCLERs and delete any folders that you can [you cannot delete the one from the current day], but you can empty it. Rid your sys of those S-....com folders. Update and retry MBAM.
Nice work.
When you do a normal deletion the file is left on disk where it was and renamed, its position on disk marked as available; the new coded name plus old name are put into a RECYCLER folder; windows can then find it to restore it. But you cannot see it in that RECYCLER, normal third party software cannot either. eg photoshop, or a music player.... However the RECYCLER is just another folder, albeit a bit special. Nothing to stop you dragging files into it, and you can see those. And it is a place that can be used by malware for just that reason. Cos funnily enough, emptying the bin will not remove files you dragged into it, and looking in the Recycle Bin will not show them. But they can be accessed lilke any other file in another folder. Again, ask Bill Gates.
Last edited by gerbil; May 7th, 2009 at 8:43 am.
Deep, deep in the woods, but walking about.
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
The Recycle Bin is a composite of all RECYCLERs, and shows all the deleted files' names. But only if they are in those S- folders. You will not see any file that you dragged into a RECYCLER, you must look in that RECYCLER. Try it... drag in a text file, and then browse to it and open it with Word, or Open Office....
Deep, deep in the woods, but walking about.
•
•
Join Date: Sep 2008
Posts: 25
Reputation:
Solved Threads: 1
Finally
Here's the solution to my problem:
$RECYCLE.BIN is just recycle bin which is used to keep files when deleted.
RECYCLER is a folder which is much advanced than the recycling concept. It usually contains the details of the files which are permanently deleted so that the user can restore them later using cheap recovery softwares such as FileRecovery, PCRecover etc.
These softwares usually work on the folder Recycler that most users are unaware of.
So, my problem was made this simple:
the file with .COM extension is the actual malware and it was not detected even with MalwareBytes!!!(believe it or not).So, I gotta resolve to Bill Gate's Microsoft (OneCare Safety Scanner) which took almost 5 hours to complete the scan and it found the threats as shown in the attachment.
This .COM file is the trojan named Trojan Win32 Alureon.BK
I've read in the Internet that Alureon.BK is used in stealing passwords, credit card numbers by using DNS number (Internet Connection). So, I have to reconfigure it again since it is been known.
http://onecare.live.com/site/en-us/v...n32/Alureon.BK
So, Gerbil I asked Bill Gates and he didn't disappoint me!!!
Here's the solution to my problem:
$RECYCLE.BIN is just recycle bin which is used to keep files when deleted.
RECYCLER is a folder which is much advanced than the recycling concept. It usually contains the details of the files which are permanently deleted so that the user can restore them later using cheap recovery softwares such as FileRecovery, PCRecover etc.
These softwares usually work on the folder Recycler that most users are unaware of.
So, my problem was made this simple:
the file with .COM extension is the actual malware and it was not detected even with MalwareBytes!!!(believe it or not).So, I gotta resolve to Bill Gate's Microsoft (OneCare Safety Scanner) which took almost 5 hours to complete the scan and it found the threats as shown in the attachment.
This .COM file is the trojan named Trojan Win32 Alureon.BK
I've read in the Internet that Alureon.BK is used in stealing passwords, credit card numbers by using DNS number (Internet Connection). So, I have to reconfigure it again since it is been known.
http://onecare.live.com/site/en-us/v...n32/Alureon.BK
So, Gerbil I asked Bill Gates and he didn't disappoint me!!!
•
•
Join Date: May 2005
Posts: 3,204
Reputation:
Solved Threads: 188
Good-oh, glad you are clean. But believe me on the RECYCLER/Recycle Bin thing... they are parts of the whole. You could have deleted those S-...com files manually from RECYCLERs, and run CCleaner to clear the temp files. And it appears that I have told you how to hide files and make em undeletable by normal methods. The end of that secret.
Last edited by gerbil; May 7th, 2009 at 11:41 pm.
Deep, deep in the woods, but walking about.
![]() |
Similar Threads
- Help with automatic update problem and more (Viruses, Spyware and other Nasties)
- Is there a way to clean up computer and remove all hidden & unused programs & files? (Windows NT / 2000 / XP)
- Surf Sidekick has taken over my computer (Viruses, Spyware and other Nasties)
- MPTFT.EXE problem (Viruses, Spyware and other Nasties)
- Need help with Hacktool.Rootkit Please! (Viruses, Spyware and other Nasties)
- Viruses/Spam is EVERYWHERE!! HELP!! HJT Log inside PLZZ HELP (Viruses, Spyware and other Nasties)
- hijacked! (Viruses, Spyware and other Nasties)
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: RUNDLL Error
- Next Thread: Help PLEASE....!!
| Thread Tools | Search this Thread |
adware anti-malware anti-virussitesaccessissue antivirus apple attack audio avg backtoschoolspeech bar blackhat botnet botnets censorship china commercial conficker connect control cyber cybercrime cyberwarfare ddos domains education email europe exam exploit facebook fake fancheckvirus gaming gtaiv halloween herss.exe hijack hosting internet iphone kaspersky legal logfiles malware mcafee mega-d messagelabs microsoft mobile msn nazi news obama onlinethreats paedophile panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro redirect redirecting report research risk rogueantivirus samhain sans scareware search security seopoisoning sites software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec system teen translate trojan unabletoaccessanti-virussites unwanted update usa virus viruses vista war warning windows worm yahoo zeroday






