Thread Solved

Join Date: Sep 2008
Posts: 25
Reputation: sudharsannr is an unknown quantity at this point 
Solved Threads: 1
sudharsannr sudharsannr is offline Offline
Light Poster

RECYCLER in hard disk

 
0
  #1
May 5th, 2009
I accidentally installed a software but it contains trojan. However, i have KIS 2009 which detected but was unable to remove it.

Also it seems that the RECYCLER folder is created in each disk partition and whenever i delete it, the folder still exists as it is regenerated. Any solution to this????and it's making my computer run sluggish.

I think Kaspersky Internet Security is a good antivirus software but is there any other thing that i could detect it and remove the trojan program???
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: RECYCLER in hard disk

 
0
  #2
May 5th, 2009
RECYCLER is your recycle bin... there is a bin for each partition. May I suggest that you go into explorer, tools, folder options, view, and Hide Protected OpSys files?
Next:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebyt...are_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 25
Reputation: sudharsannr is an unknown quantity at this point 
Solved Threads: 1
sudharsannr sudharsannr is offline Offline
Light Poster

Re: RECYCLER in hard disk

 
0
  #3
May 6th, 2009
I understand what you're saying......but this is different from the RECYCLE bin thing. Obviously, my anti-virus software detected while installing the software but remained inactive while scanning the RECYCLER folder.
Here are the details of the folder:

Size: 18.0 KB
Size on Disk: 20.0 KB

But the folder is empty???

Certainly seems to be a malware,
also there seems that MalwareBytes' update failed although i have internet connection. I then found that the update can be directly installed (mbam-rules.exe) and installed it.
I've run throughout the computer but did not find any malware.

Any other options???
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: RECYCLER in hard disk

 
0
  #4
May 7th, 2009
The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 25
Reputation: sudharsannr is an unknown quantity at this point 
Solved Threads: 1
sudharsannr sudharsannr is offline Offline
Light Poster

Re: RECYCLER in hard disk

 
0
  #5
May 7th, 2009
Originally Posted by gerbil View Post
The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
I got it.........and here it goes:

Actually there must be recycle bin in each of the disk partions named as $RECYCLE.BIN. This RECYCLER thing shows up something is there and I did what you've said(showing OS files) and here is the file name:
S-0-0-75-100020897-100014327-100022846-4120.com
this is what the actual file/malware is. Many of the anti-malware/anti-virus software didn't seem to detect it.
I'm not sure whether this is a malware or not since it is found in all the disk partitions similar to that of recycle bin. Also I haven't found it since the installation of that software.
What else do I have to tell you???You're right at this moment.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: RECYCLER in hard disk

 
0
  #6
May 7th, 2009
S-0-0-75-100020897-100014327-100022846-4120.com
.COM??!! Yep, you found a pest, there should be no .com on the end of that S- folder name.
Trust me, the Recycle Bin shows as RECYCLER in explorer partitions, one per partition [and if your sys is set to show it, Recycle Bin at the bottom of your folder view tree].
RECYCLERs contain maybe more than one S- folder, and the folder names are just S- numbers, but should NOT contain any VISIBLE files. So open all your RECYCLERs and delete any folders that you can [you cannot delete the one from the current day], but you can empty it. Rid your sys of those S-....com folders. Update and retry MBAM.
Nice work.
When you do a normal deletion the file is left on disk where it was and renamed, its position on disk marked as available; the new coded name plus old name are put into a RECYCLER folder; windows can then find it to restore it. But you cannot see it in that RECYCLER, normal third party software cannot either. eg photoshop, or a music player.... However the RECYCLER is just another folder, albeit a bit special. Nothing to stop you dragging files into it, and you can see those. And it is a place that can be used by malware for just that reason. Cos funnily enough, emptying the bin will not remove files you dragged into it, and looking in the Recycle Bin will not show them. But they can be accessed lilke any other file in another folder. Again, ask Bill Gates.
Last edited by gerbil; May 7th, 2009 at 8:43 am.
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: RECYCLER in hard disk

 
0
  #7
May 7th, 2009
The Recycle Bin is a composite of all RECYCLERs, and shows all the deleted files' names. But only if they are in those S- folders. You will not see any file that you dragged into a RECYCLER, you must look in that RECYCLER. Try it... drag in a text file, and then browse to it and open it with Word, or Open Office....
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Join Date: Sep 2008
Posts: 25
Reputation: sudharsannr is an unknown quantity at this point 
Solved Threads: 1
sudharsannr sudharsannr is offline Offline
Light Poster

Re: RECYCLER in hard disk

 
0
  #8
May 7th, 2009
Finally
Here's the solution to my problem:

$RECYCLE.BIN is just recycle bin which is used to keep files when deleted.

RECYCLER is a folder which is much advanced than the recycling concept. It usually contains the details of the files which are permanently deleted so that the user can restore them later using cheap recovery softwares such as FileRecovery, PCRecover etc.
These softwares usually work on the folder Recycler that most users are unaware of.

So, my problem was made this simple:
the file with .COM extension is the actual malware and it was not detected even with MalwareBytes!!!(believe it or not).So, I gotta resolve to Bill Gate's Microsoft (OneCare Safety Scanner) which took almost 5 hours to complete the scan and it found the threats as shown in the attachment.

This .COM file is the trojan named Trojan Win32 Alureon.BK
I've read in the Internet that Alureon.BK is used in stealing passwords, credit card numbers by using DNS number (Internet Connection). So, I have to reconfigure it again since it is been known.
http://onecare.live.com/site/en-us/v...n32/Alureon.BK

So, Gerbil I asked Bill Gates and he didn't disappoint me!!!
Attached Thumbnails
preview.JPG  
Reply With Quote Quick reply to this message  
Join Date: May 2005
Posts: 3,204
Reputation: gerbil will become famous soon enough gerbil will become famous soon enough 
Solved Threads: 188
gerbil gerbil is offline Offline
Nearly a Senior Poster

Re: RECYCLER in hard disk

 
1
  #9
May 7th, 2009
Good-oh, glad you are clean. But believe me on the RECYCLER/Recycle Bin thing... they are parts of the whole. You could have deleted those S-...com files manually from RECYCLERs, and run CCleaner to clear the temp files. And it appears that I have told you how to hide files and make em undeletable by normal methods. The end of that secret.
Last edited by gerbil; May 7th, 2009 at 11:41 pm.
Deep, deep in the woods, but walking about.
Reply With Quote Quick reply to this message  
Reply

This thread has been marked solved.
Perhaps start a new thread instead?
Message:



Similar Threads
Other Threads in the Viruses, Spyware and other Nasties Forum
Thread Tools Search this Thread



About Us | Contact Us | Advertise | DaniWeb | Acceptable Use Policy | RSS Feed

©2003 - 2009 DaniWeb® LLC