943,712 Members | Top Members by Rank

Ad:
May 5th, 2009
0

RECYCLER in hard disk

Expand Post »
I accidentally installed a software but it contains trojan. However, i have KIS 2009 which detected but was unable to remove it.

Also it seems that the RECYCLER folder is created in each disk partition and whenever i delete it, the folder still exists as it is regenerated. Any solution to this????and it's making my computer run sluggish.

I think Kaspersky Internet Security is a good antivirus software but is there any other thing that i could detect it and remove the trojan program???
Similar Threads
Reputation Points: 10
Solved Threads: 1
Light Poster
sudharsannr is offline Offline
25 posts
since Sep 2008
May 5th, 2009
0

Re: RECYCLER in hard disk

RECYCLER is your recycle bin... there is a bin for each partition. May I suggest that you go into explorer, tools, folder options, view, and Hide Protected OpSys files?
Next:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebyt...are_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you... do not click the Save Logfile button.
When it completes examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Post the Notepad log [it is also saved under Logs tab in MBAM].
Reputation Points: 239
Solved Threads: 296
Industrious Poster
gerbil is offline Offline
4,169 posts
since May 2005
May 6th, 2009
0

Re: RECYCLER in hard disk

I understand what you're saying......but this is different from the RECYCLE bin thing. Obviously, my anti-virus software detected while installing the software but remained inactive while scanning the RECYCLER folder.
Here are the details of the folder:

Size: 18.0 KB
Size on Disk: 20.0 KB

But the folder is empty???

Certainly seems to be a malware,
also there seems that MalwareBytes' update failed although i have internet connection. I then found that the update can be directly installed (mbam-rules.exe) and installed it.
I've run throughout the computer but did not find any malware.

Any other options???
Reputation Points: 10
Solved Threads: 1
Light Poster
sudharsannr is offline Offline
25 posts
since Sep 2008
May 7th, 2009
0

Re: RECYCLER in hard disk

The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
Reputation Points: 239
Solved Threads: 296
Industrious Poster
gerbil is offline Offline
4,169 posts
since May 2005
May 7th, 2009
0

Re: RECYCLER in hard disk

Click to Expand / Collapse  Quote originally posted by gerbil ...
The recycle bin is a strange place, and emptying it does not always work. Ask Bill Gates. It [they] may show in explorer as having 0 bytes, and in properties as anything up to many MBs... even after you just emptied the bin, or used tools to do it. Unhide Protected opSys files, open Recycle Bin, delete any S-1-.... folders. The RECYCLERs [each one] should come down to about 85 bytes if you check properties.
And if I am on the wrong track still, let me know?
I got it.........and here it goes:

Actually there must be recycle bin in each of the disk partions named as $RECYCLE.BIN. This RECYCLER thing shows up something is there and I did what you've said(showing OS files) and here is the file name:
S-0-0-75-100020897-100014327-100022846-4120.com
this is what the actual file/malware is. Many of the anti-malware/anti-virus software didn't seem to detect it.
I'm not sure whether this is a malware or not since it is found in all the disk partitions similar to that of recycle bin. Also I haven't found it since the installation of that software.
What else do I have to tell you???You're right at this moment.
Reputation Points: 10
Solved Threads: 1
Light Poster
sudharsannr is offline Offline
25 posts
since Sep 2008
May 7th, 2009
0

Re: RECYCLER in hard disk

S-0-0-75-100020897-100014327-100022846-4120.com
.COM??!! Yep, you found a pest, there should be no .com on the end of that S- folder name.
Trust me, the Recycle Bin shows as RECYCLER in explorer partitions, one per partition [and if your sys is set to show it, Recycle Bin at the bottom of your folder view tree].
RECYCLERs contain maybe more than one S- folder, and the folder names are just S- numbers, but should NOT contain any VISIBLE files. So open all your RECYCLERs and delete any folders that you can [you cannot delete the one from the current day], but you can empty it. Rid your sys of those S-....com folders. Update and retry MBAM.
Nice work.
When you do a normal deletion the file is left on disk where it was and renamed, its position on disk marked as available; the new coded name plus old name are put into a RECYCLER folder; windows can then find it to restore it. But you cannot see it in that RECYCLER, normal third party software cannot either. eg photoshop, or a music player.... However the RECYCLER is just another folder, albeit a bit special. Nothing to stop you dragging files into it, and you can see those. And it is a place that can be used by malware for just that reason. Cos funnily enough, emptying the bin will not remove files you dragged into it, and looking in the Recycle Bin will not show them. But they can be accessed lilke any other file in another folder. Again, ask Bill Gates.
Last edited by gerbil; May 7th, 2009 at 8:43 am.
Reputation Points: 239
Solved Threads: 296
Industrious Poster
gerbil is offline Offline
4,169 posts
since May 2005
May 7th, 2009
0

Re: RECYCLER in hard disk

The Recycle Bin is a composite of all RECYCLERs, and shows all the deleted files' names. But only if they are in those S- folders. You will not see any file that you dragged into a RECYCLER, you must look in that RECYCLER. Try it... drag in a text file, and then browse to it and open it with Word, or Open Office....
Reputation Points: 239
Solved Threads: 296
Industrious Poster
gerbil is offline Offline
4,169 posts
since May 2005
May 7th, 2009
0

Re: RECYCLER in hard disk

Finally
Here's the solution to my problem:

$RECYCLE.BIN is just recycle bin which is used to keep files when deleted.

RECYCLER is a folder which is much advanced than the recycling concept. It usually contains the details of the files which are permanently deleted so that the user can restore them later using cheap recovery softwares such as FileRecovery, PCRecover etc.
These softwares usually work on the folder Recycler that most users are unaware of.

So, my problem was made this simple:
the file with .COM extension is the actual malware and it was not detected even with MalwareBytes!!!(believe it or not).So, I gotta resolve to Bill Gate's Microsoft (OneCare Safety Scanner) which took almost 5 hours to complete the scan and it found the threats as shown in the attachment.

This .COM file is the trojan named Trojan Win32 Alureon.BK
I've read in the Internet that Alureon.BK is used in stealing passwords, credit card numbers by using DNS number (Internet Connection). So, I have to reconfigure it again since it is been known.
http://onecare.live.com/site/en-us/v...n32/Alureon.BK

So, Gerbil I asked Bill Gates and he didn't disappoint me!!!
Attached Thumbnails
Click image for larger version

Name:	preview.JPG
Views:	41
Size:	71.1 KB
ID:	10072  
Reputation Points: 10
Solved Threads: 1
Light Poster
sudharsannr is offline Offline
25 posts
since Sep 2008
May 7th, 2009
1

Re: RECYCLER in hard disk

Good-oh, glad you are clean. But believe me on the RECYCLER/Recycle Bin thing... they are parts of the whole. You could have deleted those S-...com files manually from RECYCLERs, and run CCleaner to clear the temp files. And it appears that I have told you how to hide files and make em undeletable by normal methods. The end of that secret.
Last edited by gerbil; May 7th, 2009 at 11:41 pm.
Reputation Points: 239
Solved Threads: 296
Industrious Poster
gerbil is offline Offline
4,169 posts
since May 2005

This thread is solved

Either the thread starter or a moderator has marked this thread as solved. You can most likely trust the responses and answers given. There is most likely no reason for any further responses to be posted here. If you have a related question, please start a new thread in this forum instead.

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in Viruses, Spyware and other Nasties Forum Timeline: RUNDLL Error
Next Thread in Viruses, Spyware and other Nasties Forum Timeline: Help PLEASE....!!





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC