Member Avatar for richardmaibes

I recently installed Norton Internet Security. Did a full system scan. Was
able to delete all but five files. All five are located in C:\RECYCLER (that's
what Norton tells me). The following is what I get from Norton.


The file C:\RECYCLER\S-1-5-21-2508614513-4166783643-2927389754-1003\Dc8.exe is a Adware threat.

  • 6 Contributors
  • 5 Replies
  • 439 Views
  • 5 Years Discussion Span
  • Latest Post Latest Post by gerbil

Dani AI

Generated

Thread context: Norton reported an adware executable inside a per-user Recycle Bin path (example: C:\RECYCLER\S-1-5-21-...-1003\Dc8.exe). That path is the Recycle Bin container for a specific user SID, which explains why the file can be hidden or protected while Windows is running. The suggestions from , , , and are all on point — emptying the bin and remembering that restore/hidden areas can reintroduce malware are important — the notes below expand on safe, practical next steps and checks that were not covered in earlier replies.

Safe removal workflow (ordered and non-destructive):

  • Confirm the detection (submit the file to an online multi-engine scanner or quarantine it with the AV).
  • Use an environment that does not run the infected Windows instance (Safe Mode may help, but a bootable rescue CD/USB or Linux live session is more reliable) so the file is not locked.
  • From that offline environment remove the file after clearing protective attributes. Example (run in an elevated CMD or from a rescue shell that accepts Windows commands):
attrib -s -h -r "C:\RECYCLER\S-1-5-21-2508614513-4166783643-2927389754-1003\Dc8.exe"
del     "C:\RECYCLER\S-1-5-21-2508614513-4166783643-2927389754-1003\Dc8.exe"

Follow-up and verification:

  • Run at least two different up-to-date scanners (including an offline/rescue scanner) to verify removal.
  • Check for persistence (startup entries, scheduled tasks, services) with tools such as Process Explorer / Autoruns and remove any leftovers.
  • If infections reappear because of restore points or shadow copies, clear those restore points using the OS restore/volume-shadow tools after the disk is clean.
  • Scan any connected USB drives and disable autorun/autoplay to prevent reinfection.

Cautions: back up important data first, do not indiscriminately remove system folders, and avoid deleting SIDs unless sure which account they belong to. The steps above complement the earlier advice in this thread.

Recommended Answers

All 5 Replies

Member Avatar for bentkey

Try just empting your recycling bin

Member Avatar for DMR

Just FYI-

Recycler is a hidden system folder. To make it visible, open Windows Explorer, click on the Tools menu, and choose Folder Options. Under the View tab of the Folder Options box, uncheck the "Hide protected operating sytem files" option. Close Explorer and reopen it; the Recycler folder will be visible.

Member Avatar for Grincho

You may not be able to remove any virus from this folder as it usually is a nasty virus attached to you system restore. Once you hasve this folder visible you can disable the system restore by:
right click on 'my computer' and select properties. Then click on system restore tab and turn off for the short time you need to scan the folder. Then scan the folder and antivirus will deal to the virus. You must have an updated antivirus prog to effectively deal with it. Don't forget to turn system restore back on.

How did the virus infect. Well in my experience it came in from the USB drive. The virus comes under many names and has morphed into other types. Does WIn32/Virut ring a bell. I first noticed on a campus and until their antivirus was updated in ran rife infecting from usb to pc and back. It can also take down a network and one day shut off a whole room. Their solution eventually was reformat and upgrade antivirus which now deals to it. But again if your machine is infected and system restore creates a restore point with it (Thus the file in c:/recyclers) follow step above.

Helpful I hope

DK

I have made a policy not to plug in any foreign USB drives as this virus attaches to it autoexec files and executes when windows loads the USB thus infection spread. It can then spread across a network.

Member Avatar for Netcode

for sure the folder is invisible. if you're using windows vista or higher, click on the start button, type folder options, view tab, select the option button for show hidden files and folder. if windows xp, then open my computer, select tools menu, folder options, views tab, show hidden files and folder, click ok.
it should be visible in your C:\ drive now but you cant delete it manually.

Member Avatar for gerbil

" Does WIn32/Virut ring a bell."? consensus is that it of no use trying to repair any Virut infection - the damage it does is too great.
If anything gets into System Restore you can remove it simply by toggling Restore off then on again. That clears all Restore files.
Please don't confuse X:\Recycler [part of recycle bin] with X:\SysVolInf [restore points for that drive].
anything in the Recycle Bin is easy to deal with.
That was a deeeep dredge.. Sept 2004. But anyway....

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.