Your Questions About Recycling

The Expert answers:

Well….., RECYCLER is a system folder which is required by windows to run properly, while recycler.exe is a virus which spreads very quickly via. Removable storage devices.

The Expert answers:

C:RECYCLER is in fact the Recycle Bin. It is okay to delete it. Windows protects the folder so that it can not be deleted, but you must have a setting that shows it then.

Try to empty your recycle bin. That should empty and remove all old links to non-existing files. Windows should also recognize the folder is missing and create a new one.

Best Wishes!

The Expert answers:

I’m an avid recycler, I do a 3 pronged approach, I avoid the need to recycle by avoiding excess packaging and consider what the packaging is. I recycle as much as I can and I complete the cycle by purchasing as much recycled content as I can.

The Expert answers:

The Recycler virus is a trojan that is transferred to a computer system through an infected removable storage device such as a flash drive. This particular virus will change the drive access method on an infected machine. A user will get an error message about a missing recycler.exe file when double clicking on their local hard disk or flash drive. A variant of this virus will also corrupt some system files which can cause a computer to automatically restart shortly after startup. Removing the Recycler virus is a slow and time consuming process.

1. A computer that is affected with the Recycler virus needs to be restarted in Safe Mode. To do this press the F8 key on the keyboard during the computer’s boot up sequence. When the menu option appears on the screen select Safe Mode and press Enter on the keyboard.

2. Run an anti-spyware check on the system. This can be done by using programs such as Spy-Bot Search and Destroy, Ad-Aware and Malwarebytes Anti-Malware.

3. Run a complete virus scan on the system. There are many ant-virus programs available to choose from including Norton and McAffee as well as a free program called AVG Anti-Virus.

4. Delete the autorun.inf file from the removable storage device and the local hard drive. It may be necessary to do a right click on the drive within My Computer and then selecting Explore.

5. Do a clean-up of the system registry. A free program called RegSeeker is available that can scan and remove bad, old as well as obsolete registry entries.

6. Restart the system. All traces of the virus should be gone and the system should be running normally.

The Expert answers:

System Information / Recycler are probably folders housing your system restore files. That folder is protected and shouldn’t be deleted because you can cause corruption.

However, you can clear old restore points within that folder if you want. Sometimes malware may still be lurking in your system restore volumes so it would be in your best interests to disable system restore, reboot then re-enable system restore when you log back on. What this does is protects you from reloading the malware should you ever need to do a system restore.

Many anti-virus products cannot remove viruses from system restore thus the reason for clearing out possible infected points. For reference to this, see the link below:

http://www.bleepingcomputer.com/tutorials/tutorial56.html#problems

There are several ways to disable system restore but the easiest is to go to Control Panel, System, System Restore tab and tick the box to “Turn off system restore on all drives”, click Apply, click OK and reboot. Follow the same steps when you log back on to re-enable system restore by removing the tickmark.

For reasons System Restore should disabled and re-enabled after and not before malware removal, see the webpage below:
http://msmvps.com/blogs/spywaresucks/archive/2005/09/17/66724.aspx

The Expert answers:

This is a file that has been deleted and put into the recycler bin or has been deleted for the recycler bin .

The Expert answers:

You have malware.

If when you open My COmputer, go to the tools, then folder options, there will be a View tab… There you make all invisible files, visible. You will see the three radio buttons there. Once you make all invisible files visible, look atain at each of your drives. You will see that each now has a hidden autorun.inf file. You are infected with one of the Flash Drive infections out there. Each of your drives should not have an autorun.inf file. When you double-click or open a drive, it runs whatever program is listed in that autorun.inf file. In your case, it is trying to run a file that has already been gotten rid of, but was hiding in a folder it had called “recycler”.

The short fix is to delete those autorun.inf files.

Chances are you had formatted due to an infection, but you didn’t scan and clean all your media you made backups to, and you didn’t scan and clean your thumb-drives.

As long as you get that error, you are actually ok. It means that the infection can’t find the file it needs to spread and do it’s damage.

The Expert answers:

Reboot your computer into Safe Mode, this is important as this is a memory resident virus. Do this by pressing F8 as the machine boots up and select safe mode from the DOS menu.

Once in Safe Mode, press enter to stay in safe mode, you don’t want to go to Recovery.

1. Open up windows explorer, Start>Programs>Accessories>Explorer

2. Go to (In Vista press ALT to display menus) Tools>Folder Options>View>uncheck the items below:

1>display the contents of system folders
2>hide extensions for known file types
3>hide protected operating system files(Recommended)

Leave the other items as they are.

3. Press Apply>OK.
4. Leaving windows explorer open, navigate to the root of the C: drive and remove AUTORUN.INF and any files that end in *.CMD and *.BAT excepting for AUTORUN.BAT and COMMAND.COM which are legacy files you may or may not have. Now go to C:Recycler and remove anything located in the folders that look like recycle bins, if you are on a network there will be more than one.
5. Delete all instances of the virus on your disk.

There are two or three variants of this virus, some put a file in the windows directory named SVHOSTE which is a hidden file – search for this and delete it.

6. Remove from Registry.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Active Setup>Installed Components

In the left panel, locate and delete the key:
{08B0E5C0-4FCB-11CF-AAX5-90401C608512}

Close REGEDIT and click on Start>Run or on Vista just type in the search box MSCONFIG and press enter.

Click the startup tab and uncheck any misspelt entries such as Microssoft and Norrton, also take into account the command of this startup entry, navigate to where these files are located and delete them from your disk.

Format any memory sticks you have used with this machine by going into explorer, right click on the disk and clicking format. Once Formatted reboot your virus free machine.

The Expert answers:

Recycler.exe is W32.Lecna.H a worm that spreads by copying itself to mapped drives. It also opens a back door and may download potentially malicious code on to the compromised computer.
Related files:
%System%AUTORUN.INF
%System%confi.exe
%System%Config.ini
%System%Recycler.exe
%System%uninstx.exe
%System%keyvect.dll
%System%netscv.exe
Kill the process Recycler.exe and remove Recycler.exe from Windows startup using msconfig and startup tab remove the recycler entry

Go to regedit and do a search on recycler and remove all entries.