Remove virus recycler.exe or BV:AutoRun-G[Wrm] on USB pen drive/thumb/flash drives which creates dummy folder recycler. Remove virus with flash disinfector.

• Recycler Virus Removal Download
• Recycle Bin Virus Removal
• Malwarebytes

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun.

As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Or read our to learn how to use this site. Hi, My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of them. Recycler intruded my PC from a USB pen drive that i inserted. I was using Norton Internet Security at that time but it didnt detect the worm/virus. Days later i saw $RECYCLE.BIN had also infected my PC.

I am now using Kaspersky Internet Security 2010 but it also cannot detect & remove these 2 infections. There are RECYCLER & $RECYCLE.BIN folders in every partition of my hard drive. If i manually delete these folders, they recreate themselves.

Please help me! My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of themHow do you know? If Kaspersky is not detecting a threat in Recylcer, then what program is alerting you to infection? The (Recycler) folder is a feature which provides a safety net when deleting files or folders in Windows.

The file(s) remain there until you empty the Ricycle Bin or restore the file. The actual location of the Recycle Bin varies depending on the operating system and file system used. On file systems, Recycler is the name of the Recycle Bin Folder which can be found in each partition on your hard drive.

On file systems, the folder is named Recycled. The Recycler folder contains a Recycle Bin directory for each registered user on the computer, sorted by their (SID). Inside the Recycler folder you will find an image of the recycle bin with a name that includes a long number with dashes (S-1-5-343-1003) used to identify the user that deleted the files. S - The string is a SID. 1 - The revision level. 5 - The identifier authority value.

343 - Domain or local computer identifier. 1003 – A Relative ID (RID). This number, starting from 1000, increments by 1 for each user that's added by the Administrator. 1003 means the 3rd user profile that was created. For more specific informaton about SIDS, please refer to:. Once the recycle bins are empty, the legitimate directories should be empty as well. However, even after emptying the Recycler bin, the Recycler folder will still contain a 'Recycle Bin' for each user that logs on to the computer, sorted by their security SID.

If you delete the C: Recycler folder, Windows will automatically recreate it on next reboot. If you never saw these folders before, you should not be alarmed. The Recycler folder is hidden by default unless you reconfigured Windows to show hidden files and folders by unchecking ' Hide protected operating system files' in Tools Folder Options View. The includes a directory called NProtect, which is is used to store temporary copies of files that the user has deleted or modified. This feature supplements the Windows Recycle Bin, creating a temporary backup of certain types of files that the Windows Recycle Bin does not back up.and allows the user to recover these protected files if they are accidentally deleted.

NProtect is hidden from the Windows FindFirst/FindNext APIs using rootkit technologies. Since the hidden directory is not visible to Windows, files in the directory might not be scanned during virus scans but may be detected by anti-rootkit tools. Yes, although the RECYCLER folder contains legitimate files, it is also a known hiding place for some types of malware which loads an file that modifies and uses the Windows Explorer's right-click context menu so that the standard 'Open' or 'Explore' command redirects to executing the malicious file as described.

The presence of a desktop.ini configuration file instructs Windows to display the folder RECYCLER as if it were actually a Recycle Bin. Please download (Temp File Cleaner) by Old Timer and save it to your desktop. Save any unsaved work. TFC will close ALL open programs including your browser!. Double-click on TFC.exe to run it. If you are using Vista, right-click on the file and choose.

Click the Start button to begin the cleaning process and let it run uninterrupted to completion. TFC will clear out all temp folders for all user accounts (temp, IE temp, Java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean. Note: It is normal for the computer to be slow to boot after running TFC cleaner the first time. Please download and save it to your desktop. DO NOT perform a scan yet.

Note: The file will be randomly named (i.e. Reboot your computer in ' ' using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options.

Use the arrow keys to navigate and select the option to run Windows in 'Safe Mode'. Scan with Dr.Web CureIt as follows:. Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version. Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now?

Allow the setup.exe to load if asked by any of your security programs. The Express scan will automatically begin. ( This is a short scan of files currently running in memory, boot sectors, and targeted folders). If prompted to download the Full version Free Trial, just ignore and click the X to close the window. If an infected object is found, you will be prompted to move anything that cannot be cured.

Click Yes to All. ( This will move any detected files to the C: Documents and Settings userprofile DoctorWeb Quarantine folder if they can't be cured). After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media. Note: If you only want to scan your usb (flash) drive, then instead put a check next to Custom Scan and click on (highlight) the drive letter associated with it. In the top menu, click Settings Change settings, and uncheck ' Heuristic analysis' under the 'Scanning' tab, then click Apply, Ok. Back at the main window, click the green arrow ' Start Scanning' button on the right under the Dr.Web logo.

Please be patient as this scan could take a long time to complete. When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found. Click Select All, then choose Cure Move incurable. In the top menu, click file and choose save report list. Save the DrWeb.csv report to your desktop.

Exit Dr.Web Cureit when done. Reboot your computer because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log from Dr.Web in your next reply. ( You can use Notepad to open the DrWeb.cvs report) If you cannot boot into safe mode or complete a scan, then try doing it in normal mode. Be aware, this scan could take a long time to complete. Please download (v1.44) and save it to your desktop.

MBAM may 'make changes to your registry' as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily or permit them to allow the changes. Make sure you are connected to the Internet.

Double-click on mbam-setup.exe to install the application. When the installation begins, follow the prompts and do not make any changes to default settings. When installation has finished, make sure you leave both of these checked:.

Update Malwarebytes' Anti-Malware. Launch Malwarebytes' Anti-Malware. Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the definition updates, manually download them from and just double-click on mbam-rules.exe to install. On the Scanner tab:. Make sure the ' Perform Quick Scan' option is selected.

Then click on the Scan button. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.

The scan will begin and ' Scan in progress' will show at the top. It may take some time to complete so please be patient. When the scan is finished, a message box will say ' The scan completed successfully. Click 'Show Results' to display all objects found'. Click OK to close the message box and continue with the removal process. Back at the main Scanner screen:. Click on the Show Results button to see a list of any malware that was found.

Make sure that everything is checked, and click Remove Selected. When removal is completed, a log report will open in Notepad.

The log is automatically saved and can be viewed by clicking the Logs tab in MBAM. Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system. Exit MBAM when done. Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process.

If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to. If the error you are receiving is not in the list, please report it so the research team can investigate. Some types of malware will disable Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in.

Ok, then do this instead. Please perform a scan with.

(Requires Internet Explorer to work. If given the option, choose 'Quarantine' instead of delete.) Vista users need to run Internet Explorer as. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu. Click the green ESET Online Scanner button. Read the End User License Agreement and check the box: YES, I accept the Terms of Use.

Click on the Start button next to it. You may receive an alert on the address bar that ' This site might require the following ActiveX control.Click here to install.'

Click on that alert and then click Insall ActiveX component. A new window will appear asking ' Do you want to install this software?' . Answer Yes to download and install the ActiveX controls that allows the scan to run. Click Start. Check Remove found threats and Scan potentially unwanted applications. Click Scan to start.

(please be patient as the scan could take some time to complete). If offered the option to get information or buy software. Just close the window.

When the scan has finished, a log.txt file will be created and automatically saved in the C: Program Files EsetOnlineScanner folder. Click Run., then type or copy and paste everything in the code box below into the Open dialogue box: C: Program Files EsetOnlineScanner log.txt. Click Ok and the scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply. Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished.

ESET Online scan will show detections like these: C: RECYCLER S-1-5-4320-2558 wingn.exe Win32/Peerfrag.AW worm cleaned by deleting - quarantined C: RECYCLER S-1-5-1881-0896 wingn.exe Win32/Peerfrag.AW worm cleaned by deleting (after the next restart) - quarantined. Why arent any malware-removal tools able to detect the viruses?Because I don't see any evidence of an active malware infection based on the results of all these scans and the lack of symptoms which would affect system performance or show other signs.

Usually when there is an active infection in the RECYCLER folder, it will involve a malicious file which loads an file that modifies and uses the Windows Explorer's right-click context menu so that the standard 'Open' or 'Explore' command redirects to executing the malicious file as described. The presence of a configuration file instructs Windows to display the folder RECYCLER as if it were actually a Recycle Bin. This is another example of a typical where you will find autorun.ini and desktop.ini together with a malicious file. Keep in mind that both autorun.inf and desktop.ini can also be a legitimate files so the presence of those files may not always be an indication of infection. Please, reread Post #2 and The RECYCLER folder has 2 hidden files which are 'desktop.ini' & 'INFO2' (which i saw by using WinRAR) The RECYCLED or RECYCLER folder contains a hidden master database file called INFO2 which stores information related to the deleted file that will be used when Windows tries to restore it. That information includes:. The file's original full path name.

The file's size. The date and time when the file was moved into the recycle bin. The file's unique ID number within the Recycle Bin. When deleting a file, Windows will rename it to DC1.

As more file are deleted, the number of the file will be increased by one (i.e. The number is an indexing number for the file which will read by INFO2. When the recycle bin is emptied, the INFO2 file will also be deleted and Windows will create a nwe INFO2 file which will reset the number counter into 0. This process works differently in Vista where the operating system creates a separate record file for each file that is deleted. For more specific details as to how this works in Vista, please refer to:. is a text file for configuration settings that allows you to specify how a file system folder will be viewed and handled. It can be added to any Windows folder to store information about customized folders.

The most common use of the desktop.ini file is to assign a custom icon to a folder. File system folders are commonly displayed with a standard icon and have a set of properties that describe the folder, such as whether or not the folder is shared. Therefore, if you have customized the display of a folder in any way, such as changing its icon or manner of display, Windows will save those settings in a desktop.ini file. Since Desktop.ini is a system file, it is normally hidden unless Windows is configured to show hidden/protected operating system files in Explorer's Folder Options. Edited by quietman7, 28 January 2010 - 07:29 PM. Hi, My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of them. Recycler intruded my PC from a USB pen drive that i inserted.

I was using Norton Internet Security at that time but it didnt detect the worm/virus. Days later i saw $RECYCLE.BIN had also infected my PC. I am now using Kaspersky Internet Security 2010 but it also cannot detect & remove these 2 infections. There are RECYCLER & $RECYCLE.BIN folders in every partition of my hard drive.

If i manually delete these folders, they recreate themselves. Please help me!

I just got the same virus today. I ran Combofix and it didn't detect it. I ran free online Eset scan (Google it) and it detected eleven infections including the RECYCLER & $RECYCLE.BIN virus/worm which were on my external drive. Being that both of those had never been on my backup drive before I suspected a problem. It ran about an hour or more but deleted all infections. Checked the external drive and RECYCLER & $RECYCLE.BIN are gone.

Make sure you check the box to delete and/or quarantine them.

Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. Or read our to learn how to use this site. Hi, My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of them.

Recycler intruded my PC from a USB pen drive that i inserted. I was using Norton Internet Security at that time but it didnt detect the worm/virus. Days later i saw $RECYCLE.BIN had also infected my PC. I am now using Kaspersky Internet Security 2010 but it also cannot detect & remove these 2 infections. There are RECYCLER & $RECYCLE.BIN folders in every partition of my hard drive. If i manually delete these folders, they recreate themselves.

Please help me! My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of themHow do you know? If Kaspersky is not detecting a threat in Recylcer, then what program is alerting you to infection? The (Recycler) folder is a feature which provides a safety net when deleting files or folders in Windows. The file(s) remain there until you empty the Ricycle Bin or restore the file.

The actual location of the Recycle Bin varies depending on the operating system and file system used. On file systems, Recycler is the name of the Recycle Bin Folder which can be found in each partition on your hard drive.

On file systems, the folder is named Recycled. The Recycler folder contains a Recycle Bin directory for each registered user on the computer, sorted by their (SID). Inside the Recycler folder you will find an image of the recycle bin with a name that includes a long number with dashes (S-1-5-343-1003) used to identify the user that deleted the files. S - The string is a SID.

1 - The revision level. 5 - The identifier authority value. 343 - Domain or local computer identifier. 1003 – A Relative ID (RID). This number, starting from 1000, increments by 1 for each user that's added by the Administrator.

1003 means the 3rd user profile that was created. For more specific informaton about SIDS, please refer to:. Once the recycle bins are empty, the legitimate directories should be empty as well. However, even after emptying the Recycler bin, the Recycler folder will still contain a 'Recycle Bin' for each user that logs on to the computer, sorted by their security SID.

If you delete the C: Recycler folder, Windows will automatically recreate it on next reboot. If you never saw these folders before, you should not be alarmed. The Recycler folder is hidden by default unless you reconfigured Windows to show hidden files and folders by unchecking ' Hide protected operating system files' in Tools Folder Options View. The includes a directory called NProtect, which is is used to store temporary copies of files that the user has deleted or modified. This feature supplements the Windows Recycle Bin, creating a temporary backup of certain types of files that the Windows Recycle Bin does not back up.and allows the user to recover these protected files if they are accidentally deleted.

NProtect is hidden from the Windows FindFirst/FindNext APIs using rootkit technologies. Since the hidden directory is not visible to Windows, files in the directory might not be scanned during virus scans but may be detected by anti-rootkit tools. Yes, although the RECYCLER folder contains legitimate files, it is also a known hiding place for some types of malware which loads an file that modifies and uses the Windows Explorer's right-click context menu so that the standard 'Open' or 'Explore' command redirects to executing the malicious file as described. The presence of a desktop.ini configuration file instructs Windows to display the folder RECYCLER as if it were actually a Recycle Bin. Please download (Temp File Cleaner) by Old Timer and save it to your desktop.

Save any unsaved work. TFC will close ALL open programs including your browser!. Double-click on TFC.exe to run it.

If you are using Vista, right-click on the file and choose. Click the Start button to begin the cleaning process and let it run uninterrupted to completion. TFC will clear out all temp folders for all user accounts (temp, IE temp, Java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

Note: It is normal for the computer to be slow to boot after running TFC cleaner the first time. Please download and save it to your desktop. DO NOT perform a scan yet. Note: The file will be randomly named (i.e.

Reboot your computer in ' ' using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.

A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in 'Safe Mode'. Scan with Dr.Web CureIt as follows:. Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version. Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now?

Allow the setup.exe to load if asked by any of your security programs. The Express scan will automatically begin. ( This is a short scan of files currently running in memory, boot sectors, and targeted folders).

If prompted to download the Full version Free Trial, just ignore and click the X to close the window. If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. ( This will move any detected files to the C: Documents and Settings userprofile DoctorWeb Quarantine folder if they can't be cured). After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media. Note: If you only want to scan your usb (flash) drive, then instead put a check next to Custom Scan and click on (highlight) the drive letter associated with it.

In the top menu, click Settings Change settings, and uncheck ' Heuristic analysis' under the 'Scanning' tab, then click Apply, Ok. Back at the main window, click the green arrow ' Start Scanning' button on the right under the Dr.Web logo. Please be patient as this scan could take a long time to complete.

When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found. Click Select All, then choose Cure Move incurable.

In the top menu, click file and choose save report list. Save the DrWeb.csv report to your desktop. Exit Dr.Web Cureit when done. Reboot your computer because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log from Dr.Web in your next reply. ( You can use Notepad to open the DrWeb.cvs report) If you cannot boot into safe mode or complete a scan, then try doing it in normal mode.

Be aware, this scan could take a long time to complete. Please download (v1.44) and save it to your desktop. MBAM may 'make changes to your registry' as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily or permit them to allow the changes. Make sure you are connected to the Internet. Double-click on mbam-setup.exe to install the application.

When the installation begins, follow the prompts and do not make any changes to default settings. When installation has finished, make sure you leave both of these checked:.

Update Malwarebytes' Anti-Malware. Launch Malwarebytes' Anti-Malware. Then click Finish. MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.

If you encounter any problems while downloading the definition updates, manually download them from and just double-click on mbam-rules.exe to install. On the Scanner tab:. Make sure the ' Perform Quick Scan' option is selected. Then click on the Scan button. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button. The scan will begin and ' Scan in progress' will show at the top.

It may take some time to complete so please be patient. When the scan is finished, a message box will say ' The scan completed successfully. Click 'Show Results' to display all objects found'. Click OK to close the message box and continue with the removal process.

Recycler Virus Removal Download

Back at the main Scanner screen:. Click on the Show Results button to see a list of any malware that was found. Make sure that everything is checked, and click Remove Selected. When removal is completed, a log report will open in Notepad. The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.

Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system. Exit MBAM when done. Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. If Malwarebytes Anti-Malware results in any error messages, check the Help file's list of error codes within its program folder first. If you do not find any information, please refer to. If the error you are receiving is not in the list, please report it so the research team can investigate.

Some types of malware will disable Malwarebytes Anti-Malware and other security tools to keep them from running properly. If that's the case, please refer to the suggestions provided in. Ok, then do this instead. Please perform a scan with. (Requires Internet Explorer to work.

If given the option, choose 'Quarantine' instead of delete.) Vista users need to run Internet Explorer as. Right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu. Click the green ESET Online Scanner button. Read the End User License Agreement and check the box: YES, I accept the Terms of Use. Click on the Start button next to it. You may receive an alert on the address bar that ' This site might require the following ActiveX control.Click here to install.' Click on that alert and then click Insall ActiveX component.

A new window will appear asking ' Do you want to install this software?' . Answer Yes to download and install the ActiveX controls that allows the scan to run. Click Start. Check Remove found threats and Scan potentially unwanted applications. Click Scan to start. (please be patient as the scan could take some time to complete).

If offered the option to get information or buy software. Just close the window.

When the scan has finished, a log.txt file will be created and automatically saved in the C: Program Files EsetOnlineScanner folder. Click Run., then type or copy and paste everything in the code box below into the Open dialogue box: C: Program Files EsetOnlineScanner log.txt. Click Ok and the scan results will open in Notepad. Copy and paste the contents of log.txt in your next reply.

Note: Some online scanners will detect existing anti-virus software and refuse to cooperate. You may have to disable the real-time protection components of your existing anti-virus and try running the scan again. If you do this, remember to turn them back on after you are finished. ESET Online scan will show detections like these: C: RECYCLER S-1-5-4320-2558 wingn.exe Win32/Peerfrag.AW worm cleaned by deleting - quarantined C: RECYCLER S-1-5-1881-0896 wingn.exe Win32/Peerfrag.AW worm cleaned by deleting (after the next restart) - quarantined. Why arent any malware-removal tools able to detect the viruses?Because I don't see any evidence of an active malware infection based on the results of all these scans and the lack of symptoms which would affect system performance or show other signs. Usually when there is an active infection in the RECYCLER folder, it will involve a malicious file which loads an file that modifies and uses the Windows Explorer's right-click context menu so that the standard 'Open' or 'Explore' command redirects to executing the malicious file as described.

The presence of a configuration file instructs Windows to display the folder RECYCLER as if it were actually a Recycle Bin. This is another example of a typical where you will find autorun.ini and desktop.ini together with a malicious file. Keep in mind that both autorun.inf and desktop.ini can also be a legitimate files so the presence of those files may not always be an indication of infection. Please, reread Post #2 and The RECYCLER folder has 2 hidden files which are 'desktop.ini' & 'INFO2' (which i saw by using WinRAR) The RECYCLED or RECYCLER folder contains a hidden master database file called INFO2 which stores information related to the deleted file that will be used when Windows tries to restore it. That information includes:. The file's original full path name. The file's size.

The date and time when the file was moved into the recycle bin. The file's unique ID number within the Recycle Bin.

When deleting a file, Windows will rename it to DC1. As more file are deleted, the number of the file will be increased by one (i.e. The number is an indexing number for the file which will read by INFO2.

When the recycle bin is emptied, the INFO2 file will also be deleted and Windows will create a nwe INFO2 file which will reset the number counter into 0. This process works differently in Vista where the operating system creates a separate record file for each file that is deleted.

Recycle Bin Virus Removal

For more specific details as to how this works in Vista, please refer to:. is a text file for configuration settings that allows you to specify how a file system folder will be viewed and handled. It can be added to any Windows folder to store information about customized folders. The most common use of the desktop.ini file is to assign a custom icon to a folder. File system folders are commonly displayed with a standard icon and have a set of properties that describe the folder, such as whether or not the folder is shared. Therefore, if you have customized the display of a folder in any way, such as changing its icon or manner of display, Windows will save those settings in a desktop.ini file. Since Desktop.ini is a system file, it is normally hidden unless Windows is configured to show hidden/protected operating system files in Explorer's Folder Options.

Edited by quietman7, 28 January 2010 - 07:29 PM. Hi, My computer has been infected by RECYCLER & $RECYCLE.BIN virus/worm and i cant get rid of them. Recycler intruded my PC from a USB pen drive that i inserted.

I was using Norton Internet Security at that time but it didnt detect the worm/virus. Days later i saw $RECYCLE.BIN had also infected my PC. I am now using Kaspersky Internet Security 2010 but it also cannot detect & remove these 2 infections. There are RECYCLER & $RECYCLE.BIN folders in every partition of my hard drive. If i manually delete these folders, they recreate themselves.

Please help me! I just got the same virus today. I ran Combofix and it didn't detect it.

Malwarebytes

I ran free online Eset scan (Google it) and it detected eleven infections including the RECYCLER & $RECYCLE.BIN virus/worm which were on my external drive. Being that both of those had never been on my backup drive before I suspected a problem. It ran about an hour or more but deleted all infections. Checked the external drive and RECYCLER & $RECYCLE.BIN are gone.

Make sure you check the box to delete and/or quarantine them.