Computer help forum: Strange viruses detected.

for virus protection?

Assuming you are using Windows, (you don't say, nor which Windows OS), Recycler is a hidden System Protected folder and can be unhidden from the Control Panel > Folder options. Open that, then in the View tab, remove the tick for "Hide System protected files and folders (Recommended)".

I would re-hide that afterwards.

Most good virus scanners should be able to remove the one you mentioned but if not, download, install, update then run full scans with both the free versions of Malwarebytes Anti-malware and SUPERAntiSpyware.

Mark

The problem is not simple:
Even latest Symantec Endpoint Protection MR4 is unable to delete it, the only way to delete this virus is
1> set your system to show hidden and system files.
2> open Taskmanager
3> kill all explorer.exe process
4> click on newtask button and go the C:\
5> delete recycler folder ( you will not be able to delete this folder when explorer.exe is loaded)
6> if you have multiple drive do the same for other drives.
7> do not load explore.exe yet
8> open regedit from newtask button.
9> find key c:\recycler and delete it(you will find c:\recycler\s-????\svchost.exe or service.exe)
10> find all the keys and delete it.
11> load explorer.exe now.
this will remove this virus from you PC but its temperary basis as no antivirus software is able to delete it.
---Actually, I came only to point 8>, and wasn't able to find the appropriate keys in the registry.
Apparently the problem isn't new, is known, but hard to solve.
enigma

Where did you get that from?

Mark

ww.symantec.com/connect/forums/virus-alert-crecyclers-1-5-21-1482476501-1644491937-682003330-1013svchostexe

enigma

That isn't a key at all, c:\recycler. You were following a bad recipe. Such happens on forums: not all advice is equally good or applicable.

Now, what's your current problem? All you told was yesterday's problem and your (very good!) inability to follow 2 bad recipes.

Kees

have your anti-virus do a boot time scan maybe. Just a thought.........Digger

'The system cannot find the path specified.'

enigma

If you deleted the contents of the recycle bin at 2:44 (point 5 in your above post), it's not really amazing that file is gone at 5:59. It would have been more amazing if it should still be there.

One other thing. I don't think it's a great idee to run a program (that's what that run-box does) if you have been warned by your antivirus program it contains a virus. In fact, I think it's a very bad idea. Why did you do that? Luckily, it was already gone.

Kees

Deleting the recycle bin doesn't help, it reappears , I think as long as the keys are in the registry.
In http://support.microsoft.com/mats/windows_file_and_folder_diag/ you could find the following:
'Diagnose and repair Windows File and Folder Problems
You cannot empty the Recycle Bin or delete a file or a folder inside the Recycle Bin. ' No reason given and
I don't understand why a recycle bin has to be System Protected. After a time is it quite a volume and it
slows all virus checks. You might know more about the interconnections.

enigma

Why should you ant to delete the recycle bin? Windows needs one. Each and every user of Windows can delete the contents of his part of the recycle bin. That's enough.
And what keys are you talking about?

Kees

PS. Deleting the recycle bin was #5 on the list. And you said you came to #8. Now you say you didn't even come to #5. It's an enigma!

After the next reboot the deleted contents were again in the bin. That's the enigma.

It appears clear, but the deleted files are reappearing after a reboot, because I can't find the appropriate keys in the registry. They have to be removed as well.

enigma

You can't find the appropiate keys in the registry, because you don't know what the appropiate keys are. That makes sense.

It seems a program runs at boot time that recreates that exe. Could be a program listed at the startup tab of msconfig. Did you have a look there? Or it could be a service. Did you look for any uncommon service starting automatically?

And did you do a system restore back to before you had this virus? That would restore the registry to the clean state it was in then.

Kees

Are you doing a system restore every other day just for the case that some funny virus could appear? I don't.
Have a back-up, of course, but that wouldn't restore my registry. No uncommon services starting automatically.Yet.
enigma

You don't have to create a System Restore manually everyday, a new one is created automatically. Go to System Restore

http://img715.imageshack.us/img715/1061/screenshot020ml.jpg

Select Restore my computer to an earlier time then press Next and see if there is Restore Point available a day before the problem occurred. You probably can even go back to last month.

http://img521.imageshack.us/img521/162/screenshot021xq.jpg


.

Actually I never knew about this possibility, thanks.
enigma