Windows XP forum: USB Stick Virus causes Windows XP Problems (RECYCLER.exe)

recycler.exe

May be you are a born rich person and you may say these words. Flash drives are not so cheap to discard them like a CD when infected from virus. They are not so cheap in many parts and hence your reply is not at all a worth.
Here we are discussing solution but not to get new one.

Let's lock it and let it drop back into the archives.

First cleaning out the machine by running a good trojan cleaner in SAFE MODE? Something like AVG Antispyware or TrojanHunter.

Ewido/AVG Antispyware 7.5 Tool

TrojanHunter

Also make sure to clean out the registry entries mentioned here so it won't attempt to load on the machine at startup:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
"Taskman"="C:\\WINNT\\system32\\drivers\\taskmen.exe"
"DataAccess"="C:\\WINNT\\taskmen.exe"

or this one as well:

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
Recycle Bin Handler =<system folder>\recycler.exe

and delete it if they exist.

There are a couple of ways to go about this.. You can leave the infected flash drive in the USB port and scan it along with the rest of the computer WITHOUT opening it and attempt to clean it while it's in the port...OR... you can clean out the machine first, then place the drive and press the "Shift" key to hopefully prevent it from autorunning.. You could then open "My Computer", then RIGHT click on the removable drive and choose "Format" (or use the format utility for the specific model of flash drive you have, or run a RIGHT click scan with your antivirus or AVG Antispyware..

Hope this helps.

Grif

Buddy, just get to kelly's corner and find a vbs file titled "show hidden files" and run it. Then find the autorun on your usb device and open it with notepad. In this, you would find the name of the program which the autorun links to, most probably recycler.exe or recycled.exe. This may be located in a RECYCLER folder on the root of the drive. Just take them out.
Then run msconfig from the run dialog choose the startup tab.
If you find iiiiii.exe or kavo.exe or tavo.exe or ckvo.exe or amvo.exe, uncheck them and delete them from the system32 folder in the windows folder.

I have this stupid virus on all of drives now. I dont know what to do and please dont tell me to format my computer cause I dont want to lose the data. by the way one of the weird things that now I cant show the hidden files. even when I change the option it automatically switch back to do not show hidden files !!!

The simple solution is to format your drives. However, make sure you use the unconditional switch or you won't repair the boot sector. You do that like so...

a:>format c: /u

Apply the same rule to formatting other drives.

Another simple formatting fix is to download PCLinuxOS (http://www.pclinuxos.com/) and burn a live CD. You can then use it to format your drive and boot sector. PCLinuxOS will automatically handle overwriting and formatting the boot sector since it is installing a new OS on your drive. Go ahead and let PCLinuxOS install and set up. Now go back and reinstall Windows by inserting your Windows CD and starting up. Your drive will be reformatted.

That should get rid of it on your hard drives. Do this first, that way you know your PC is virus free.

Now, you can use the same PCLinuxOS live CD to format your USB drive! You can safely do this after Windows is installed. Just insert the PCLinuxOS live-CD and reboot. Don't install it, but just choose to run it as a live-CD. It won't install on your hard drive and mess with Windows or anything. Once it is up and running, you plug your USB drive in. Then, you will be looking at your Linux desktop...click on the "install" icon on your desktop.

You should get a dialog asking if you want to install it and whatnot (it's been a while since I did it to my USB drive)...and you install it to your USB drive. This will overwrite the USB drive boot sector and format your drive.

Later on, reboot your PC in Windows. Insert your USB drive. Reformat it from Windows. Your problems should be gone.

But really, once you install PCLinuxOS on your PC...you may just wonder why the heck you ought to ever go back to using Windows. I run a dualboot WinXP Pro and PCLinuxOS box. I used to have it triple-boot and run those two and either Debian or SuSe...but now I'm just using Windows for music recording software and playing happily on PCLinuxOS.

Hope this helps.

Using the format switch /u might be a good idea. But I would personally go for zero-filling the entire hard drive to completely erase all the data. Western Digital and Seagate offer free drive utilities that take care of this.

Just download the software onto floppy drive or create a bootable cd (nero and most other burning apps have a burn from ".iso" image option). This should also save time over installing linux. IMO it's too easy for linux installations to corrupt the partioning on the drive. I've experimented with trying to install linux then changing my mind and going back to windows a couple of times on an old computer and it stuffed things up. Zero-filling the hard drive completely reset it allowing it to be reformatted to use with windows on the first attempt.

Luckily, the only experience I've had with this 'recycler' virus are the random emails from individuals panicking at my uni. I usually back things up anyway so I wouldn't be too worried about having the computer crash for a day or so (unless I'm writing an assignment at the eleventh hour lol).

Dear Slim0131,

I hae recently joined Cnet forums and was going thru the posts on this article. The problem that I have on my machine is I am not able to delete any file from my system. whenever I delete any file another file of the same name gets created. Also all the folders on my system are doubled. The actual folders are hidden and the new ones that are created are all of 40 Kb.

I have a Recycler.exe (having an icon like a folder) in each drive that I have, and, that is causing all the problems (seems like).

Whenever I try to delete this Recycler folder it copies itself back. Also there is a autorun.ini and few other files, which if I try to delete are copied back.

Please help.

regards.

Thanks Kees, I will check these out and will let you and the group know about the results.

Regards,
amitrajh.

There are three ways to go about this.
One is good ol' DOS command prompt.
1st go to your root ( c:/> ) by default, windows command prompt console root is in the Documents folder, all u have to do is keep typing ( cd .. ) till you get to the root directory ( c:/> ) then go

dir /a /p

you might want to look for these:
<dir> RSH recycler
xx Kb RSH autorun.inf

1st thing needs to be done is to get rid of those 'flags' RSH
R -read only
S -system
H -hidden
by typing this:
attrib autorun.inf -r -s -h
then you can:

del autorun.inf *enter* (are you sure (y/n) of course Yes -_- )

same thing done for the recycler folder

then do it on your flash drive by going to it's root dir. if it's drive e:/, then type in cmd>> e:
and do above again.

caveat emptor: Be careful with these commands lol. AND it's a better idea to get a working version of DOS on floppy and do the above there, or a flashdrive bootable version of Linux or whatever that can read NTFS and FAT32 volumes and delete files off em. or you can stick that flashdrive in a system running Linux or Fedora that can read NTFS and delete it from there (two-step process; initial delete sends it into a .trashes (mac) or .Trash-root (linux/fedora) and you have to delete that as well to keep it from coming back. As for system hard disks where you run windows on it, either get an external drive case/adapter for that drive (IDE-PATA or SATA) and delete it using a mac or linux box, or get another hard drive / partition and install linux on that (make sure it CAN read fat32/NTFS volumes) in a dualboot config, or a live CD/USB setup.

External drive manual delete with Linux worked well; deleted every last RECYCLER and autorun.inf off them ALL. Hopefully the last virus i'll ever see on my system, ever.

Hope this helps.

Hello, i'm having the same problem, and i don't know how to solve it. But what i have noticed is:

1.- there are 2 files
<drive>:\autorun.inf and
<drive>:\recycler\S-1... .5111\system.exe

both of them have readonly and sytem atributes, so you only can see it if you have right folder options.


2.-there is a process who create files so if you delete it, the process write it again. This process is launched from user acount session, I ran another session and delete both files and they gone away, but when I come back to infected session the files came again.


I seek for system.exe in registry but it don't apeared, it must have another way to initiate the process maybe a service.

that is what I can say about problem hope it be useful.

Use a free programme called autorun eater it removes any defect autorun files on all your drives including any usb drives

Try using smitfraudfix, I had the same problem with my USB thumbdrive and smitfraudfix fixed it. it's a freeware fix for most malwares. Here's a site where you can download the file.

www.bleepingcomputer.com/files/smitfraudfix.php

or try googling for other site that provide this malware remover.