FRIHOSTFORUMSSEARCHFAQTOSBLOGSCOMPETITIONS
You are invited to Log in or Register a free Frihost Account!


Recycler.exe - virus





ainieas
Hey does anyone know about this virus/trojan Recycler.exe. It affects removable drives. Right now it has become a nightmare for me tryig to get rid of it. AVG Anti-Virus doesn't detect it even though I can see it is scanning the virus files. Trend Micro Internet security shows everything safe even when I delete the folder and it regenerates while Trend Micro is running. Kaspersky Internet Security detects that the files are infectected but cannot clean it up. I've the latest updates of the said anti-viruses yet I'm going around in circles. Any help would be much appreciated.
brokenadvice
Boot your computer in safe mode by pressing F8 during startup, and re run the AVG scan. It should be able to detect the files in safe mode. You will also have to delete the autorun files off the flash drive. I suggetst you find a friend who has a mac to delete if for you. There may be an easier way, but this way should work.
aningbo
such a thing will keep playing around. one has to be careful with removable drives and get yourself a good anti virus.
ainieas
I've tried every anti virus i could think of. No use. Of course I'm using the trial versions. Don't know if that might have something to do with that. I even tried to remove it manually, no avail!
aningbo
wats ur actual problem? why dont you manually delete the fileand also the autorun.inf from your pendrive. i guess there must be a service running under the name wscript.exe too

specify more details plz.
jembo
at least, you'd better turn off your autorun first..
or like they said before, run your windows in safe mode first, then you scan with your antivirus
Diablosblizz
I use NOD32, and I was able to remove various viruses while they were running. It's pretty good!
ainieas
aningbo wrote:
wats ur actual problem? why dont you manually delete the fileand also the autorun.inf from your pendrive. i guess there must be a service running under the name wscript.exe too

specify more details plz.


I did try to manually delete the files. My anti-virus does scan the autorun.inf file but it just doesn't delete it. Even in safe mode its not working. My main problem is everytime i delete the file it regenerates. I can't find the auto-run.inf file to delete it manually. Let me try and disable auto-run and see if I can get that to lessen my headache.
frih
if all the steps have been failed, if you dont have any important data in your usb , then just format your device through command prompt without opening that device.
ezekiel_rage
ainieas wrote:
Hey does anyone know about this virus/trojan Recycler.exe. It affects removable drives. Right now it has become a nightmare for me tryig to get rid of it. AVG Anti-Virus doesn't detect it even though I can see it is scanning the virus files. Trend Micro Internet security shows everything safe even when I delete the folder and it regenerates while Trend Micro is running. Kaspersky Internet Security detects that the files are infectected but cannot clean it up. I've the latest updates of the said anti-viruses yet I'm going around in circles. Any help would be much appreciated.


The reason antivirus suites dont see the virus is because the file attribute its files were set to system/superhidden.

So even if you set your folder view to Show hidden files, it would still not show up.

You have to enable showsuperhidden key in the registry then do a full system scan as that virus/trojan put files iside the windows directory and modify keys in the registry. Particularly the ShowSuperHidden key.

To modify that key;

Click "run" at the start menu, type regedit

the Registry editor will open.

Go to HKEY_CurrentUser\Software\Microsoft\Windows\Explorer\Advanced

on the left side look for the key ShowSuperHidden and set it to 0 (ZERO).

Close the Registry editor then on Folder options' View tab select Show hidden files. You may havee to reboot for the changes to take effect. then Do a full system scan, with your removable drives plugged in.

AVG should see it and clean it.


Hope this helps
sitacool
I encountered this virus recently. The biggest problem with this virus is it makes itself hidden and readonly. It also spreads through autorun.inf file. However it is possible to delete it by checking for readonly files. That is what I did. I was helped by the blog post http://binaryday.com/2009/05/16/how-to-remove-recycler-virus-on-usb/
ether
Also u can try free antivirus program such as cureit. You can download it from http://www.freedrweb.com/download+cureit/. I think that it help. Just run it and chek your hard disk, very easy for execute. Good luck !
FunDa
ainieas wrote:
Hey does anyone know about this virus/trojan Recycler.exe. It affects removable drives. Right now it has become a nightmare for me tryig to get rid of it. AVG Anti-Virus doesn't detect it even though I can see it is scanning the virus files. Trend Micro Internet security shows everything safe even when I delete the folder and it regenerates while Trend Micro is running. Kaspersky Internet Security detects that the files are infectected but cannot clean it up. I've the latest updates of the said anti-viruses yet I'm going around in circles. Any help would be much appreciated.


There are so many viruses nowadays that use the same name Recycler.exe.



Give me the complete details like file size, location, or better - Send me a copy of the virus though rapidshare or mediashare or filden or some file hosting.


I'll infect my test computer in my Antivirus labs and make an antidote.



If I do make any antidotes, I usually put them here : http://www.fundazone.com
mamuni
@sitacool

Thanks for sharing the link to http://binaryday.com/2009/05/16/how-to-remove-recycler-virus-on-usb/ . It was really helpful in removing the dreaded virus.

However does anyone have any idea if this virus can affect my cd as well. I have some music cds that are not running properly.
FunDa
mamuni wrote:
@sitacool

Thanks for sharing the link to http://binaryday.com/2009/05/16/how-to-remove-recycler-virus-on-usb/ . It was really helpful in removing the dreaded virus.

However does anyone have any idea if this virus can affect my cd as well. I have some music cds that are not running properly.



Nope, they don't directly copy to CDs


These viruses take the easy routes, which is anything recognised as a mass storage device in the USB port.


Pen Drives, Memory cards, mobile phones, iPods, mp3 players, digital cameras, external hard drives, etc ...



Your CD may just have some scratches, dust or time damage.
albuferque
recycler.exe
Recycler.exe is W32.Lecna.H.
W32.Lecna.H is a worm that spreads by copying itself to mapped drives. It also opens a back door and may download potentially malicious code on to the compromised computer.
Related files:
%System%\AUTORUN.INF
%System%\confi.exe
%System%\Config.ini
%System%\Recycler.exe
%System%\uninstx.exe
%System%\keyvect.dll
%System%\netscv.exe
Read more:http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2007-082212-5844-99&tabid=2
Kill the process Recycler.exe and remove Recycler.exe from Windows startup using RegRun Reanimator.
http://www.regrun.com

Removal: recycler.exe is removed by RegRun.
Jaan
If you have an external hard drive it would probably easiest to reformat everything... usually speeds the whole computer up too!

cheers
FunDa
Jaan wrote:
If you have an external hard drive it would probably easiest to reformat everything... usually speeds the whole computer up too!

cheers


If u use windows, the best housekeeping is to format and reinstall once in a while.
EdDrick
ainieas wrote:
Hey does anyone know about this virus/trojan Recycler.exe. It affects removable drives. Right now it has become a nightmare for me tryig to get rid of it. AVG Anti-Virus doesn't detect it even though I can see it is scanning the virus files. Trend Micro Internet security shows everything safe even when I delete the folder and it regenerates while Trend Micro is running. Kaspersky Internet Security detects that the files are infectected but cannot clean it up. I've the latest updates of the said anti-viruses yet I'm going around in circles. Any help would be much appreciated.


Yes, even I had the same problem - this recycler virus is really a bad damn thing and finding solution was a nightmare for me. I am not an internet / computer expert and hence that was a huge tough problem on my desk. Nod32 did not identify it, but Avast did identify, but failed to remove it Sad

Anyways, I digged out a solution while googling. Hope the same works for you - here it is- The recycler virus solution: http://www.techpavan.com/2009/01/10/recycler-autorun-virus-removal-instructions/

Hope that helps you Smile
sitacool
The link you have provided is also the same link to which the post submitted by me earlier i.e http://binaryday.com/2009/05/16/how-to-remove-recycler-virus-on-usb/ refers to. A really useful post on the topic without doubt.
reza2re
brokenadvice wrote:
Boot your computer in safe mode by pressing F8 during startup, and re run the AVG scan. It should be able to detect the files in safe mode. You will also have to delete the autorun files off the flash drive. I suggetst you find a friend who has a mac to delete if for you. There may be an easier way, but this way should work.
.
Hey does anyone know about this virus/trojan mscdent.exe nsmcse.exe mscsmc.exe service.exe network gateway manager that coming up with some program setup . its like a shadow there is there is,nt . i have no program limit but no program can find him . if every body have inf about its please help me and send it to reza2re@yahoo.com

oh recycler.pif and autorun.inf are in ralated with it . it failed sys restore . iknow it isnt rootkit and change regestery keies and value
reza2re
Hey does anyone know about this virus/trojan mscdent.exe nsmcse.exe mscsmc.exe service.exe network gateway manager that coming up with some program setup . its like a shadow there is there is,nt . i have no program limit but no program can find him . if every body have inf about its please help me and send it to reza2re@yahoo.com

oh recycler.pif and autorun.inf are in ralated with it . it failed sys restore . iknow it isnt rootkit and change regestery keies and value
jdelfire
Maybe I can help...
This is my Profession and hobby at the same time... Manually deleting virus...
I think its a bit too late for your computer to install some antivirus since now that you are fully infected... There is no Perfect antivirus... I dont have any antivirus in my system i welcome them and delete manually... one disadvantage of antivirus is if its gonna encounter a false positive which could even ruin ur system...
We can either chat or do remote sessions...
Just like to lend a hand to fellow frihosters...

so if ur interested chat me in ym g0d_0f_ff7@ym
FunDa
reza2re wrote:
Hey does anyone know about this virus/trojan mscdent.exe nsmcse.exe mscsmc.exe service.exe network gateway manager that coming up with some program setup . its like a shadow there is there is,nt . i have no program limit but no program can find him . if every body have inf about its please help me and send it to reza2re@yahoo.com

oh recycler.pif and autorun.inf are in ralated with it . it failed sys restore . iknow it isnt rootkit and change regestery keies and value



It's my hobby to remove viruses manually.


U can contact me on

http://www.crossloop.com/FundaZone



First get ProcessExplorer.exe (Just google for the link)
That's all u need.


Install Crossloop http://www.crossloop.com
Then send me a help request.
slipshot07
I found this simple system to effectively remove Recycler virus - Blam to Recycler virus.


1. Go to Desktop, right click on Recycle bin and select properties.
2. Check (select or put a tick mark) on the square box (Do not move files to the recycle bin. Remove files immediately when deleted)

3. Get File zilla FTP which is free and install. (you dont need to change any file settings)
4. without entering any sort of web address anywhere click the directories in the Local site box.
5. Then each directory will display all the folders below this box with file name, file size, file type and last modified.
6. Now check if RECYCLER folder is there. Then simply delete it.
7. Your job is done.
8. Repeat in all the folders by searching if it is sub folders too.
9. Repeat for each directory ( C D E F ...)

try it.. Very Happy
FunDa
slipshot07 wrote:
I found this simple system to effectively remove Recycler virus - Blam to Recycler virus.


1. Go to Desktop, right click on Recycle bin and select properties.
2. Check (select or put a tick mark) on the square box (Do not move files to the recycle bin. Remove files immediately when deleted)

3. Get File zilla FTP which is free and install. (you dont need to change any file settings)
4. without entering any sort of web address anywhere click the directories in the Local site box.
5. Then each directory will display all the folders below this box with file name, file size, file type and last modified.
6. Now check if RECYCLER folder is there. Then simply delete it.
7. Your job is done.
8. Repeat in all the folders by searching if it is sub folders too.
9. Repeat for each directory ( C D E F ...)

try it.. Very Happy



That's a nice technique, but I'll outline a simpler(just my opinion) technique.


1. Open "My Computer"
2. Make hidden files visible ( Tools>Folder Options>View > Show hidden files and folders , [uncheck] Hide protected OS files)

3. In the address bar of Windows Explorer (My Computer), type c:\recycler and press Enter
4. If the folder exists, it will go inside the folder and you can see the virus inside.
5. Delete the virus.
6. Repeat from step 3 replacing c:\recycler with the other drive letters, that is, d:\recycler , etc
7. After restarting, check if the virus has really gone.
nam_siddharth
Download and install Norton Internet security trial version. Full scan your PC with Norton. Your problem should be solved now.
airh3ad
They said to clean up system which automatically creates autorun.inf and RECYCLER folder with jwgkvsq.vmx, download and run this program. After reboot, the system probably will complain about missing dll file. To fix it manually, you can use regedit or msconfig try also this if you want an easy way to get rid of the virus off the USB drive itself, just download a file explorer like snowbird off the internet and use it. Once again though make sure you enable the “show hidden files option” from within the program but this will override the viruses control over that option in Windows. I have also found that McAfee was the best to get it off the computer itself. Hope this helps anyone.
nini9
Im currently using Kaspersky antivirus and it deleted this off my hard drive. I changed my recycle bin options to remove files immediately when deleted first and the virus was detected and removed straight away. Just make sure to unhide all folders because the virus folder will still be there but it should be empty.
gphoenix
Just quick format your pendrive Very Happy
bruclem
ainieas wrote:
Hey does anyone know about this virus/trojan Recycler.exe. It affects removable drives. Right now it has become a nightmare for me tryig to get rid of it. AVG Anti-Virus doesn't detect it even though I can see it is scanning the virus files. Trend Micro Internet security shows everything safe even when I delete the folder and it regenerates while Trend Micro is running. Kaspersky Internet Security detects that the files are infectected but cannot clean it up. I've the latest updates of the said anti-viruses yet I'm going around in circles. Any help would be much appreciated.


Easy way to remove it without any anti-virus programs etc. This method worked for me and could be used for all viruses perhaps?
The sequence must be followed strictly:
1)Boot up in safe mode
2)Under Tools Folder options VIEW for the infected drive, unhide all files, APPLY OK.
2)Find the virus file... recycler.exe and the associated autorun.inf
3) For each in turn, RENAME to something similar, with no extension, eg RECYC or AUTO
4) Right click on the renamed file. PROPERTIES, check OFF the read only status, APPLY OK.
5) Highlight each file in turn. Hit the DEL button. SHould disappear.
This works most times
Good luck
Related topics
751 Useful Windows XP Files
Protect your pc from new virus programs..
/.exe Virus
[Official] Security: Anti-Spyware/Virus, & Firewall
ibm00001.exe and Virus problem
AVG wont catch adobeR.exe virus!
New Folder.exe
sscvihost problem
What is eating my memory???
w32 virus removal
Clean ur flash drive from common virus....
Technique to prevent virus infection in win32
Delete An "undeletable" File
Recycler.exe Virus Help...
Reply to topic    Frihost Forum Index -> Computers -> Computer Problems and Support

FRIHOST HOME | FAQ | TOS | ABOUT US | CONTACT US | SITE MAP
© 2005-2011 Frihost, forums powered by phpBB.