[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

RECYCLER1-5-21-1001050067-2202560375-649528981-1009\DE2.PST

Posted on 2006-05-04
24
Medium Priority
?
546 Views
Last Modified: 2012-08-14
I SCANNED WITH BIT DEFENDER AND FOUND THIS FILE IN THE HIDDEN RECYCLER FOLDER, ORIGINALLY THERE WAS 4 FILES WITH THE LAST DIGIT BEING 1008.  THREE OF THE FILES WOULD DELETE THIS WOULD NOT, EVEN IN SAFE MODE, AS I TRIED TO DELETE IT IT SAID THERE WAS A PROGRAM OR PERSON USING THE FILE, I USED CTRL ALT DEL AND THE RECYCLER PROGRAM WAS RUNNING I ENDED IT BUT STILL WOULDN'T DELETE . IN BITDEFENDER IT WAS CALLED A TROJAN BANKFRAUD AND HAD NORTON IN THE FILE LINE ( I ORIGINALLY HAD NORTON ) I TRIED TO USE ZONEALARM, PCTOOLS AND NORTON 2006 NONE EVEN SAW THE PROGRAM, KNOW I SCANNED WITH BITDEFENDER AND IT DOESN'T SEE IT , BUT WHEN I LOOK IN THE RECYCLER FOLDER THERE IT IS ANY IDEAS
0
Comment
Question by:jim123fish
  • 12
  • 6
  • 6
24 Comments
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 16611787
Follow r-k's advice on this thread to delete persistent file.
http://www.experts-exchange.com/Applications/Viruses/Q_21838635.html#16611678

If not, you can also use Killbox, "delete on reboot" option pasting all 3 files and paths, they will be deleted all at once at reboot.
0
 
LVL 47

Assisted Solution

by:rpggamergirl
rpggamergirl earned 1200 total points
ID: 16611804
Are you sure it's not the Norton protected recycle bin?

Here's the Killbox link:
http://www.atribune.org/downloads/KillBox.exe


You might also like to let us look at your hijackthis log.

http://www.cyberanswers.org/forum/uploads/HijackThis1991.exe
Open Hijackthis, click "Do a system scan and save a logfile" don't fix anything yet, just upload the logfile created, go here and paste your Hijackthis log, http://www.rafb.net/paste/
then at the bottom left corner click "paste"
Copy the address/url and post it here:

Or copy and paste the log at;
http://www.hijackthis.de/ 
and click "Analyse", click "Save".  Post the link to the saved list here.
0
 

Author Comment

by:jim123fish
ID: 16611823
I SCANNED WITH BIT DEFENDER AND FOUND THIS FILE IN THE HIDDEN RECYCLER FOLDER, ORIGINALLY THERE WAS 4 FILES WITH THE LAST DIGIT BEING 1008.  THREE OF THE FILES WOULD DELETE THIS WOULD NOT, EVEN IN SAFE MODE, AS I TRIED TO DELETE IT IT SAID THERE WAS A PROGRAM OR PERSON USING THE FILE, I USED CTRL ALT DEL AND THE RECYCLER PROGRAM WAS RUNNING I ENDED IT BUT STILL WOULDN'T DELETE . IN BITDEFENDER IT WAS CALLED A TROJAN BANKFRAUD AND HAD NORTON IN THE FILE LINE ( I ORIGINALLY HAD NORTON ) I TRIED TO USE ZONEALARM, PCTOOLS AND NORTON 2006 NONE EVEN SAW THE PROGRAM, KNOW I SCANNED WITH BITDEFENDER AND IT DOESN'T SEE IT , BUT WHEN I LOOK IN THE RECYCLER FOLDER THERE IT IS ANY IDEAS
0
2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

 

Author Comment

by:jim123fish
ID: 16611986

Here is the log whats next



Logfile of HijackThis v1.99.1
Scan saved at 10:20:28 PM, on 5/4/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\Brmfrmps.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Softwin\BitDefender9\bdswitch.exe
C:\Program Files\Softwin\BitDefender9\bdnagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender9\vsserv.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Softwin\BitDefender9\bdmcon.exe
C:\Program Files\HijackThis 1.99.1\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmflp03\BrStDvPt.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [IndexSearch] "C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\Program Files\Softwin\BitDefender9\bdswitch.exe"
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender9\bdmcon.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender9\bdnagent.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1B9935E4-8A50-4DD8-BD09-A7518723BF97} (Talisma NetAgent Customer ActiveX Control version 3) - https://quicken.ehosts.net/netagent/objects/custappx3.cab
O16 - DPF: {298BFFEE-662D-11D5-ADAF-00E0810232D7} (lgbplay Class) - https://video.manheim.com/lib/LiveSound.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123804366671
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\SYSTEM32\Brmfrmps.exe" -service (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

0
 
LVL 32

Assisted Solution

by:r-k
r-k earned 800 total points
ID: 16612233
Here is the link to your analyzed HJT log:

  http://www.hijackthis.de/logfiles/900c525db612f4eba0cc2adf5e489a6d.html

(I got this by using steps posted by rpggamergirl in the above post).

It does not show anything bad running on your system.

Can you post the full name of the file which you can't delete (and the folder it is in?)

Thanks.
0
 

Author Comment

by:jim123fish
ID: 16615808
C:\RECYCLER
S-1-5-21-1001050067-2202560357-649528981-1008
type is a folder
size is 85 bytes
2files 0folders
created oct 7 2004
read only
space reserved 3.99 gb

what is the best way to remove the things hijack this says aren't needed thanks
0
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 1200 total points
ID: 16618859
Just run hijackthis again and put a check next to items that you want to remove and click "Fix Checked" button and hijackthis will remove it.


Also, have you tried emptying your bin?
Or deleting your recycle bin? at reboot windows will create a new one.

You can also use a batchfile to delete the bin.
Copy & paste the text below into notepad and save it as "recyclerem.bat"
Set filetype to "All Files", Close all programs and doubleclick "recyclerem.bat"
Your computer will reboot and you will have a new recycle bin.
---

attrib -r -s -h %systemdrive%\Recycler
del %systemdrive%\Recycler
attrib -r -s -h %systemdrive%\Recycled
del %systemdrive%\Recycled
shutdown /r /t 0 /f
0
 

Author Comment

by:jim123fish
ID: 16632316
i did the batchfile route to delete the c:RECYCLER  and the file inside and the batch file worked fine asked yes or no i obviously said yes then rebooted but when i went to explorer and looked for the file it was still there in C:\RECYCLER  on the reboot a microsoft executable cfmon wanted to change the registry  .  You have been great and insightful, any other ideas, sorry about the delay in getting back Jim
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 16635617
Are you trying to delete the folder or the file inside which is "DE2.pst"
when I looked at my Recycler these numbers starting with "S-1-5-21-" are the users SID, and when its "Type: Folder" that is the users recycle bin, unless the type is "Type: File Folder" then that's just a normal folder. Some folders under "Recycler" can be created by anyone(using a program) especially if they want to spy on what every users throw in their bins, that user can see inside every users recycle bins.

.pst extension is Outlook's repositories for emails, contacts, calendars, etc.
Try using Unlocker to delete the file inside that bin.

Download Unlocker
http://ccollomb.free.fr/unlocker/unlocker1.8.0.exe
Install it.
Reboot your computer.
After reboot, navigate to whatever file you want to unlock and delete:(example below)

C:\RECYCLER\S-1-5-21-1001050067-2202560357-649528981-1009\DE2.PST

right-click on this file and choose "Unlocker".
A window should come up, click to highlight the file path and choose "unlock" (make sure "no action" is chosen in the program).
After you unlock it, right-click on the file and choose delete.

Hope it helps.
0
 

Author Comment

by:jim123fish
ID: 16636350
i ran the batchfile 2 times and now the file within C:RECYCLER is gone should i delete the folder RECYCLER thanks jim
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 16636452
>>i ran the batchfile 2 times and now the file within C:RECYCLER is gone should i delete the folder RECYCLER <<

There's probably no need to delete that if the file is gone anyway, when you delete the RECYCLER folder windows will replace it at reboot.
0
 

Author Comment

by:jim123fish
ID: 16653917
The file came back, would it be a good idea to use kill box or will doing a system restore clean it out
0
 

Author Comment

by:jim123fish
ID: 16654092
my computer was acting weird so i looked and the file came back so i looked at properties and changed form read only then used killbox to delete and it did then it came back again could i delete my outlook pst file since originally when bitdefender found it it said it was  a html  bankfraud trojan, in a email?
0
 

Author Comment

by:jim123fish
ID: 16654099
my computer was acting weird so i looked and the file came back so i looked at properties and changed form read only then used killbox to delete and it did then it came back again could i delete my outlook pst file since originally when bitdefender found it it said it was  a html  bankfraud trojan, in a email?   will doing a system restore clean it out
0
 

Author Comment

by:jim123fish
ID: 16654144
This was the bitdefender virus scan
System plugins      : 5

Scan options

Detection
[X] Scan boot sectors
[X] Scan archives
[X] Scan packed files
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Second action
[ ] Ignore
[X] Delete
[ ] Copy to quarantine
[ ] Move to quarantine
[ ] Rename
[ ] Prompt user

Scan options
[X] Enable warnings
[X] Enable heuristics
[ ] Show all files in log
[X] Report file: C:\Program Files\Softwin\BitDefender9\Logs\vscan_1146425918.log

Spyware scan options

[X] Memory Processes
[X] Registry keys
[X] Cookies


Summary:

C:\RECYCLER\S-1-5-21-1001050067-2202560375-649528981-1009\Dc2.pst=>[Subject: [Norton AntiSpam] REGIONS BANK - CONFIRM YOUR DETAILS TO AVOID SERVICE CANCELLATION [Tue, 18 Jan 2005 15:13:22 +0500]][From: Regions and Union Planters]=>(body)=>(Compressed Rtf)=>(Rtf2Html)      Infected: Trojan.Spy.HTML.Bankfraud.DQ
C:\RECYCLER\S-1-5-21-1001050067-2202560375-649528981-1009\Dc2.pst=>[Subject: [Norton AntiSpam] REGIONS BANK - CONFIRM YOUR DETAILS TO AVOID SERVICE CANCELLATION [Tue, 18 Jan 2005 15:13:22 +0500]][From: Regions and Union Planters]=>(body)=>(Compressed Rtf)=>(Rtf2Html)      Disinfection failed
C:\RECYCLER\S-1-5-21-1001050067-2202560375-649528981-1009\Dc2.pst=>[Subject: [Norton AntiSpam] REGIONS BANK - CONFIRM YOUR DETAILS TO AVOID SERVICE CANCELLATION [Tue, 18 Jan 2005 15:13:22 +0500]][From: Regions and Union Planters]=>(body)=>(Compressed Rtf)=>(Rtf2Html)      Deleted
C:\RECYCLER\S-1-5-21-1001050067-2202560375-649528981-1009\Dc2.pst=>[Subject: [Norton AntiSpam] REGIONS BANK - CONFIRM YOUR DETAILS TO AVOID SERVICE CANCELLATION [Tue, 18 Jan 2005 15:13:22 +0500]][From: Regions and Union Planters]=>(body)=>(Compressed Rtf)      Update failed
0
 
LVL 32

Expert Comment

by:r-k
ID: 16654170
These look like some infected e-mails you may have received. They are just sitting in the email database, not actively infecting your PC. If you simply delete those emails (from within Outlook) and clear the email trash they should go away.
0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 16654403
>> will doing a system restore clean it out <<
System Restore console doesn't monitor that folder or those files, so it wouldn't make any difference.

Try following r-k's suggestion by deleting it from within Outlook.
0
 
LVL 32

Expert Comment

by:r-k
ID: 16654827
Just to re-cap:

The folder c:\recycler is your re-cycle bin

The folder with the long name within c:\recycler is the recyle bin for your user ID (which starts with S-1-5-21...)

Files within that sub-folder are files that have been deleted by you.

When you delete a file, it is stored in the Recycle bin with a name like DC#.xxx
here in our example, the file name is DC2.PST
The D means "deleted" file
The C means "deleted from C drive"
The 2 means the second file deleted
The .pst is the original extension of the file (in this case, an Outlook mail storage file)
(the above is explained at this link: http://support.microsoft.com/kb/q136517/)

I don't think your PC is infected, but your recycle bin might be corrupt if the dc2.pst file keeps reappearing even after you empty the trash. In that case follow the suggestion by rpggamergirl and delete your recycle bin - a new one should get created when you reboot. The link I posted also has a method for deleting the recycle bin.

You can also download: http://www.kellys-korner-xp.com/regs_edits/restorerecyclebin.reg to your deskop, then double-click on it, and answer Yes to the import prompt. This is described at: http://www.kellys-korner-xp.com/xp_tweaks.htm
0
 

Author Comment

by:jim123fish
ID: 16655060
i can't find these emails, how do you find their location and could you explain how to delete the info file in xp and how to fix the desktop.ini file in xp thanks jim
0
 
LVL 32

Expert Comment

by:r-k
ID: 16655195
I guess by that comment about deleting the emails I was intending that if you have emails with those titles (REGIONS BANK...) then you should delete them. If you don't have them, don't worry about it, they must have been there at one time in an older version of your pst file which keeps appearing in the recycle bin.

On reading some of the earlier emails, it seems possible or likely that what you have is not a computer virus, but a damaged recycle bin. Did you get a chance to delete it see if a new gets created after reboot?

I would suggest trying that fix from the kelly-korner link first.
0
 

Author Comment

by:jim123fish
ID: 16655367
i used the batchfile form rpggamergirl and also did the kellys korner but the file comes back it would seem it might help to delete the info file and check the desktop ini file but i don't know how to do that with xp thanks jim
0
 
LVL 32

Expert Comment

by:r-k
ID: 16655578
Try this from a command prompt:

> rd /s /q c:\recycler

and then reboot your machine. A new recycler should get created.
0
 

Author Comment

by:jim123fish
ID: 16658369
where are the spaces supposed to be, first it said the parameter is not found then i put a space between qand c and then it said the file cannot be found thanks
0
 
LVL 32

Expert Comment

by:r-k
ID: 16658675
It should be:

 rd <sp> /s <sp> /q <sp> c:\recycler

<sp> = space

However, if that doesn't work I'll try it on my computer in a few hours when I get back. Have to leave now.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Cybersecurity has become the buzzword of recent years and years to come. The inventions of cloud infrastructure and the Internet of Things has made us question our online safety. Let us explore how cloud- enabled cybersecurity can help us with our b…
Phishing emails are a popular malware delivery vehicle for attack.  While there are many ways for an attacker to increase the chances of success for their phishing emails, one of the most effective methods involves spoofing the message to appear to …
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
As many of you are aware about Scanpst.exe utility which is owned by Microsoft itself to repair inaccessible or damaged PST files, but the question is do you really think Scanpst.exe is capable to repair all sorts of PST related corruption issues?
Suggested Courses

873 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question