Files still in C:\RECYCLER that were deleted from Recycle Bin

July 16, 2007

I was defragging my hard drive and I noticed that some of the files

that it couldn't move were in C:\RECYCLER. Turns out it's two

humongous video files I thought I'd deleted a long time ago, but were

still lingering there along with a bunch of other stuff. I can't get

to the folder in Windows Explorer, and I tried the method at

http://support.microsoft.com/kb/229041 but it didn't work (I'm not

sure if I have the right original directory for that). This is taking

up nearly 3GB. Is there some way to delete them?

July 16, 2007

Re: Files still in C:\RECYCLER that were deleted from Recycle Bin

The KB article you looked at was for Nt4.0. Try this workaround instead.

Click on "my computer" then click on Tools, Folder Options, tab on View.

Put a button next to Show hidden files and folders, remove checkmarks from

Known file exts, and System hidden files. Click apply and ok. Look for the

\Recycler folder in the root directory of drive C and click on it. You now

should see userSID recycle bin baskets in the \Recycler directory... click

on each of these to see what files are in each one, then delete them

manually.

Reverse the above procedure in folder options/View - to hide files and

folders, known file exts, and System hidden files.

Good luck, if you get stuck holler back

BlastOButter42 <RobertEColgan@gmail.com> wrote:

> I was defragging my hard drive and I noticed that some of the files

> that it couldn't move were in C:\RECYCLER. Turns out it's two

> humongous video files I thought I'd deleted a long time ago, but were

> still lingering there along with a bunch of other stuff. I can't get

> to the folder in Windows Explorer, and I tried the method at

> http://support.microsoft.com/kb/229041 but it didn't work (I'm not

> sure if I have the right original directory for that). This is taking

> up nearly 3GB. Is there some way to delete them?

July 17, 2007

Re: Files still in C:\RECYCLER that were deleted from Recycle Bin

On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:

> The KB article you looked at was for Nt4.0. Try this workaround instead.

> Click on "my computer" then click on Tools, Folder Options, tab on View.

> Put a button next to Show hidden files and folders, remove checkmarks from

> Known file exts, and System hidden files. Click apply and ok. Look for the

> \Recycler folder in the root directory of drive C and click on it. You now

> should see userSID recycle bin baskets in the \Recycler directory... click

> on each of these to see what files are in each one, then delete them

> manually.

>

> Reverse the above procedure in folder options/View - to hide files and

> folders, known file exts, and System hidden files.

>

> Good luck, if you get stuck holler back

>

> BlastOButter42 <RobertECol...@gmail.com> wrote:

> > I wasdefraggingmy hard drive and I noticed that some of the files

> > that it couldn't move were in C:\RECYCLER. Turns out it's two

> > humongous video files I thought I'd deleted a long time ago, but were

> > still lingering there along with a bunch of other stuff. I can't get

> > to the folder in Windows Explorer, and I tried the method at

> >http://support.microsoft.com/kb/229041but it didn't work (I'm not

> > sure if I have the right original directory for that). This is taking

> > up nearly 3GB. Is there some way to delete them?

Well, that got me farther than I was before, but in the C:\RECYCLER

folder, I see two directories, each beginning with S-1-5-21- and then

a long string of numbers, but then when I open them up they are empty.

The defrag told me where the files I want to delete are: in one of

them, inside a folder called Dc21, but that folder is nowhere to be

found when opening the S-1-5-21 folders.

Also, if I try to type the directory into the address bar, it keeps

deleting what I type, and if I paste it in it says Cannot find 'file:\\

\C:\RECYCLER\..." etc.

July 17, 2007

Re: Files still in C:\RECYCLER that were deleted from Recycle Bin

Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the

C:\Restore folder in your defrag report message, then Dc21.exe is a

suspected trojan process and the files are super hidden.

You may need to make a post in a hijackthis forum online. The gurus there

will get you cleaned out for sure. By preference - I use the HJT forums at

Bleepingcomputer.com but most all other forums provide the same level of

help.

http://www.bleepingcomputer.com/forums/forum22.html

you'll have to register to post, but its free. Be sure to follow all the

instructions your malware removal advisor gives you.

Good luck.

BlastOButter42 <RobertEColgan@gmail.com> wrote:

> On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:

>> The KB article you looked at was for Nt4.0. Try this workaround instead.

>> Click on "my computer" then click on Tools, Folder Options, tab on View.

>> Put a button next to Show hidden files and folders, remove checkmarks

>> from Known file exts, and System hidden files. Click apply and ok.

>> Look for the \Recycler folder in the root directory of drive C and click

>> on it. You now should see userSID recycle bin baskets in the

>> \Recycler directory... click on each of these to see what files are in

>> each one, then delete them manually.

>>

>> Reverse the above procedure in folder options/View - to hide files and

>> folders, known file exts, and System hidden files.

>>

>> Good luck, if you get stuck holler back

>>

>> BlastOButter42 <RobertECol...@gmail.com> wrote:

>>> I wasdefraggingmy hard drive and I noticed that some of the files

>>> that it couldn't move were in C:\RECYCLER. Turns out it's two

>>> humongous video files I thought I'd deleted a long time ago, but were

>>> still lingering there along with a bunch of other stuff. I can't get

>>> to the folder in Windows Explorer, and I tried the method at

>>> http://support.microsoft.com/kb/229041but it didn't work (I'm not

>>> sure if I have the right original directory for that). This is taking

>>> up nearly 3GB. Is there some way to delete them?

>

> Well, that got me farther than I was before, but in the C:\RECYCLER

> folder, I see two directories, each beginning with S-1-5-21- and then

> a long string of numbers, but then when I open them up they are empty.

> The defrag told me where the files I want to delete are: in one of

> them, inside a folder called Dc21, but that folder is nowhere to be

> found when opening the S-1-5-21 folders.

> Also, if I try to type the directory into the address bar, it keeps

> deleting what I type, and if I paste it in it says Cannot find 'file:\\

> \C:\RECYCLER\..." etc.

July 17, 2007

Re: Files still in C:\RECYCLER that were deleted from Recycle Bin

On Jul 17, 1:00 am, "C J." <no.re...@example.invalid> wrote:

> Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the

> C:\Restore folder in your defrag report message, then Dc21.exe is a

> suspected trojan process and the files are super hidden.

>

> You may need to make a post in a hijackthis forum online. The gurus there

> will get you cleaned out for sure. By preference - I use the HJT forums at

> Bleepingcomputer.com but most all other forums provide the same level of

> help.

>

> http://www.bleepingcomputer.com/forums/forum22.html

>

> you'll have to register to post, but its free. Be sure to follow all the

> instructions your malware removal advisor gives you.

>

> Good luck.

>

> BlastOButter42<RobertECol...@gmail.com> wrote:

> > On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:

> >> The KB article you looked at was for Nt4.0. Try this workaround instead.

> >> Click on "my computer" then click on Tools, Folder Options, tab on View.

> >> Put a button next to Show hidden files and folders, remove checkmarks

> >> from Known file exts, and System hidden files. Click apply and ok.

> >> Look for the \Recycler folder in the root directory of drive C and click

> >> on it. You now should see userSID recycle bin baskets in the

> >> \Recycler directory... click on each of these to see what files are in

> >> each one, then delete them manually.

>

> >> Reverse the above procedure in folder options/View - to hide files and

> >> folders, known file exts, and System hidden files.

>

> >> Good luck, if you get stuck holler back

>

> >>BlastOButter42<RobertECol...@gmail.com> wrote:

> >>> I wasdefraggingmy hard drive and I noticed that some of the files

> >>> that it couldn't move were in C:\RECYCLER. Turns out it's two

> >>> humongous video files I thought I'd deleted a long time ago, but were

> >>> still lingering there along with a bunch of other stuff. I can't get

> >>> to the folder in Windows Explorer, and I tried the method at

> >>>http://support.microsoft.com/kb/229041butit didn't work (I'm not

> >>> sure if I have the right original directory for that). This is taking

> >>> up nearly 3GB. Is there some way to delete them?

>

> > Well, that got me farther than I was before, but in the C:\RECYCLER

> > folder, I see two directories, each beginning with S-1-5-21- and then

> > a long string of numbers, but then when I open them up they are empty.

> > The defrag told me where the files I want to delete are: in one of

> > them, inside a folder called Dc21, but that folder is nowhere to be

> > found when opening the S-1-5-21 folders.

> > Also, if I try to type the directory into the address bar, it keeps

> > deleting what I type, and if I paste it in it says Cannot find 'file:\\

> > \C:\RECYCLER\..." etc.

I'm sure the path is correct; I was able to navigate there and see all

the files while running Ubuntu off a CD, but I couldn't delete them.

I don't quite see how this could be a trojan; when I was rooting

around there in Ubuntu I didn't find any files other than old stuff I

thought I'd deleted, and I've never seen anything called dc21.exe.

Should I run a HiJackThis scan?

July 17, 2007