Printable View
I keep getting this error message on startup
'cannot find file d:\recycler\S-1-5-~1\DD7 make sure the filename is correct and that all of the required libraries are available '(or words to that effect)
Does anyone have any ideas as to what this means and how I can stop it happening?
Thanks,
Physed.
Sounds like someones profile has a problem. Under NT, every user that logs on gets there own recycle bin. This is stored in the default recycle bin path, in this case d:\recycler. Log on as an administrator, open the recycle bin in explorer in delete the
\S-1-5-~1\DD7 file. Hopefully, this should fix the problem
yesterday i got the same problem !
When i tried to open any partition it wouldn't open , so i reinstaled my windows xp sp2 but now
when i tried to open the partitions o got this error msg:
Windows cannot find 'RECYCLER\S-7-1-21-100020146-100019345-100023968-6712.com'.
I searched the net for the cause of the error and didn't find a thing , but i think i found
it and also fix it.The problem was a trojan rootkit.
How to fix :
step 1:
get a good antivirus (kaspersky internet security 7 worked for me)
step 2:
open your windows partition with explore function( right click --> Explore)
step 3:
Go to : Tools-->Folder Options-->View tab and :
-check "Show hidden files and folders"
-uncheck "Hide protected operating system files"
the apply and ok
step 4:
in your windows partiton you will see an autoexec.bat ---> delete it !!!
step 5:
delete autoexec.ini !!!
step 6:
Go to RECYCLER and delete the files that have the extension .com
step 7:
repeat steps 5 and 6 for all your partitions
step 8:
restart you computer
DONE!
Hope this helps
I have the same problem...Ive done exactly what you said, the only problem is, it wont allow me to delete the file. It says its being use by another program.
Similarly, I cant uninstall Mcafee for the same reason. Coincidence that all this started when I downloaded it from my university web site.
Welcome to VirtualDr Spiider11 and atsal :)
Try it in Safe mode.Quote:
Originally Posted by atsal
I have the exact same problem.
happened just moments after i connected a brand new flash drive i bought off fleebay. the drive was manufactured in China!
Anyhow, I cannot access the C drive now.
And when I go through explorer and show hidden files, i cannot find autoexec.ini or bat.
All you guys should start new topics in HijackThis forum, and go through these steps:
Print these instructions out.
NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to screw_you.exe
1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/
* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.
PHYSICALLY DISCONNECT FROM THE INTERNET
Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen
* Open SUPERAntiSpyware.
* Under Configuration and Preferences, click the Preferences button.
* Under [b]General and Startup" tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* Back on the main screen, under Scan for Harmful Software click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under Complete Scan, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.
NOTE: Tracking cookies can be omitted from the log.
RECONNECT TO THE INTERNET
RESTART COMPUTER!
2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
RESTART COMPUTER!
3. Download, install, and run HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.
Do NOT attempt to "fix" anything!
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
Worked spot on for me just gotta make sure you get all the files and dont miss none then its all cushty.. nice 1 :DQuote:
Originally Posted by Spiider11
This method worked perfect for me! cheers spiider
Quote:
Originally Posted by Spiider11
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 02/01/2009 at 09:00 PM
Application Version : 4.25.1012
Core Rules Database Version : 3738
Trace Rules Database Version: 1707
Scan type : Complete Scan
Total Scan Time : 00:33:03
Memory items scanned : 194
Memory threats detected : 0
Registry items scanned : 2757
Registry threats detected : 0
File items scanned : 37617
File threats detected : 3
Adware.Tracking Cookie
C:\Documents and Settings\admin\Cookies\admin@doubleclick[1].txt
C:\Documents and Settings\admin\Cookies\admin@insightexpressai[2].txt
C:\Documents and Settings\admin\Cookies\[email protected][1].txt
CristianZ
Please, start your own topic here: http://discussions.virtualdr.com/forumdisplay.php?f=71
Malwarebytes' Anti-Malware 1.33
Database version: 1713
Windows 5.1.2600 Service Pack 2
2/1/2009 9:54:25 PM
mbam-log-2009-02-01 (21-54-25).txt
Scan type: Full Scan (C:\|D:\|E:\|G:\|)
Objects scanned: 77732
Time elapsed: 9 minute(s), 23 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
D:\Chestii vechi\Setup-uri\Windows 2003 & XP Anti Product Activation Crack 1.8 Beta 2\Crypt.dll (Hacktool) -> Quarantined and deleted successfully.
I have the same problem.I try what Spiider11 say, but i don't find any
autoexec.bat or autoexec.ini.
I did what Broni wrote and it didn't find any infected file.
I've formatted and reinstalled windows, and this partition works now, but for the others the problem remaines. I've scaned olso with norton,avg,panda nod32, bitdef and none of them found files to be infected.
What should i do?
Empty the Recycle Bin?
The autoexec.bat is a hidden file, you need to make sure that not only is 'Show hidden system files and folders' is checked but also that 'Hide protected system operating files' is un checked..Quote:
Originally Posted by george09
These actions if applied to all your files and folders should allow you to see the RECYCLER folder which will be in the root of each of your hard drives.. i.e. C:\RECYLCER
also my .ini file was autorun.ini not autoexec.ini as stated on spiiders post.. if you dont delete all the files it will still be on your computer :D
I had the same problem with my system. Mine would say Recycler\s-1-7-37****6616.com. Spiider11 had 6712.com so it must be a different name for everyone. In Windows Task Manager i could see the ****6616.com file running in the processes section so i ended it .My shortcuts to each partition worked but i couldn't access the partition directly from "MY Computer". I found that i could still access the partition by going to Start / Run / and entering C:/ or whatever letter the partition was on. Whatever was causing the problem for me was in the Recycler folder. The folder had three files in it (1.) recycler file (2.) Recycler file with .com in the name (3.) Batch file . I deleted files 2 and 3 on each partition. I also searched the registry (Start / Run / Regedit) Then i went to Edit / Find and searched for the last part of my file name "6166.com" I found two entries in the autostart for each of the partitions. I just deleted each one and restarted my computer. That fixed it for me.
I don't have autorun.ini or autoexec.ini. Only autorun.inf and autoexec.bat .Quote:
Originally Posted by trip0x
The problem remain .
This discussion is totally worthless.
As I said before, this is some malware issue, and all of you who are having this problem, should follow the steps, I listed in reply #7, and start a new topic in HJT forum.
I followed the steps and I started a new topic in HJT forum but nobody answered me.Quote:
Originally Posted by Broni
http://discussions.virtualdr.com/sho...d.php?t=236785
Excellent, now we have to wait until some one gets home from work or the like. Remember we are scattered all over the world.
windows cannot find RECYCLER\S-8-6-76-100003598-100010904-100014070-6284.com
Download Autorun Eater. this is a free program. This will take care of your problem.
Thanks a million ....worked like a charm :DQuote:
Originally Posted by sikosrus
Thanks a million...it worked like a charm :DQuote:
Originally Posted by sikosrus
I have had a similar problem before and upon my own investigations, I found that there was a call being made from the system to a hidden system file within the recycle bin folder. This file IS in fact a virus, that attaches itself to programs on a USB key or other removable drives. Once the program is loaded, it "triggers" a hidden installation process and keeps the file loaded at all times (or at least locks the file). Loading the computer in safe-mode (F8 at startup), removing ALL attributes using the attrib command (you can google how to use it) should make the file deletable, but if it has already infected your system files, this might not work (see below if this is the case) but you must ALSO remove the reference to the file with HiJackThis before the reboot. The removable drive and whole computer should be scanned for this virus with an updated anti-virus after you do that (after re-boot).
If the files are un-deletable in safe-mode with the attributes cleared:
Insert your windows installation CD, do a repair if possible (Windows XP). If not, do a re-install. Make sure that after it is done it does NOT load into windows, but into safe-mode instead (to avoid being re-infected). Once loaded in safe-mode, immediately run "sfc /scannow", and when that is done, run "sfc /purgecache". This is to make sure that all of the files are replaced with signed versions. Restart and GO BACK INTO SAFE-MODE. Now, within safe-mode, re-try the attribute change and delete of the file. After that is done, scan with HiJackThis and then re-start into Windows and run the updated Anti-Virus program to get rid of the rest.