recently ive been having this problem in my comp. ive tried everything and i cant even delete this it keeps on regenerating itself whenever i try to refresh or boot my comp. whenever i transfer files to my flashdisk about 1GB it takes me 158mins. and also i cant delete the folder recycler under my C: drive ive search through the forum about removing it, ive disable my system restore and still cant even delete this, any solution? btw im using windows defender for my antispyware and recently ive scan a full scan and no spyware detected.

heres my log:

//-----------------------------------------------------------------
//
// ProductBitDefender Antivirus Plus v10
// Product10.2
//
// Created on: 11/07/2007 12:44:59
//
//-----------------------------------------------------------------


Virus Statistics

Scan path : F:\
Folders : 4
Files : 71
Memory processes scanned : 0
Archives : 4
Runtime packers : 1
Identified viruses : 1
Infected files : 1
Memory processes infected : 0
Suspect files : 0
Warnings : 0
Disinfected files : 0
Deleted files : 1
Moved files : 0
I/O errors : 0
Scan time : 00:00:23
Scan speed (files/sec) : 3

Virus definitions : 31272630
Scan plugins : 16
Archive plugins : 41
Unpack plugins : 6
Mail plugins : 6
System plugins : 5

Virus scan options

Detection
[ ] Scan boot sectors
[ ] Memory Processes
[X] Scan archives
[X] Scan runtime packers
[X] Scan email

File mask
[ ] Programs
[X] All files
[ ] User defined extensions:
[ ] Exclude extensions: ;

Action

Infected objects
[ ] Ignore
[X] Disinfect
[ ] Delete
[ ] Move to quarantine
[ ] Prompt user

Second action
[ ] Ignore
[X] Delete
[ ] Move to quarantine
[ ] Prompt user

Virus scan options
[X] Enable warnings
[X] Enable heuristics
[X] Show all files in log
[X] Report file: C:\Documents and Settings\Prinz Magallanes\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1184129099.log

Spyware scan options

[X] Scan for riskware
[ ] Skip dial and applications from scan
[ ] Registry keys
[ ] Cookies


Summary:

F:\autorun.inf Infected: Trojan.Agent.AD
F:\autorun.inf Disinfection failed
F:\autorun.inf Deleted

Scanned files

F:\ OK
F:\Programs\ OK
F:\Programs\TCPOptimizer.exe OK
F:\Programs\uTorrent-1.6.1-install.exe OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o) OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0000 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0001 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0002 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0003 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0004 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0005 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0006 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0007 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Persian!fa.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Serbian (Latin)!srYU.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>German!de.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>French (Canada)!frCA.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Swedish!sv.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Bulgarian!bg.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Norwegian!no.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>english.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Russian!ru.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Portuguese (Portugal)!pt.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Hungarian!hu.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Thai!th.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Macedonian!mk.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Italian!it.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Greek!el.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>French (France)!fr.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Bosnian!bs.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Finnish!fi.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Dutch!nl.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Latvian!lv.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Hebrew!he.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Slovak!sk.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Spanish!es.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Czech!cs.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Portuguese (Brazil)!ptBR.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Serbian (Cyrillic)!srSR.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Frisian!fyNL.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Ukrainian!ua.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Korean!ko.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Chinese (Traditional)!zhTW.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Slovenian!sl.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Arabic!ar.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Danish!dk.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Taiwan!tw.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Vietnamese!vi.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Chinese (Simplified)!zhCN.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Estonian!et.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Icelandic!is.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Romanian!ro.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Lithuanian!lt.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Polish!pl.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Japanese!jp.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Turkish!tu.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>Catalan!ca.txt OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0008=>version OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0009 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0010 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0010=>(NSIS g) OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0010=>(NSIS g)=>lzma_nsis0000 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0010=>(NSIS g)=>lzma_nsis0001 OK
F:\Programs\uTorrent-1.6.1-install.exe=>(NSIS o)=>lzma_nsis0010=>(NSIS g)=>lzma_nsis0002 OK
F:\Torrents\ OK
F:\Torrents\Elfen_Lied_-_01-13 [myBittorrent[1].com].torrent OK
F:\Torrents\gundam_wing_(dual_audio).torrent OK
F:\Torrents\o-Demonoid.com-o_Tenjou_(Tenjo)_Tenge_Manga_5121030.1208.torrent OK
F:\Torrents\School_Rumble_Season_1_EP1_26_2_OVA_-++Demonoid.com++_5121030.1208.torrent OK
F:\Show Desktop.txt OK
F:\RECYCLER\ OK
F:\RECYCLER\INFO.exe OK
F:\RECYCLER\desktop.ini OK
F:\autorun.inf Infected: Trojan.Agent.AD
F:\autorun.inf Disinfection failed
F:\autorun.inf Deleted

also

C:\RECYCLER\S-1-5-21-571900465-793559814-1820354528-1008

cant delete that.

It seems that the virus has been removed by BD. However, make a deep system scan and post that result. You may have another malware program hidden in system folders.

Recycler is a system folder, basically, it is the recycle bin. You can't remove this folder. You can't remove System Volume Information either, because that's where Windows keeps track of restore points.

yep i know the recylcer overwrites my recycle folder ill post another log for the deep scan in safe mode..

Hello

Did you empty your recycle bin? Do that also in safe mode. You can use also this tool : http://www.gregorybraun.com/CLEANUP.ZIP This tool designed to clear previously deleted files. Because after you delete software the data can still being recovered or find by an antivirus. I suggest that you download superantispyware to be sure that there isn't any malware active : http://downloads2.superantispyware.com/dow...AntiSpyware.exe Update it and afterwards boot your pc into safe mode by just rebooting. Press several times on the F8 button before the windows loadingscreen and choose safe mode. After that start superantispyware and perform a complete scan.

Regards
Niels

But you can clean it: http://www.microsoft.com/windowsxp/using/h...ps/mcgill1.mspx

That is true but in this case it's located in the recycle bin. Otherwise it must be found in system_volume_information. Than by disable system restore you get rid of the files stored in the system volume restore folder.

Regards
Niels

ive disabled my system restore a few days ago so all my previous restore points should be deleted.. ill try that antispyware and post my logs here..

it seems that Virus has been deleted by BD
u must foolow this
first of all go to Tool bar in menu
then check the unhide all items and the uncheck the hide protected system files
the run CMD
go to C:
the enter this coomond
attrib autorun.inf -r -h -s
after running this comond
run this
del autorun.inf
if other drives opf computer are infected by this follow the same petrn for other e.g
D:
then
D:// attrib autorun.inf -r -h -s
then
del autorun.inf
then restart ur computer ur problum will be solved
Regards
Sheikh Muddasar

ive done what you have told me too.. ive tried on my C: drive and it says could not find C:/Documents and Settings.../autorun.inf ive also tried this on my Flash Disk Drive and and it cannot find also but its definitely the autorun is there together with a folder recycler. for now ill try niels suggestion about superantispyware ive just update it.. and will run a full scan... btw the autorun.inf or trojan.agent.ad is regenerating itself each time i delete it together with the recycler and its only effect is that whenever i try to copy some file on my HD to my flashdist about 1gb it takes 158mins to copy thats annoying its worse than ravmone.

Please follow the instructions.

Goto Start > Run >

then enter



Now enter CD\ and you'll get this prompt now



Now, enter the command i previously mentioned i.e;


HIT ENTER ... and if there is autrun present in your root of C it will be visible for you ... got windows explorer, C Drive and you can watch it there .. just dELETe it.

Regards
sheikh Muddasar

file cannot be found... but its still there ive also open this autorun and heres what it looks..

[autorun]
open=

shell\open\Command=RECYCLER\INFO.exe
shell\open\Default=1
shell\explore\Command=RECYCLER\INFO.exe

ill be scanning my comp on safe mode using superantispyware then ill post my logs here... oh btw niels or anyone here ive downloaded the rescue cd its version 9 and i have updated my bitdefender on 10 can it also scan in safe mode with the version9 in the rescue cd cuz im version 10 now.. also i dont know about this iso filename thing should i extract this first and burn it to a cd or the iso itself on the cd also how about if i mount it on daemon tools?

thnx guys for the help you can close this thread now.. it was just a spyware after scanning it discovered 26 spyware and ive remove it and its gone now.. thnx..

Glad that we could assist you!

Andrei

Hi deltashock,

You're welcome to post here any other questions you might have. We'll try to help you

Cris.

Please look for the file RECYCLER\INFO.exe and upload it here. It is not spyware, it is most likely a worm.

btw off topic about the iso thing do i need to extract it first then burn it to a cd i have a rescue cd version 9 which niels give me but ive upgraded to version 10 recently will it still scan in the safe mode?

i already say u that i is not a big problum
Regards
Sheikh Muddasar

Use ccleaner to empty the recylce securely. www.ccleaner.com