Solved How to remove $Recycle.Bin and System Volume Information virus?

R

rextz101

New member
I run a 32-bit Windows 7 machine as well as a 64-bit Windows 7 laptop. I also have a few USBs and Hard-Drives infected with the $Recycle.Bin. I am not sure if it is a virus; however, on my Hard-Drive it has made everything hidden and the FOLDER PROPERTIES (not FOLDER AND SEARCH OPTIONS) wont let me unhide the folders. Also on my laptop, it has deleted My Documents, My Pictures, My Music etc files, and the only way I can access them is through AppData (so technically it hasn't deleted them). When I unhide system files and hidden files (through FOLDER AND SEARCH OPTIONS), it shows a bunch of random folders that I have never seen before.

I have tried several anti-virus and anti-malware programs but I will not hesitate to do it again, if that is what I have to do. Hope someone can help get rid of this BOTH on my PC and LAPTOP as well as my HARD-DRIVES and USBs. Thanks!
 

My Computer

OS
Windows 7 Enterprise 32 bit
$Recycle.Bin and System Volume information are system folders that are normally created (as far as I know) on all system attached harddrives.
If you right click on your recycle bin link on your desktop you will see it has allocated space for all drives and partitions that is connected to the computer.

I do not know why you are unable to show you hidden files, but if that were the case you would not see these folder either. Screenshots, more info, please?
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Main WKS/Gaming Sloth
OS
W10 Pro
CPU
AMD Ryzen 5 2600X
Motherboard
Asus TUF B450M-PRO-GAMING
Memory
32 GB DDR4
Graphics Card(s)
AMD Radeon RX 5600 XT
Sound Card
Generic Motherboard
Monitor(s) Displays
2 x Dell 24" LED P2415Q
Screen Resolution
2 x 3840 x 2160
Hard Drives
Samsung NVME
PSU
750 W
Case
Fractal Design
Cooling
Fractal Design
Keyboard
Roccat Horde AIMO
Mouse
Logitech G703
Internet Speed
ADSL 30 MBit
Antivirus
Bitdefender
Browser
Firefox
I have enabled "Show hidden files, folders and drives" and disabled "Hide protected operating system files" in the Folder Options (in Control Panel). Due to these settings I can view the $RECYCLE.BIN and System Volume Information folders. I can also see hidden folders that were not previously hidden a week ago. However these folders were shortcuts for some reason a week ago. About a month ago, the hard disk was working perfectly fine. However, when I make a new folder in my hard disk now, it is not hidden.
 

My Computer

OS
Windows 7 Enterprise 32 bit
6

That is an image of my hard disk. Sorry, I had to blur out my private folders, but hopefully you can tell the difference between the hidden folders and normal folders. Just to confirm, are you saying that $RECYCLE.BIN and System Volume Information folders are created by Windows itself and are NOT a virus? I have scanned my hard disk with a free version of Malwarebytes Anti-Malware (version 1.65.0.1400) and it has not found any malicious objects. So now I need a solution to unhide those folders. I do not have access to unhide any of the hidden folders. Please see the image for more details.
6
 

My Computer

OS
Windows 7 Enterprise 32 bit
Hi Rext.
Welcome to SF

I've come across some similar cases as yours. Unfortunately once your system is infected and the virus becoming resident, any attempt to install any new AV or malware program will mostly fail as the virus itself already taking control of PC (system) environment. There are many simple local viruses in our area that hiding the folders making it non reversed read only, creating fake folder in any USB drive named Recycler. They even reside in system Volume Information folder that is unreachable by normal folder browsing.

Here is the the cure that I mostly do.

  1. Pull out the HDD, connect it to other known-virus-free system that has good AV protection. Make sure not to boot from it as you may spread the virus to the clean HDD.
  2. Copy/backup as much important data as possible.
  3. Format all known infected drive(s). It will also erase all virus reside in Volume Information folders.
  4. Shut down, put back HDD to its origin.
  5. Fresh install.
  6. When done with installation, copy back all data with good AV is active. many of the folder that were attributed as hidden might not be able to be reversed, then just copy the content.
That the only idea I can offer ;)

Kevin.
 

My Computers

System One System Two

  • Computer type
    PC/Desktop
    Computer Manufacturer/Model Number
    MSI
    OS
    Windows 11 Prerelease
    CPU
    CORE i5 10400
    Motherboard
    MSI H510M Pro
    Memory
    16GB
    Graphics Card(s)
    GTX 750Ti
    Sound Card
    Realtek HD Integrated
    Monitor(s) Displays
    Samsung Curved 24"; Samsung TV 50"
    Screen Resolution
    1920 x 1080
    Hard Drives
    Vi-Gen NVMe 256GB
    WD 3 TB
    Seagate 2 TB
    Seagate 4TB
    PSU
    Power Striker
    Case
    VBR
    Cooling
    Conventional
    Keyboard
    Logitech Wireless
    Mouse
    Logitech Wireless
    Internet Speed
    2MBPs
  • Computer type
    Laptop
    System Manufacturer/Model Number
    Apple MacBook
    OS
    BigSur
    CPU
    Core i5
    Memory
    8 GB
    Monitor(s) Displays
    13 "
    Screen Resolution
    1366 x 768
    Hard Drives
    SSD 256 GB
rextz101 said:
6
Just to confirm, are you saying that $RECYCLE.BIN and System Volume Information folders are created by Windows itself and are NOT a virus?
6
Click to expand...

Yes, they are Windows-created folders. And, as far as I know, Windows does not let you open them. If you make a back-up image (using, e.g. Acronis True Image) then you could explore them in the backup.

I recommend that you leave them alone.
 

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Scan 3XS P55 liteDAW
OS
Windows Home Premium (64)
CPU
Intel Core i7 860
Motherboard
Gigabyte GA-P55A-UD4
Memory
8GB (4x2GB) Corsair TwinX XMS3
Graphics Card(s)
1GB Gainward 9500 GT
Sound Card
M-Audio Delta 66
Monitor(s) Displays
Acer v223wBBd
Screen Resolution
1680 x 1050
Hard Drives
1 x 500 GB WD Barracuda (OS+Docs)
2 x 1TB Samsung Spinpoint F3 (Data)
PSU
Enermax EMD625AWT II - 625W Enermax Modu82+ II
Case
Fractal Design Define R2 Black
Cooling
Prolima Megahalems Super 6 Heatpipe Tower Cooler
Keyboard
Microsoft Digital Media Pro
Mouse
Belkin Optical Ergo
Internet Speed
8 Mbps nominal (14.9 achieved !)
Other Info
Digital Audio Workstation

My Computer

Computer type
PC/Desktop
Computer Manufacturer/Model Number
Main WKS/Gaming Sloth
OS
W10 Pro
CPU
AMD Ryzen 5 2600X
Motherboard
Asus TUF B450M-PRO-GAMING
Memory
32 GB DDR4
Graphics Card(s)
AMD Radeon RX 5600 XT
Sound Card
Generic Motherboard
Monitor(s) Displays
2 x Dell 24" LED P2415Q
Screen Resolution
2 x 3840 x 2160
Hard Drives
Samsung NVME
PSU
750 W
Case
Fractal Design
Cooling
Fractal Design
Keyboard
Roccat Horde AIMO
Mouse
Logitech G703
Internet Speed
ADSL 30 MBit
Antivirus
Bitdefender
Browser
Firefox
rextz101 said:
I run a 32-bit Windows 7 machine as well as a 64-bit Windows 7 laptop. I also have a few USBs and Hard-Drives infected with the $Recycle.Bin. I am not sure if it is a virus; however, on my Hard-Drive it has made everything hidden and the FOLDER PROPERTIES (not FOLDER AND SEARCH OPTIONS) wont let me unhide the folders. Also on my laptop, it has deleted My Documents, My Pictures, My Music etc files, and the only way I can access them is through AppData (so technically it hasn't deleted them). When I unhide system files and hidden files (through FOLDER AND SEARCH OPTIONS), it shows a bunch of random folders that I have never seen before.

I have tried several anti-virus and anti-malware programs but I will not hesitate to do it again, if that is what I have to do. Hope someone can help get rid of this BOTH on my PC and LAPTOP as well as my HARD-DRIVES and USBs. Thanks!
Click to expand...
C:\users\<your name>\Documents is location of "My documents" . It's not in appdata! Same for my images, my pictures etc.

If you activate "show hidden files" everythings is normal?
really all folders are hidden?
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ACER ASPIRE 5742G
OS
Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Motherboard
Acer Aspire 5742G
Memory
4,00 GB
Graphics Card(s)
ATI Mobility Radeon HD 5400 Series
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
WDC WD5000BEVT-22ZAT0
Kaktussoft said:
rextz101 said:
I run a 32-bit Windows 7 machine as well as a 64-bit Windows 7 laptop. I also have a few USBs and Hard-Drives infected with the $Recycle.Bin. I am not sure if it is a virus; however, on my Hard-Drive it has made everything hidden and the FOLDER PROPERTIES (not FOLDER AND SEARCH OPTIONS) wont let me unhide the folders. Also on my laptop, it has deleted My Documents, My Pictures, My Music etc files, and the only way I can access them is through AppData (so technically it hasn't deleted them). When I unhide system files and hidden files (through FOLDER AND SEARCH OPTIONS), it shows a bunch of random folders that I have never seen before.

I have tried several anti-virus and anti-malware programs but I will not hesitate to do it again, if that is what I have to do. Hope someone can help get rid of this BOTH on my PC and LAPTOP as well as my HARD-DRIVES and USBs. Thanks!
Click to expand...
C:\users\<your name>\Documents is location of "My documents" . It's not in appdata! Same for my images, my pictures etc.

If you activate "show hidden files" everythings is normal?
really all folders are hidden?
Click to expand...

Yes, thats the folder I meant.

No, I cannot activate "show hidden files" as you can see in the second image.
 

My Computer

OS
Windows 7 Enterprise 32 bit
in command prompt:
Code: 
attrib  j:\cruzer

Is it only hidden? Or also system? You see sometjing like this?
Code: 
   SH        J:\Cruzer
If so check some other folders.
post results
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ACER ASPIRE 5742G
OS
Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Motherboard
Acer Aspire 5742G
Memory
4,00 GB
Graphics Card(s)
ATI Mobility Radeon HD 5400 Series
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
WDC WD5000BEVT-22ZAT0
New Thread

I am going to create a new thread, as I figured out that it wasn't a virus. However, the folders are still hidden. Thanks for all your help :)
 

My Computer

OS
Windows 7 Enterprise 32 bit
rextz101 said:
I am going to create a new thread, as I figured out that it wasn't a virus. However, the folders are still hidden. Thanks for all your help :)
Click to expand...
if you can't change the hidden attribute in windows explorer ... it has the SYSTEM attribute as well. Files and folders aren't hidden without a cause! How cone you're so sure it's not a virus/malware?
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ACER ASPIRE 5742G
OS
Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Motherboard
Acer Aspire 5742G
Memory
4,00 GB
Graphics Card(s)
ATI Mobility Radeon HD 5400 Series
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
WDC WD5000BEVT-22ZAT0

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
ACER ASPIRE 5742G
OS
Microsoft Windows 7 Home Premium 64-bits 7601 Multiprocessor Free Service Pack 1
CPU
Intel(R) Core(TM) i3 CPU M 370 @ 2.40GHz
Motherboard
Acer Aspire 5742G
Memory
4,00 GB
Graphics Card(s)
ATI Mobility Radeon HD 5400 Series
Sound Card
(1) AMD High Definition Audio Device (2) Realtek High Defi
Screen Resolution
1366 x 768 x 32 bits (4294967296 colors) @ 60 Hz
Hard Drives
WDC WD5000BEVT-22ZAT0
Seagate External Hardisk

Hi,

i have a 500gig Seagate External Hardisk. First i had this Recycle Bin virus, and then now my hardisk got a System Volume Information.

When i tried to open my files at my external hardisk, i can't see them. but when i tried scanning the hardisk, the files are there but it doesn't show up when i try to explore them.

How can i retrieve my files and save it to another location?:( and remove all the viruses...
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Compaq
OS
Windows 7 32 bit
Hi angie214,

Welcome to Seven Forums.

I may advise you to start a new thread in the System Security sub-forum giving all details ab-initio, instead of tagging on to a old thread.
 

My Computer

OS
Windows 7 Home Premium 32 bit
Hi,

i have a 500gig Seagate External Hardisk. First i had this Recycle Bin virus, and then now my hardisk got a System Volume Information.

When i tried to open my files at my external hardisk, i can't see them. but when i tried scanning the hardisk, the files are there but it doesn't show up when i try to explore them.

How can i retrieve my files and save it to another location?:( and remove all the viruses...
 

My Computer

Computer type
Laptop
Computer Manufacturer/Model Number
Compaq
OS
Windows 7 32 bit
You must log in or register to reply here.
Back
Top