Files still in C:\RECYCLER that were deleted from Recycle Bin

I was defragging my hard drive and I noticed that some of the files
that it couldn't move were in C:\RECYCLER. Turns out it's two
humongous video files I thought I'd deleted a long time ago, but were
still lingering there along with a bunch of other stuff. I can't get
to the folder in Windows Explorer, and I tried the method at
http://support.microsoft.com/kb/229041 but it didn't work (I'm not
sure if I have the right original directory for that). This is taking
up nearly 3GB. Is there some way to delete them?

The KB article you looked at was for Nt4.0. Try this workaround instead.
Click on "my computer" then click on Tools, Folder Options, tab on View.
Put a button next to Show hidden files and folders, remove checkmarks from
Known file exts, and System hidden files. Click apply and ok. Look for the
\Recycler folder in the root directory of drive C and click on it. You now
should see userSID recycle bin baskets in the \Recycler directory... click
on each of these to see what files are in each one, then delete them
manually.

Reverse the above procedure in folder options/View - to hide files and
folders, known file exts, and System hidden files.

Good luck, if you get stuck holler back

BlastOButter42 <RobertEColgan@gmail.com> wrote:
> I was defragging my hard drive and I noticed that some of the files
> that it couldn't move were in C:\RECYCLER. Turns out it's two
> humongous video files I thought I'd deleted a long time ago, but were
> still lingering there along with a bunch of other stuff. I can't get
> to the folder in Windows Explorer, and I tried the method at
> http://support.microsoft.com/kb/229041 but it didn't work (I'm not
> sure if I have the right original directory for that). This is taking
> up nearly 3GB. Is there some way to delete them?

On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:
> The KB article you looked at was for Nt4.0. Try this workaround instead.
> Click on "my computer" then click on Tools, Folder Options, tab on View.
> Put a button next to Show hidden files and folders, remove checkmarks from
> Known file exts, and System hidden files. Click apply and ok. Look for the
> \Recycler folder in the root directory of drive C and click on it. You now
> should see userSID recycle bin baskets in the \Recycler directory... click
> on each of these to see what files are in each one, then delete them
> manually.
>
> Reverse the above procedure in folder options/View - to hide files and
> folders, known file exts, and System hidden files.
>
> Good luck, if you get stuck holler back
>
> BlastOButter42 <RobertECol...@gmail.com> wrote:
> > I wasdefraggingmy hard drive and I noticed that some of the files
> > that it couldn't move were in C:\RECYCLER. Turns out it's two
> > humongous video files I thought I'd deleted a long time ago, but were
> > still lingering there along with a bunch of other stuff. I can't get
> > to the folder in Windows Explorer, and I tried the method at
> >http://support.microsoft.com/kb/229041but it didn't work (I'm not
> > sure if I have the right original directory for that). This is taking
> > up nearly 3GB. Is there some way to delete them?

Well, that got me ****her than I was before, but in the C:\RECYCLER
folder, I see two directories, each beginning with S-1-5-21- and then
a long string of numbers, but then when I open them up they are empty.
The defrag told me where the files I want to delete are: in one of
them, inside a folder called Dc21, but that folder is nowhere to be
found when opening the S-1-5-21 folders.
Also, if I try to type the directory into the address bar, it keeps
deleting what I type, and if I paste it in it says Cannot find 'file:\\
\C:\RECYCLER\..." etc.

Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
C:\Restore folder in your defrag report message, then Dc21.exe is a
suspected trojan process and the files are super hidden.

You may need to make a post in a hijackthis forum online. The gurus there
will get you cleaned out for sure. By preference - I use the HJT forums at
Bleepingcomputer.com but most all other forums provide the same level of
help.

http://www.bleepingcomputer.com/forums/forum22.html

you'll have to register to post, but its free. Be sure to follow all the
instructions your malware removal advisor gives you.

Good luck.




BlastOButter42 <RobertEColgan@gmail.com> wrote:
> On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:
>> The KB article you looked at was for Nt4.0. Try this workaround instead.
>> Click on "my computer" then click on Tools, Folder Options, tab on View.
>> Put a button next to Show hidden files and folders, remove checkmarks
>> from Known file exts, and System hidden files. Click apply and ok.
>> Look for the \Recycler folder in the root directory of drive C and click
>> on it. You now should see userSID recycle bin baskets in the
>> \Recycler directory... click on each of these to see what files are in
>> each one, then delete them manually.
>>
>> Reverse the above procedure in folder options/View - to hide files and
>> folders, known file exts, and System hidden files.
>>
>> Good luck, if you get stuck holler back
>>
>> BlastOButter42 <RobertECol...@gmail.com> wrote:
>>> I wasdefraggingmy hard drive and I noticed that some of the files
>>> that it couldn't move were in C:\RECYCLER. Turns out it's two
>>> humongous video files I thought I'd deleted a long time ago, but were
>>> still lingering there along with a bunch of other stuff. I can't get
>>> to the folder in Windows Explorer, and I tried the method at
>>> http://support.microsoft.com/kb/229041but it didn't work (I'm not
>>> sure if I have the right original directory for that). This is taking
>>> up nearly 3GB. Is there some way to delete them?
>
> Well, that got me ****her than I was before, but in the C:\RECYCLER
> folder, I see two directories, each beginning with S-1-5-21- and then
> a long string of numbers, but then when I open them up they are empty.
> The defrag told me where the files I want to delete are: in one of
> them, inside a folder called Dc21, but that folder is nowhere to be
> found when opening the S-1-5-21 folders.
> Also, if I try to type the directory into the address bar, it keeps
> deleting what I type, and if I paste it in it says Cannot find 'file:\\
> \C:\RECYCLER\..." etc.

On Jul 17, 1:00 am, "C J." <no.re...@example.invalid> wrote:
> Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
> C:\Restore folder in your defrag report message, then Dc21.exe is a
> suspected trojan process and the files are super hidden.
>
> You may need to make a post in a hijackthis forum online. The gurus there
> will get you cleaned out for sure. By preference - I use the HJT forums at
> Bleepingcomputer.com but most all other forums provide the same level of
> help.
>
> http://www.bleepingcomputer.com/forums/forum22.html
>
> you'll have to register to post, but its free. Be sure to follow all the
> instructions your malware removal advisor gives you.
>
> Good luck.
>
> BlastOButter42<RobertECol...@gmail.com> wrote:
> > On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:
> >> The KB article you looked at was for Nt4.0. Try this workaround instead.
> >> Click on "my computer" then click on Tools, Folder Options, tab on View.
> >> Put a button next to Show hidden files and folders, remove checkmarks
> >> from Known file exts, and System hidden files. Click apply and ok.
> >> Look for the \Recycler folder in the root directory of drive C and click
> >> on it. You now should see userSID recycle bin baskets in the
> >> \Recycler directory... click on each of these to see what files are in
> >> each one, then delete them manually.
>
> >> Reverse the above procedure in folder options/View - to hide files and
> >> folders, known file exts, and System hidden files.
>
> >> Good luck, if you get stuck holler back
>
> >>BlastOButter42<RobertECol...@gmail.com> wrote:
> >>> I wasdefraggingmy hard drive and I noticed that some of the files
> >>> that it couldn't move were in C:\RECYCLER. Turns out it's two
> >>> humongous video files I thought I'd deleted a long time ago, but were
> >>> still lingering there along with a bunch of other stuff. I can't get
> >>> to the folder in Windows Explorer, and I tried the method at
> >>>http://support.microsoft.com/kb/229041butit didn't work (I'm not
> >>> sure if I have the right original directory for that). This is taking
> >>> up nearly 3GB. Is there some way to delete them?
>
> > Well, that got me ****her than I was before, but in the C:\RECYCLER
> > folder, I see two directories, each beginning with S-1-5-21- and then
> > a long string of numbers, but then when I open them up they are empty.
> > The defrag told me where the files I want to delete are: in one of
> > them, inside a folder called Dc21, but that folder is nowhere to be
> > found when opening the S-1-5-21 folders.
> > Also, if I try to type the directory into the address bar, it keeps
> > deleting what I type, and if I paste it in it says Cannot find 'file:\\
> > \C:\RECYCLER\..." etc.

I'm sure the path is correct; I was able to navigate there and see all
the files while running Ubuntu off a CD, but I couldn't delete them.
I don't quite see how this could be a trojan; when I was rooting
around there in Ubuntu I didn't find any files other than old stuff I
thought I'd deleted, and I've never seen anything called dc21.exe.
Should I run a HiJackThis scan?

On Jul 17, 1:00 am, "C J." <no.re...@example.invalid> wrote:
> Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
> C:\Restore folder in your defrag report message, then Dc21.exe is a
> suspected trojan process and the files are super hidden.
>
> You may need to make a post in a hijackthis forum online. The gurus there
> will get you cleaned out for sure. By preference - I use the HJT forums at
> Bleepingcomputer.com but most all other forums provide the same level of
> help.
>
> http://www.bleepingcomputer.com/forums/forum22.html
>
> you'll have to register to post, but its free. Be sure to follow all the
> instructions your malware removal advisor gives you.
>
> Good luck.
>
> BlastOButter42 <RobertECol...@gmail.com> wrote:
> > On Jul 16, 2:56 pm, "C J." <no.re...@example.invalid> wrote:
> >> The KB article you looked at was for Nt4.0. Try this workaround instead.
> >> Click on "my computer" then click on Tools, Folder Options, tab on View.
> >> Put a button next to Show hidden files and folders, remove checkmarks
> >> from Known file exts, and System hidden files. Click apply and ok.
> >> Look for the \Recycler folder in the root directory of drive C and click
> >> on it. You now should see userSID recycle bin baskets in the
> >> \Recycler directory... click on each of these to see what files are in
> >> each one, then delete them manually.
>
> >> Reverse the above procedure in folder options/View - to hide files and
> >> folders, known file exts, and System hidden files.
>
> >> Good luck, if you get stuck holler back
>
> >> BlastOButter42 <RobertECol...@gmail.com> wrote:
> >>> I wasdefraggingmy hard drive and I noticed that some of the files
> >>> that it couldn't move were in C:\RECYCLER. Turns out it's two
> >>> humongous video files I thought I'd deleted a long time ago, but were
> >>> still lingering there along with a bunch of other stuff. I can't get
> >>> to the folder in Windows Explorer, and I tried the method at
> >>>http://support.microsoft.com/kb/229041butit didn't work (I'm not
> >>> sure if I have the right original directory for that). This is taking
> >>> up nearly 3GB. Is there some way to delete them?
>
> > Well, that got me ****her than I was before, but in the C:\RECYCLER
> > folder, I see two directories, each beginning with S-1-5-21- and then
> > a long string of numbers, but then when I open them up they are empty.
> > The defrag told me where the files I want to delete are: in one of
> > them, inside a folder called Dc21, but that folder is nowhere to be
> > found when opening the S-1-5-21 folders.
> > Also, if I try to type the directory into the address bar, it keeps
> > deleting what I type, and if I paste it in it says Cannot find 'file:\\
> > \C:\RECYCLER\..." etc.

I've been able to delete the files using a utility called DelinvFile,
so as far as I know this is resolved. There were many other folders
inside with names beginning with Dc and then 2 digits, so I think the
fact that it had the same name as a trojan was a coincidence. But if
there is any reason that it might not be, please let me know.
Thanks again for your help C.J.