Solved "$Recycle.Bin" in the Root directory of WD External Hardrive Detected

[Ramen]

*UPDATE" I have added the addtion file.

As it is above, I scanned my External Hard-Drive (the G Drive)
1) Microsoft Security Essential　(Nothing Detected)
2) Adwcleaner (Nothing Detected)
3) FRST scanner, (please see FRST and addtion attached)
4) MCshield (Detects something once in a while)

but Only had results from MCshield that removes the malware,
once in a while. (the patterns are random as I will write below)

1) Safely removing the external hard-drive after MCS's initial scan then connecting it (not found)

2) Restarting the system several days after the intinal after MCS's Initial scan
-in this case, the MCS initial scans will find the .DS_store files again

as for the DS_Store files I sometimes remove those file that I find in a different external hardrives (Drive K) I use with a Mac to transfer .mp3 files (I have the understanding that _DS.Store files are the file that the Mac OS uses for folder locations)

I have found mixed information about the $Recylce.bin files ranging from "its a virus" to "not a virus" but not actually the contents of it (I did a google search but cannot find anything about it)

please enlighten me what exactally are those files doing in my external hardrive (so far not infected my C drive or other External Hardrives)

 

[argus]

Helllo,

Before we begin, please note the following:

• I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
• The logs can take some time to research, so please be patient with me.
• Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
• Instructions that I give are for your system only!
• Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
• Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
• Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

Scan with McSield

Please download McShield by dr_bora and save it to your desktop.

• Install it on your machine.
• It will initially run a scan and show the result as a toaster by the system clock.
• Start the Control Centre by clicking on the
  
  icon in your system tray.
• Go to the Scanner tab and tick unhide items on flash drives.
• Plug in the drive and McShield will start a scan.
• A logfile of this scan may be found in the Logs tab of the main screen.

Please include that log in your next reply.

Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.

​

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
  (XP users click run after receipt of Windows Security Warning - Open File).
• Press the Fix button just once and wait.
• If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
• When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

 

[Ramen]

Sorry, I used the "fix" function without downloading the fixlist provided above.
does that change anything or is it still safe to do the fix function again with the fixlist.txt?

for the while being I will attach the MCShield-All scan (this is because scan I performed as instructed before the fix function did not detect any malwares, I thought it would be helpful to give to the whole list also the .ds_fles change everytime which is confusing)

and the fixlog I got from fixing WITHOUT the fixlist you have provided

 

[argus]

>>> G:\$RECYCLE.BIN\$IC5NZ4X - Malware > Deleted. (14.09.08. 17.31 $IC5NZ4X.642498; MD5: 4342744c5e7c9e0da3b7f37834f7d560)


=> Malicious files   : 1/1 deleted.

Is everything ok now? fixlist is unnecessarily.

 

[Ramen]

I dont think so.. Im just trying to remove the device safely and it is claiming that it's in use
when only I have is the Firefox browser and Tweetdeck (isntalled in the C drive)

and Im not too sure its connected or not but my download list and history from Firefox has been deleted automatically all of the sudden.

 

[argus]

Scan with ComboFix

This is a very powerful tool that should be used only if advised by Malware Analyst.
Do not run ComboFix on your own!

Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

• Right-click on
  
  icon and select
  
  Run as Administrator to start the tool.
• Accept the disclaimer and agree if prompted to install Recovery Console.
• Do not take any actions while ComboFix goes through your System - it may cause it to stall!
• This scan may take some time!
• When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).

Include that log in your next reply.

If you'll encounter any issues with internet connection after running ComboFix, please visit this link.

If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine.

 

[Ramen]

To add this appeared when running the fix.... what is it?

 

[argus]

Run Combofix.

 

[Ramen]

Here is the copy of combofix.
PLease inform me when it is safe to turn MSE back on

 

[Ramen]

Sorry just to add, it was the contets of the $Recycle.bin, not the $Recycle.bin itself.
(please see my MCS-All log for reference)

 

[argus]

Logs doesn't show active infection.

Do this

 

[Ramen]

Okay, i ran cmd as the admin and
taken

"chkdsk"
"chkdsk c:/r" and then "y" to confirm to repair after restart

as insructed in the video, and restarting from the start-menu...
but unlike in the video, it started up to the welcome screen (after the windows logo)
instead of going to the cmd. What is going on?

p.s.
the MCShield did another initinal scan at the restart but did not detect anything
in all of my drives including the one I am having problmew with. Please also tell
me when it is safe to turn MSE back on as I fell unprotected without it.

 

[argus]

the MCShield did another initinal scan at the restart but did not detect anything
in all of my drives including the one I am having problmew with.

Ok, so the HDD clean.

http://windows.microsoft.com/en-us/windows/security-essentials-download

Install MSE now.

 

[Ramen]

I already have MSE on my computer.


Should I uninstall the current one then re-install it as the wizard
suggets? or should I just turn it back on through the settings?


p.s.

furthermore, in the Chkdsk vid you showed me a there was an another user
who also claimed it didnt work.


Here are the steps the How-to-vid guy suggsted in taking.
1. Go to the Start Menu , click 'Computer'.
2. Select and right-click the hard disk drive which you need to check
3. Click Properties from the drop-down menu..
4. Click 'Tools' tab
5. Inder 'Error-checking' option, click 'Check Now'.
6. You will be prompted for an administrator credentials for confirmation. Type in the administrator password or provide confirmation.
7. Select 'Automatically fix file system errors' to automatically repair problems with files and folders that the scan detects.
8. Or else, disk check reports problems but it will not troubleshoot the issue.
9. To perform a disk check, choose 'Scan for and attempt recovery of bad sectors'. This repair physical errors occurred to the hard disk by itself. In order to check for both file errors and physical errors, click both 'Automatically fix file system errors' and 'Scan for and attempt recovery of bad sectors'.
This may take several minutes depending upon the size of the hard disk,. Do not use the PC for any other tasks while it is checking for errors, for best results.

 

[argus]

I already have MSE on my computer.


Should I uninstall the current one then re-install it as the wizard
suggets? or should I just turn it back on through the settings?

Yes. Not working.

 

[Ramen]

So what you inplying by saying "yes"

A)the re-installing
B)Just turning it back on?

Im sorry if I sound patronising (which I dont meant toI just want to make sure Im doing the right thing.)

 

[argus]

 

[Ramen]

Okay, ive re-installed the MSE and updated it. What shoud I do now?
Should I try doing a whole system scan? or just a quick scan?

 

[argus]

How's your computer behaving now?


Startup: C:\Users\Shingo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ニコ生アラート(本家).lnk
ShortcutTarget: ニコ生アラート(本家).lnk -> C:\Program Files (x86)\niwango\ニコ生アラート(本家)\ニコ生アラート(本家).exe ()




What is this? Legitimate or not?

 

[Ramen]

No reports from MCshield (I restarted my Computer after unistalling MSE)
from any of the drives (Including C drive, the problematic G drive or any other my external HDDS as the
USB sticks) so Yeah, not infected now.


Just out of interest could you tell me what was those weird DS_Store files that were in the $recycle.bin folder in
my exterinal HDD...that set off the MCS? I did a google search but all I could find was the "$Recycle.bin" file (not folder) which
was explained to be a torjan horse.