(Computers Group) Talk about computers here. Mods - CreateAMuck(FP #110) You must be a member of this group to post here. You must have a member level of 1 or greater to post new topics here and a level of 1 to post replies.
Normal Egg
Member Lvl: 9
Egg Points: 5659
Posts: 1968
Posted: Nov 12, 2005 11:07 a.m. - Subject: The strange and twisted tale of the
Yesterday Norton Antivirus found some adware on my C: drive. Here’s a brief synopsis of my ordeal trying to delete these two folders that had been created on my computer hard drive.
(P.S., if you really want to keep your hard drive clean and running good-- DON’T DOWNLOAD PORN. I almost never do but I have a couple of times over the last couple of weeks, and that’s when the problem started! If you want porn, your local adult store usually has a "ten vids for five dollars" deal going-- and if you are underage just ask a street legal friend to buy them for you. It’s much less expensive in the long run, believe me!)
Anyway, whenever Norton tells me I have a bad file, the first thing I do is copy and paste the problem file names into a MSWord document:
---
The file C:RECYCLERS-1-5-21-xxxxx8172-774573769-2841603515-1006Dc10.xml is a Adware threat.
The file C:RECYCLERS-1-5-21-xxx5438172-774573769-2841603515-1006Dc7.dll is a Adware threat. ---
It’s just easier that way, because I know that most of the time when I tell Norton to delete those files, it will say "deletion failed".
Next I do a Windows search for those files and the folder they are in. Nine times out of ten the search will come up empty. That is because when the adware is installing itself it will often have attributes attached-- it will be identified as a "system file" or "hidden file", for instance. You can set your Windows search to look for hidden files, but if the files are attrib’ed as "system" then you will still not find anything.
By using WordPerfect search I did find the folder called "recycler", BUT I could still not see what was in it.
Then I went to the Windows "command prompt" accessory and navigated to the "C:RECYCLER" folder. This is a hidden/system folder so I had to remove those attributes to be able to see it and its contents, see below.
-----
C:Documents and Settingslalala>cd c:recycler
C:RECYCLER>dir /a:h (telling it to show me all the hidden files in that directory) Volume in drive C has no label.
Volume Serial Number is 9xxxx-EDF5
0 File(s) 0 bytes
4 Dir(s) 86,871,269,376 bytes free
----
So you will notice that the two folders that Norton identified as adware do show when I type in "dir" with the /h switch.
Now when I started out with this I had no idea what the folder "C:RECYCLER" was for. I did not assume that it was for "trash" files (but that’s what it ended up being). I don’t like to assume things when I am deleting files/folders, that can cause a messy problem. To make sure that I was not deleting needed system files, I then went on Google and looked up "recycler folder". (As with any search, if you start off spelling the name of the search item correctly it will save you lots of time and hassle.)
I found the following useful information:
---
BTW the recycle bin it self is empty, I don’t have Norton recycle bin.
It could be that your RECYCLER folder is infected with adware or malware. The RECYCLER folder is associated to the recycle bin. First, make sure that the recycle bin is empty (do that for each registered user in your computer).There is one directory in the recycler folder for each registered user. Once the recycle bins are empty, the legitimiate directories should be empty as well. If you still have a directory with data, it is probably adware. You can remove the contents mannually, by going to the command prompt, navigating to c:RECYCLER and then using rmdir/s directory_name to delete the directory in question. ---
Don’t you just love the internet?
Anyway, I followed the instructions of emptying ALL the trash bins on my hard drive, including "Norton protected files". I looked at the trash contents first to make sure that I was not permanently deleting anything that I wanted to keep.
When I went back under "command prompt" I found it was a nuisance that I still could not see the recycler folder or its contents because they had attributes attached to them.
I removed all the attributes from those files and folders; see below. NOTE: DO NOT REMOVE ATTRIBUTES ON FILES AND FOLDERS USING "COMMAND PROMPT" UNLESS YOU ARE THE SOLE USER OF THAT COMPUTER, AND/OR YOU KNOW WHAT YOU ARE DOING! Also, DO NOT DELETE THE "RECYCLER FOLDER". Your system needs it so that you can unerase files that were accidentally deleted, and its absence might cause system failure, or at the very least problems at startup/shutdown.
If you want to remove or add attributes, here’s how:
---
C:RECYCLER>attrib/?
Displays or changes file attributes.
+ Sets an attribute.
- Clears an attribute.
R Read-only file attribute.
A Archive file attribute.
S System file attribute.
H Hidden file attribute.
[drive:][path][filename]
Specifies a file or files for attrib to process.
/S Processes matching files in the current folder
and all subfolders.
/D Processes folders as well.
---
This is a very handy feature, but again-- you can fuck your OS up badly by changing attributes if you are not sure what you’re doing. That’s why I always do a search BEFORE I change attributes on a file or folder.
Ok, so the trash had been emptied but those adware directories were still there.
I tried a "delete" command ("del c:recyclers*.*"-- "s" because that’s the common character starting both those adware folder names) but it returned the message "file not found". (%^##@*&*@!!!!!)
I removed the attributes from the folders and use the "rd" (remove directory) command to get rid of the adware directories in my recycler folder. Again, "remove directory" is a risky undertaking and you should only do that if all else has failed!
Once I had done that, my recycler folder was clean. I scanned just that folder with Norton Antivirus and it told me there were no longer any infected files.
I note that now when I search for files/folders called "recycler" it DOES show that folder because I removed its "hidden" and "system" attributes. This has not seemed to cause a problem yet, but eventually I’ll probably restore those attributes so that someone casually searching my computer won’t stumble across my deleted files-- thinking about my b/f here who is due to get out of prison in February.
Normal Egg
Member Lvl: 9
Egg Points: 5659
Posts: 1968
Posted: Nov 12, 2005 11:53 a.m. - Subject:
Is what a pirated version of Norton? You mean my antivirus program, or what?
Posted: Nov 14, 2005 5:26 p.m. - Subject:
Ignore TIMS, he is testing to see if you’re a software pirate.
----------------------------------------------------------------------------------------
I had a similar problem with adware that was inside a .zip file and Norton couldn’t rid my PC of it, I finally deleted it manually. It was a WAY easier to fix than what YOU went through!
I probably would have just reformated the damn thing and started over ’cause I doubt I would have had the patience and the fortitude to work that hard to fix it!!
Me lazy. Format easy.
Normal Egg
Member Lvl: 5
Egg Points: 1243
Posts: 7 AIM
Posted: Dec 06, 2005 5:44 p.m. - Subject:
Norton? pshh dont use that poo
Posted: Dec 17, 2005 12:07 p.m. - Subject:
How, do you figure MoNkEySpEeD? Norton makes some of the best apps going! I think too many people think that these apps are PERFECT, well they’re not! You and many others expect too much from the likes of Norton Anti-Virus and apps like this, you STILL must realise that the people who MAKE the viruses and stuff are ALWAYS going to be ahead of the people who combat them, just because it takes time to come up with a "cure".
There are others just as good, but none are BETTER than Norton.
