Hi Friends, I did a Google search on recycler and found the following . Recycler is a virus which spreads through our Pen drive. I am pasting the info , below:
The virus drops the following files into the flash drive (thumb drive or usb drive) List of 3 items . autorun.inf . RECYCLER\desktop.ini . UcHelp.exe list end The easiest way to remove the virus is to format the USB drive. However if the computer has contacted the virus, then you may have to use the procedure outlined below to remove it. If not, it will start spreading to other USB drive that is plug into the infected computer. To remove the trojan, you need to download PSKILL utility, see below. pskill -t explorer.exe attrib -s -h c: \ windows \ system32 \ AceExt32.dll attrib -s -h "c: \ windows \ Downloaded Program Files \ Ext32.dat" attrib -s -h "c: \ windows \ Downloaded Program Files \ Ext32.dll" attrib -s -h "c: \ windows \ Downloaded Program Files \ CxUSBKey.exe" attrib -s -h "c: \ windows \ Downloaded Program Files \ ZipExt32.dll" del "c: \ windows \ system32 \ AceExt32.dll" del "c: \ windows \ Downloaded Program Files \ Ext32.dat" del "c: \ windows \ Downloaded Program Files \ Ext32.dll" del "c: \ windows \ Downloaded Program Files \ CxUSBKey.exe" del "c: \ windows \ Downloaded Program Files \ ZipExt32.dll" start explorer.exe reg delete HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ ShellServiceObjectDelayLoad / v ZipExt32 / f reg delete HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ ShellServiceObjectDelayLoad / v AceExt32 / f reg delete HKEY_CLASSES_ROOT \ CLSID \ {35CEC8A3-2BE6-11D2-8773-92E220524140} / f reg delete HKEY_CLASSES_ROOT \ CLSID \ {35CEC8A3-2BE6-11D2-8773-92E220524150} / f --- Remove Uchelp.exe on the flash drive (thumb drive): List of 2 items . Attrib -s -h \RECYCLER\Uchelp.exe . Del Uchelp.exe list end --- PsTools Version in this package: 2.43. PsKill works on NT 4 and higher including Windows Vista. Download PsTools The PsTools kit's PSKILL utility can terminate processes on the local computer and processes on remote systems. Running PsKill with a process ID directs it to kill the process of that ID on the local computer. If you specify a process name PsKill will kill all processes that have that name. Now my system is infected ., but I could not understand the removal procedure . If any one can make out from the info , , please, guide me. Thanks in advance. In a day, when you don't come across any problems, -you can be sure that you are travelling in the wrong path -. . SWAMI - VIVEKANANDHA . ----- Original Message ----- From: "Abdul Razique Khan" <[EMAIL PROTECTED]> To: <accessindia@accessindia.org.in> Sent: Tuesday, August 07, 2007 7:52 PM Subject: Re: [AI] recycler > Hello my friend, > You can't delete this file because as the name suggests it will > produce anotherr file of the same sort. > If I am not wrong, this virus creates a folder in every folder of the > parent folder's name. Even if you delete those folers, it will > reproduce another one. > > Thanks, > Abdul > > To unsubscribe send a message to [EMAIL PROTECTED] > with the subject unsubscribe. > > To change your subscription to digest mode or make any other changes, > please visit the list home page at > http://accessindia.org.in/mailman/listinfo/accessindia_accessindia.org.in > To unsubscribe send a message to [EMAIL PROTECTED] with the subject unsubscribe. To change your subscription to digest mode or make any other changes, please visit the list home page at http://accessindia.org.in/mailman/listinfo/accessindia_accessindia.org.in