Video Screencast Help
Scheduled Maintenance: Symantec Connect is scheduled to be down Saturday, April 19 from 10am to 2pm Pacific Standard Time (GMT: 5pm to 9pm) for server migration and upgrades.
Please accept our apologies in advance for any inconvenience this might cause.

how to remove recyler.exe??

Created: 06 May 2009 • Updated: 22 May 2010 | 22 comments

 This is a very critical virus. Not searching the registy and deleting the entries, or removing the autorun.inf file will work for this. The recycler.exe will still keep running in your system.
Recently I had the same problem but somehow at google, I got a partial solution for recycler virus and still I am not very much satisfied. The reason being this recycler virus is not like any other virus, only one solution is available till now, it is the usage of flash disinfector. Flash disinfector disables the existing autorun virus and avoids the re creation of the same.
Also take care that you don't delete the existing autorun.inf folder because if you delete that, the virus again starts its work. Also, don't format the usb drive.
also it cannot be deal with endpoint protection.....
below its the image of the folder that it made during the process.........
imagebrowser image

Comments 22 CommentsJump to latest comment

pete_4u2002's picture

hi,
you able to find the autorun.inf file which executes the folder to create?

have you scanned the system with the latest virus definition, in safe mode? Submit any suspicious file to the Security response.

Pete

Paul Mapacpac's picture

Hi Owais, based from the screenshot it looks like a folder. Can you include on the screenshot the type column?

First thing to do is to boot from safe mode and run a full scan from there.

Better to inspect running process see if there is any process not familiar to you. Do this also on msconfig, startup and services tab.

Owais's picture

 yup..i hav done the scanning in safe mode.........and this file autorun.inf is present in all folders.......
and i already submitted the case in symantec.......

Owais's picture

 hey guys,
the folder is executable as it follows.exe.........

Paul Mapacpac's picture

I think this happened to me before.. Is Recycler.exe on the processess tab?

Om_123's picture

thanx fr the discussion .I was facing the same problem too.

Owais's picture

hey guys,
below some info
this is his registry entry
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Manager Task C:\RECYCLER\S-1-5-21-1202660629-412668190-725345543-500\smss.exe
file entry
c:\recycler\Taskmgr.exe
SMSS.EXE is processes it made when machine log in......nearly of 94,200 bytes.......

Paul Mapacpac's picture

Hi Owais, can post Loadpoint Diagnostic Tool logs here?

Please check on this website how to obtain it and post the logs here

http://service1.symantec.com/support/ent-security....

sufiyan's picture

 http://spywarefiles.prevx.com/RRCJHJ2508335/RECYCLER.EXE.html

see it can help u out..!!

Owais's picture

 arey above link is jst giving d description of the recycler.exe......and the recommended antivirus on d above link....i already used it.......

Owais's picture

 hey but iam using vista.......ur link is not working........i think so its only for xp and all.....its mentioned

sujay70524's picture

Me to Facing same problem kindly suggest any help

Owais's picture

 hey hii sujay...
wats ur symptoms....

Peter_007's picture

hi sujay

You are running vista or xp

Do the full scan of your system in safe mode

brav's picture

Follow these instructions to remove :

http://threatinfo.trendmicro.com/vinfo/virusencycl...

The virus propagates via removable media or network drives.... if you RDP into a machine that's infected you will pickup the infection.

Disable autorun on your machine and disinfect all removable media .

I submitted the virus files to Symantec in March and the SEP definitions now detect and prevent this virus from spreading

What AV are you using ? and what defs ?

m00

windessy's picture

1) run Process Explorer and kill all suspicious rundll32.exe processes (normally, in most cases it must not be such processes in memory)
2) check services, and disable/stop any named like "autorun" or seemed not must be there
3) download and run w32.downloadup removal tool from symantec site
4) if you make boot scan and there is no viruses, may be there is only traces of them. delete them manually. you can use unlocker tool (google unlocker download)

Невозможно жить в обществе без чёткой цветовой дифференциации штанов (С)

Paul Mapacpac's picture

Were you able to remove the infection just by deleting the file?

kerald salva's picture

im also encountering this kind of prob. can some one help me and make a step by step procedure to removed my recycler virus on my computer, the screenshot was the same to owais prob. pls help me my comp. is windows xp. pls help me...thank you all,.ill wait for your reply on my account...tnx

ShadowsPapa's picture

Are you folks SURE, beyond a doubt, that you are not seeing the NORMAL WINDOWS recycler???!!!
That's your recycle bin!! That screenshot at the top is PART OF WINDOWS!
Recycler is a WINDOWS process.

Be REALLY certain you aren't following bogus advice, like those hoax emails that circulate telling of doom and gloom and that your system is already infected - when in fact it's PART OF WINDOWS............

It's possible a real virus will exist that uses the names of VALID Windows processes to try to fool folks, but too often people see somthing and will believe anything they read on a web site or in an email.

The example in the first screen shot in this thread from May 6th is NOT A VIRUS! The original poster in this thread is showing what is a normal part of Windows.
Someone has UNhidden hidden files and folders in their windows folder settings and is now all excited and concerned.
My advice - rehide the hidden folders and files - hide system files and ignore that.
That's your recycle bin, and recycler is a Windows process. Recycler exists on every Windows XP machine. That folder exists on every Windows XP machine.
BE VERY CAREFUL what you read from non-experts - and verify before removing.
Check where the process resides. Check a new install on a known clean computer and compare. You WILL find recycler.

Jason1222's picture

If you go to c:\recycler does it open up as a folder should?
Like Shadows indicated above, this is part of Normal Windows operating system and is your recycling bin.

I have seen the "Recycler" virus before, and it is always misspelled, generally replacing the C with an S.  Hence you get Resycler...

You don't want to be removing the regular Recycle bin on your system.

You will also find a "Recycler" folder on every drive.

D:\recycler
e:\recycler
etc.

Peterpan's picture

Recycler is a part of windows system, the thing that you will worry about is the recycle.exe, I submitted the file before to symantec security reponse team fortunately they found out the file is a virus, but there is some instances that eventhough my virus def is up to date the file cannot be detected by SEP, I need to submit it again it might be a new variant but seeing the same result.

:-)