Files still in C:\RECYCLER that were deleted from Recycle Bin

[BlastOButter42]

I was defragging my hard drive and I noticed that some of the files
that it couldn't move were in C:\RECYCLER. Turns out it's two
humongous video files I thought I'd deleted a long time ago, but were
still lingering there along with a bunch of other stuff. I can't get
to the folder in Windows Explorer, and I tried the method at
http://support.microsoft.com/kb/229041 but it didn't work (I'm not
sure if I have the right original directory for that). This is taking
up nearly 3GB. Is there some way to delete them?

 

[C J.]

The KB article you looked at was for Nt4.0. Try this workaround instead.
Click on "my computer" then click on Tools, Folder Options, tab on View.
Put a button next to Show hidden files and folders, remove checkmarks from
Known file exts, and System hidden files. Click apply and ok. Look for the
\Recycler folder in the root directory of drive C and click on it. You now
should see userSID recycle bin baskets in the \Recycler directory... click
on each of these to see what files are in each one, then delete them
manually.

Reverse the above procedure in folder options/View - to hide files and
folders, known file exts, and System hidden files.

Good luck, if you get stuck holler back

 

[BlastOButter42]

The KB article you looked at was for Nt4.0. Try this workaround instead.
Click on "my computer" then click on Tools, Folder Options, tab on View.
Put a button next to Show hidden files and folders, remove checkmarks from
Known file exts, and System hidden files. Click apply and ok. Look for the
\Recycler folder in the root directory of drive C and click on it. You now
should see userSID recycle bin baskets in the \Recycler directory... click
on each of these to see what files are in each one, then delete them
manually.

Reverse the above procedure in folder options/View - to hide files and
folders, known file exts, and System hidden files.

Good luck, if you get stuck holler back

Well, that got me farther than I was before, but in the C:\RECYCLER
folder, I see two directories, each beginning with S-1-5-21- and then
a long string of numbers, but then when I open them up they are empty.
The defrag told me where the files I want to delete are: in one of
them, inside a folder called Dc21, but that folder is nowhere to be
found when opening the S-1-5-21 folders.
Also, if I try to type the directory into the address bar, it keeps
deleting what I type, and if I paste it in it says Cannot find 'file:\\
\C:\RECYCLER\..." etc.

 

[C J.]

Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
C:\Restore folder in your defrag report message, then Dc21.exe is a
suspected trojan process and the files are super hidden.

You may need to make a post in a hijackthis forum online. The gurus there
will get you cleaned out for sure. By preference - I use the HJT forums at
Bleepingcomputer.com but most all other forums provide the same level of
help.

http://www.bleepingcomputer.com/forums/forum22.html

you'll have to register to post, but its free. Be sure to follow all the
instructions your malware removal advisor gives you.

Good luck.

 

[BlastOButter42]

Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
C:\Restore folder in your defrag report message, then Dc21.exe is a
suspected trojan process and the files are super hidden.

You may need to make a post in a hijackthis forum online. The gurus there
will get you cleaned out for sure. By preference - I use the HJT forums at
Bleepingcomputer.com but most all other forums provide the same level of
help.

http://www.bleepingcomputer.com/forums/forum22.html

you'll have to register to post, but its free. Be sure to follow all the
instructions your malware removal advisor gives you.

Good luck.

I'm sure the path is correct; I was able to navigate there and see all
the files while running Ubuntu off a CD, but I couldn't delete them.
I don't quite see how this could be a trojan; when I was rooting
around there in Ubuntu I didn't find any files other than old stuff I
thought I'd deleted, and I've never seen anything called dc21.exe.
Should I run a HiJackThis scan?

 

[BlastOButter42]

Hmm if you are sure Dc21 is being seen in C:\Recycler folder and not the
C:\Restore folder in your defrag report message, then Dc21.exe is a
suspected trojan process and the files are super hidden.

You may need to make a post in a hijackthis forum online. The gurus there
will get you cleaned out for sure. By preference - I use the HJT forums at
Bleepingcomputer.com but most all other forums provide the same level of
help.

http://www.bleepingcomputer.com/forums/forum22.html

you'll have to register to post, but its free. Be sure to follow all the
instructions your malware removal advisor gives you.

Good luck.

I've been able to delete the files using a utility called DelinvFile,
so as far as I know this is resolved. There were many other folders
inside with names beginning with Dc and then 2 digits, so I think the
fact that it had the same name as a trojan was a coincidence. But if
there is any reason that it might not be, please let me know.
Thanks again for your help C.J.