Recycler Virus AKA BV:Autorun-G [Wrm]

Recently I have had problems when plugging in removable USB devices into my computer. Immediately my Avast 4.8 Home Edition detected a virus saying that it was "BV:Autorun-G [Wrm]". I am running Windows XP Professional SP 3.

I looked on other forums/blogs/etc. and they usually suggested things like Disk Disinfector or Flash Disinfector and other types of Removable scanners, but they didn't remove the problem just deactivated it it seemed like. I also saw some other topics regarding this, however I wanted help specifically to my computer and I didn't want to do anything manually without proper instruction.

I tried running MalwareBytes and AVG in safe mode, and activated all hidden/operating system folders in the folder options and saw RECYCLER and System Volume Information in my C: drive. Recycler was present in my removable disk drives and D: drive as well.

While Avast and MalwareBytes says they removed the infected files, they are all still there and Avast, AVG have not detected it after that. (I ran AVG on it and uninstalled it when I read that it may get rid of it instead of Avast, however AVG didn't detect anything.) Whenever I unplug and replug a flashdrive it doesn't display the autorun virus indication anymore, but the Recycler folder is still there. I'm guessing the registry keys are there as well but I don't want to do anything with that yet. CCleaner was run and it didn't clean anything regarding this either. Despite this, I want to make sure that there's no traces of malware left on my computer.

Is there a way to get rid of this worm once and for all? It seems to replicate itself and continue to infect other USB removable devices since it's on my computer itself.

If there's any information that I need to post, please let me know. Thanks.

Hey,
I saw your post, and since I am not a "expert" in the sense of the word that is meant here, I can at least tell you some things that I've noticed in my own computing experiences. First and foremost, the "recycler" folder is a normal folder on all drives. It is most common on fixed drives such as your main internal hard drive and any other external drives you have plugged in to the computer. You may even see it if you have a sandisc cruiser with U3 configured to start as well. I have two hard drives and two flash drives (both with the U3 launchpad configured), and I see this folder on them all. The thing you need to make sure of is that the threat within the folder, not the folder itself, is gone. In fact, since you have to enable show protected system files and folders, you should automatically assume that if you can't see the folder without that configuration, that it is a very important one.

Regards,
Chromebuster

Edited by chromebuster, 23 May 2010 - 01:06 PM.

Hey Chrome,

Thanks for the response. I do infact use U3 SanDisk Cruzer on 1 of my USB flashdrives. I also however, use a Signature MicroMini External Hardrive as well, which has the Recycler folder. I checked inside the folders and they do have a recycle bin icon in there, but nothing in them. This did not change when Avast did go off and found viruses whenever I plugged them in. So I can't be certain if the infected files were deleted or not. Also in my C and D drive for my HDD, they also have the folders as well. I don't know if the contents within them that contain the malicious scripts are gone since I didn't really notice anything different from when it first appeared.


To be on the safe side, I would like someone to take a look at my Hijack log or whatever log file that they wish to see to make sure that there are no traces of it or any other problems they can find.

Thanks again.

Edited by missingmodule, 23 May 2010 - 01:17 PM.

Not a problem at all! Just one thing to remember, did you check the Avast log? That can usually tell you what it did with the infected files, like if they were repaired, deleted, or restored after repair or something like that. if you feel more comfortable, you can go to the virus, trojan, and malware removal logs and follow the steps in the preparation guide to prepare a DDs log. That might help some folks, but you are freely allowed to post logs from conventional tools such as Avast or AVG here if you want and maybe someone will be able to clear you from here if it's nothing major, especially if it is nothing at all at this point. It looks to me as if this were just some really weird thing that is here for a moment then gone the next as was the situation with me last week. And one peace of advice. Since you can only use one antivirus, I'd recommend Avast over AVG since AVG is only popular due to their products and not due to their reputation. They can't clean out a darn thing. I'll give you an example of something that happened to me. My teacher sent me a file of some assignment she needed from me. AVG took the file claiming that it was infected with W97M/Marker, which it was, but unlike programs like Avast, NOD32 (what I use), or Kaspersky, AVG couldn't disinfect the file from the dang macro! all it knew how to do was take it and delete it. Avast can clean those things out in a flash and so can NOD32. Now you're probably wondering how the heck such an ancient virus was present in 46 files from that drive the file was sent from. wel, that is because they're making a comeback through Macs that do not have the latest version of office for Mac installed. Well anyway, sorry for the long explanation and story, but I think you should now see the truth of the matter in terms of AVG.

Let me know if there's anything else I can do,
Chromebuster

Edited by chromebuster, 23 May 2010 - 03:05 PM.

Hello can we see an MBam log,please.


Rerun MBAM (MalwareBytes) like this:

Open MBAM in normal mode and click Update tab, select Check for Updates,when done
click Scanner tab,select Quick scan and scan (normal mode).
After scan click Remove Selected, Post new scan log and Reboot into normal mode.

As far as Avast goes, I deleted the files but it kept replicating itself and popping up the same message. I tried it with mbam and it also removed the files in safe mode, but they both weren't able to find it before which is why I want to be sure.

Here's the MalwareBytes log:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4135

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

5/23/2010 8:53:40 PM
mbam-log-2010-05-23 (20-53-40).txt

Scan type: Quick scan
Objects scanned: 142683
Time elapsed: 8 minute(s), 48 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


------

Let me know if you need to see anything else. Thanks.

Edited by missingmodule, 23 May 2010 - 08:01 PM.

Hi, Ok I don't see recycler here. As that file can be an ominous sign we may as well get to the DDS log. We don't use HJT much any more. So do this.
We need a deeper look. Please go here....
Preparation Guide ,do steps 6 - 9.

Create a DDS log and post it in the new topic explained in step 9,which is here Virus, Trojan, Spyware, and Malware Removal Logs and not in this topic,thanks.
If Gmer won't run,skip it and move on.
Let me know if that went well.

You may now need to reformat that Flash Drive let me know if you need help with that here.

Hey, I was able to get the DDS logs, and ran DeFogger, but as far as GMER I couldn't save anything. It kept giving me errors like "Notification Wnd for RNAdmin", "insufficient resources required to run GMER", end program not responding errors with "wscntfy.exe" and "explorer.exe". I had to hardboot and restart my computer manually several times which I knew wasn't good because it made windows explorer very unresponsive. Even pressing ctrl alt del for the task manager to come up and restarting wasn't working, the screen would just sit there, and I could only move my mouse around.

Going to the start menu and trying to see the programs only pulled up empty or even clicking on anything resulted in nothing either. I don't know if that would qualify as crashing but it definitely didn't respond at all.

Here's the link to the topic that I made with the logs: http://www.bleepingcomputer.com/forums/t/318807/bvautorun-g-wrm-recycler-virus/



I also noticed that my windows startup sound would have a slight delay when starting up. my desktop would fully load all my icons before it made the sound. I tried msconfiging and removing unnecessary startups too but it still does that. Any ideas?

Thanks.

This looks good. we will handle this now there.

Now that your log is properly posted, you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a Malware Removal Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show it the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the Malware Removal Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the Malware Removal Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the Malware Removal Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

To avoid confusion, I am closing this topic.