SysChat - How to Remove the Recycler Virus

The Recycler virus is malicious code that originated from the worm W32.Lecna.H. It infiltrates a computer system through the Windows Autorun feature. The virus enters via permanent media, as well as removable devices (including CD-ROMs, DVDs, USB drives, memory sticks, and other devices). The Recycler copies all autorun.inf files on each drive, and duplicates itself onto all active computer drives.

An infection by the Recycler virus results in a hidden folder per active drive. The virus executes itself every time removable media is inserted. The virus alters the System Registry with a batch file and activates itself during start-up. Anti-virus programs may identify the presence of the Recycler virus, although many of these will be unable to eliminate it from the system. The virus is resistant to removable even after formatting of any the removable media.

Upon installation of the Recycler virus, your browser will be redirected to malicious websites, upon which your computer will automatically download additional malicious code. This code will then be able to fleece various private information, including account numbers, credit card data, passwords, social security information, and usernames stored within the system.

Recycler Virus Manual Removal

1. End the Recycler Virus Processes. Press the Ctrl, Alt, and Delete keys simultaneously to access Windows Task Manager. [Ctrl + Alt + Esc] will also allow access to the program. Look for the [ctfmon.exe] process, select it, and choose ‘End Process’.

2. Erase the Recycler Virus Files. Click on the ‘Start’ menu on your desktop and proceed to the ‘Search’ option. Go to ‘For Files and Folders’ and choose the [ctfmon.exe] file. Erase this file.

3. Restart your system in ‘Safe Mode’. Access the command prompt and disable the following folders and files associated with [autorun.inf]:
• Hidden folders
• System folders
• Read-only attributes

4. Change the associated Recycler Virus entries in the Windows Registry. Go to the Windows Registry Editor. Modify the ‘NoDriveTypeAutoRun’ entries which have the ‘03fffffff’ value in these registry folders:
• HKEY_LOCAL_MACHINESOFTWARE
• HKEY_CURRENT_USERSOFTWARE

5. Download any reputable antivirus software. Make sure that the virus database is updated. Reboot your system and do a thorough scan after cleaning up the Recycle Bin.

As always, professionals or users with proficient working knowledge of amending contents of the Windows Registry should undergo manual removal of the Recycler Virus or any malicious code. Any erroneous alterations may result in critical system damage. The best course to resolve this issue is to download, install, and properly utilize a specialized virus removal program.