Secunia CSI7
Advisories
Research
Forums
Create Profile
Our Commitment
PSI
PSI API
CSI
OSI
xSI
Vulnerabilities
Programs
Open Discussions
My Threads
Create Thread
Statistics
About

Forum Thread: Finds files in recycle bin even after emptied.

You are currently viewing a forum thread in the Secunia Community Forum. Please note that opinions expressed here are not of Secunia but solely reflect those of the user who wrote it.

This thread was submitted in the following forum:
PSI 2.0 Beta

This thread has been marked as locked.
mogrith Finds files in recycle bin even after emptied.
Member 6th Oct, 2010 23:36
Ranking: 0
Posts: 2
User Since: 29th Jan, 2008
System Score: 97%
Location: US
Can't seem to tell this thing that oracle client file in recycle bin can be ignored.

I have emptied the bin and rescanned it still wants me to update. But I moved from the 10.x to 11

--
Win 7 ult X64
AMD 64 X2 5600+, 4GB Ram, ATI 4500 series Video

mogs RE: Finds files in recycle bin even after emptied.
Expert Contributor 7th Oct, 2010 07:38
Score: 2265
Posts: 6,266
User Since: 22nd Apr 2009
System Score: 100%
Location: UK
Hello.
What is the path to the vulnerability ?
Click on the + sign alongside the entry, and twice for more information.
Post that info back to the forum if uncertain how to proceed.
It's often useful to include as much info as possible....OS, browser, so on and so forth. If you include those details in your Signature box in "My Profile", on the left of page, it will save you having to repeat them whenever you contact the forum.
Hope this helps........regards,

--
Was this reply relevant?
+1
-0
Seadley RE: Finds files in recycle bin even after emptied.
Member 7th Oct, 2010 12:06
Score: 9
Posts: 33
User Since: 12th Sep 2009
System Score: N/A
Location: US
Not sure if I can jump on this thread as the problem is as described but the program is different. This concerns Adobe Reader 9.3.4

There is nothing in the recycle bin. It is emptied.
PSI 2.0 Beta gives me

C:\$Recycle.Bin\S-1-5-21-1579618400-2839178153-114 2281820-1000\$R0YFW3Y\AcroRd32.exe, version 9.3.4.218

On following the path of this file, I find the following :
Local Disk (C)> $Recycle.Bin> Recycle Bin> $r0yfw3y
There are 42 items in the file.

I have run Windows file cleaner, CCleaner, rescanned, shutdown, rebooted, rescanned and checked the forum.

Any idea how I can get rid of this file ? What is it ? Why won't it go away ?


This is the only file I am having a problem with.
I know there is a 9.4 version of Adobe Reader but I have uninstalled AR from the program file and gone to another reader. I do not wish to return to AR.
The Adobe Reader file on C drive is empty.

PSI 2.0 Beta
W7 Ultimate





--
Secunia 3.0
Windows 7 SP1 64 Bit OS
Dell XPS M1530 Laptop 8GB RAM 128GB SSD
Was this reply relevant?
+0
-0
ddmarshall RE: Finds files in recycle bin even after emptied.
Dedicated Contributor 7th Oct, 2010 13:23
Score: 1210
Posts: 961
User Since: 8th Nov 2008
System Score: 98%
Location: UK
Ensure that you have emptied the recycle bin for all users on your system. If this is not the problem, it is possible your recycle bin has been corrupted. There should be two files in the recycle bin for each deleted file: the one you have specified and another with a similar name except $R is replaced with $I. This file contains metadata for the deleted file.
Instructions for fixing a corrupted recycle bin can be found here:
http://www.vistax64.com/tutorials/131294-recycle-b...

I'd consider this the nuclear option. It's very unlikely that the program could be exploited from this location. You could set up an ignore rule for the recycle bin.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+4
-0
mogrith RE: Finds files in recycle bin even after emptied.
Member 7th Oct, 2010 20:02
Score: 0
Posts: 2
User Since: 29th Jan 2008
System Score: 97%
Location: US
Detected Instances:
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1768\$RVJ2XQM\install\patches\5923165\files \bin\oracle.exe, version 10.2.0.3
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1768\$RVJ2XQM\.patch_storage\5923165_MAR_6_ 2007_16_02_56\original_patch\files\bin\oracle.exe, version 10.2.0.3
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1768\$R2PC36L\install\patches\5923165\files \bin\oracle.exe, version 10.2.0.3
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1768\$R2PC36L\.patch_storage\5923165_MAR_6_ 2007_16_02_56\original_patch\files\bin\oracle.exe, version 10.2.0.3
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1200\$RM7UT84\install\patches\5923165\files \bin\oracle.exe, version 10.2.0.3
C:\$Recycle.Bin\S-1-5-21-160818166-3078681496-3033 544925-1200\$RM7UT84\.patch_storage\5923165_MAR_6_ 2007_16_02_56\original_patch\files\bin\oracle.exe, version 10.2.0.3

No Browser involved. Using standalone beta app.

Files are gone and bin has been emptied. Do I need to check registry for traces of this install?

--
Win 7 ult X64
AMD 64 X2 5600+, 4GB Ram, ATI 4500 series Video
Was this reply relevant?
+0
-0
Seadley RE: Finds files in recycle bin even after emptied.
Member 7th Oct, 2010 20:06
Score: 9
Posts: 33
User Since: 12th Sep 2009
System Score: N/A
Location: US
Thank you once again ddm.
Your advice, as usual, was impeccable.

I used the 'nuclear option' version 2 thru Internet explorer.
I replaced the $Recycle Bin.
The mystery file has gone away.
I have rebooted and rescanned and still the file has not come back.

If I could now just get rid of the Adobe Reader 9.3.4 file on my E drive (E is where I keep my programs) I will be happy.
Interestingly, PSI 2.0 is not picking this up as a problem but the file is there. Any suggestions as to how I can get rid of this ? As it is just taking up room.

In other words how do I delete this without screwing up the system ?
If I try to delete I am told the SYSTEM does not like this.
So I have left it alone.
I have a feeling I need to do something similar to deleting the $Recycle Bin but I do not want to try this without some firm steps to follow.

Your input will be appreciated.

--
Secunia 3.0
Windows 7 SP1 64 Bit OS
Dell XPS M1530 Laptop 8GB RAM 128GB SSD
Was this reply relevant?
+0
-0
Seadley RE: Finds files in recycle bin even after emptied.
Member 7th Oct, 2010 20:21
Score: 9
Posts: 33
User Since: 12th Sep 2009
System Score: N/A
Location: US
@mogrith

Your problem seems the same as mine was - empty recycle bin but Secunia showing $Recycle files, just different programs involved.

I suggest you look at ddmarshall's reply to me.
It works.
Follow the link to see which solution is best for you.

Good luck.

--
Secunia 3.0
Windows 7 SP1 64 Bit OS
Dell XPS M1530 Laptop 8GB RAM 128GB SSD
Was this reply relevant?
+1
-0
ddmarshall RE: Finds files in recycle bin even after emptied.
Dedicated Contributor 7th Oct, 2010 23:41
Score: 1210
Posts: 961
User Since: 8th Nov 2008
System Score: 98%
Location: UK
@Seadley

Is this your Windows 7 Ultimate system? Vista usually allows you to delete from Program Files. It just gives you a lot of confirmation boxes to go through.

If you are getting 'Access denied' messages, you can try taking ownership of the Adobe Reader folder and its contents using the process described here:
http://www.vistax64.com/tutorials/67717-take-owner...

Again, I'd advise caution with this.


--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+1
-0
Seadley RE: Finds files in recycle bin even after emptied.
Member 8th Oct, 2010 11:44
Score: 9
Posts: 33
User Since: 12th Sep 2009
System Score: N/A
Location: US
@ddm

Thanks again for your prompt reply.

I am taking your advice on this and being extremely careful, as I see what you mean about the potential for screwing up the SYSTEM.
As the files are seemingly not active, Secunia is not picking them up and I have plenty of room on the hard drive, I will leave them alone for now.

This ends my part of the thread.

--
Secunia 3.0
Windows 7 SP1 64 Bit OS
Dell XPS M1530 Laptop 8GB RAM 128GB SSD
Was this reply relevant?
+0
-0
Seadley RE: Finds files in recycle bin even after emptied.
Member 8th Oct, 2010 12:29
Score: 9
Posts: 33
User Since: 12th Sep 2009
System Score: N/A
Location: US
@ddm

There is a follow up.

Picking up on your observation W7 allows deletion, I started to delete from the inside out. I have deleted everything from the inside folders except 'identity-H' and 'identity-V'.
The SYSTEM does not want to let go of these two.
Any ideas ?



--
Secunia 3.0
Windows 7 SP1 64 Bit OS
Dell XPS M1530 Laptop 8GB RAM 128GB SSD
Was this reply relevant?
+0
-0
ddmarshall RE: Finds files in recycle bin even after emptied.
Dedicated Contributor 8th Oct, 2010 15:30
Score: 1210
Posts: 961
User Since: 8th Nov 2008
System Score: 98%
Location: UK
@Seadley

I had a look at those files. They are owned by SYSTEM and everybody else is restricted to Read & Execute permissions. So you would need to take ownership of these files and change the permissions for your account to Full Control, as described in the Vista Forums article, in order to delete them.

There are some utilities available that can delete stubborn files. Some of the other Forum users may be able to suggest one.

--
This answer is provided “as-is.” You bear the risk of using it.
Was this reply relevant?
+1
-0

This thread has been marked as locked.


 Products Solutions Customers Partner Resources Company
 
 Corporate
Vulnerability Intelligence Manager (VIM)
Corporate Software Inspector (CSI)
Consumer
Personal Software Inspector (PSI)
Online Software Inspector (OSI)
 Industry
Compliance
Technology
Integration
 Customers
Testimonials
 VARS
MSSP
Technology Partners
References
 Reports
Webinars
Events
 About us
Careers
Memberships
Newsroom


 
© 2002-2014 Secunia ApS - Rued Langgaards Vej 8, 4th floor, DK-2300 Copenhagen, Denmark - +45 7020 5144
Terms & Conditions and Copyright - Privacy - Report Vulnerability - Disclaimer