Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is some malware process which is writing the folder $RECYCLE.BIN to every drive in my system. How can I find out which process is doing that. Is there a sysinternals tool? i'm pretty sure of some virus activity

share|improve this question

The procmon utility will do what you're looking for, but if the virus writer is any good at what they do it won't catch it. If there is a rootkit on that system (very likely) then it is most assuredly hiding the virus processes from the Windows environment.

However, it's still worth a shot.

share|improve this answer
Another great, but young, tool: APIMonitor. He might also want to consider RootkitRevealer, since it sounds like something that will interest him. – songei2f Feb 11 '11 at 15:07

I could be wrong, but "%Recycle.bin" is actually a legitimate Windows folder. It's literally where the "Recycle Bin" goes (each drive has an individual one). If you disable the "Hide Protected Operating System Files (Recommended)" under Tools>Folder Options>View you can see these. So the malicious process your speaking of is a little program called Microsoft Windows 7. :D

Edit:any Windows user should be able to un check that box and see these files Another thing you can do to test though is Right click on the $Recycle.bin folder and go to properties Note its size delete something large(obviously a copy of it would be better you don't want to delete anything important!) Check the properties again, it should be larger(the size of whatever you deleted larger to be exact

share|improve this answer
Like @Topherhead said, I have lots of USB keys. I notice every time I mount them in Debian, Mac OS X, what have you (which is often) the folder is repopulated. This is because Windows needs to. The other common one you will see is System Volume Information, which is related to Restore Points and meta-data apparently. – songei2f Feb 11 '11 at 15:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.