Malware in Red found on hard drive

[longbeachlouise]

A malware was found when I ran a scan on a Toshiba hard drive that I shared with a family member. After I got it back, I started a scan, because he backed up his files as he is taking care of his glitching computer, because his fan isn't working.

The last time I ran a malware bytes scan before just now is July 14th, which showed the additional hard drive is clean.

Here is the Custom Scan Results, attached, and the view of the top level folders in the storage.

Why does

Quote

F:\$RECYCLE.BINS

not show up in the folder view?

Should I quarantine the thing? I am waiting to hear from you.

Edited July 22, 2019 by longbeachlouise

[David H. Lipman]

It is not active, it is a file in the Recycle Bin.
Empty the Recycle Bin and its gone.

[longbeachlouise]

Hi David. Thanx for replying. My recycle bin shows empty. His 2nd laptop had games and things in the recyle bin. Even though the SCAN was just on the F drive, are you saying it showed a threat in my Recycle Bin?

[David H. Lipman]

Yes. 

[longbeachlouise]

BTW, should I quarantine the thing? Thanx.

[longbeachlouise]

But my Recycle Bin shows empty!

If you tell me it is my Recycle Bin, I will run a CCleaner. But I don't see anything!

[David H. Lipman]

Connect Drive "F:"  and yes, you can quarantine it or you can empty the "F:" recycle bin.

[longbeachlouise]

The result is from a Toshiba storage connected to the F drive. But, you say it is MY recycle bin.

[David H. Lipman]

Yes.  The Recycle Bin is not a folder that is viewable in Windows Explorer.  It is a "Special" OS Construct.

 

[longbeachlouise]

Okay. Just got your reply . . . May I ask - I must appear dumb to you! - how do I empty the Recycle Bin, when it doesn't show up on Windows Explorer folders?

[longbeachlouise]

How do I empty it?

[longbeachlouise]

13 minutes ago, David H. Lipman said:

Connect Drive "F:"  and yes, you can quarantine it or you can empty the "F:" recycle bin.

Sorry if I do not understand. How do I empty the "F:" recycle bin?

[longbeachlouise]

It is plugged in, the storage hard drive into the, "F:" drive. You see the top level files from the screen image I uploaded. I am waiting for your instructions.

[David H. Lipman]

The "F:" drive is the " Toshiba hard drive " you indicated you scanned.

The Recycle Bin will be an Icon on your Desktop    <=== This shows it has items in the Recycle Bin. 

This shows I have emptied it ==>

https://support.microsoft.com/en-us/help/15057/windows-show-hide-recycle-bin

Once it is on the Windows Desktop, Right-Click on the Recycle Bin icon and choose "Empty Recycle Bin"

 

Edited July 22, 2019 by David H. Lipman
Edited for content, clarity, spelling and grammar

[longbeachlouise]

Okay, I will do that. Already have the recycle Bin icon on my desktop, and it showed empty before and after the SCAN. Here is a desktop view, and the recycle bin is on the upper left.

Edited July 22, 2019 by longbeachlouise
fixed uploaded image.

[longbeachlouise]

I just tried the command, Empty Recycle Bin from the pull-down menu on my desktop, and it is not clickable. I try to click it, and nothing.

[longbeachlouise]

Is there a way I can make the Recycle Bin on the "F:" drive visible?

[longbeachlouise]

Just to recap, I did a custom scan on ONLY the "F:" drive.

The malware showed up as an "F:\$RECYCLE.BIN" file in the results of the scan.

The Toshiba storage device is plugged into the "F:" drive right now, and clicking Empty Recycle Bin on my desktop doesn't generate a click. The option is not clickable!

[David H. Lipman]

No.  It is best to leave as-is. As noted it is a special OS construct.  If the Recycle Bin shows empty, perhaps MBAM has already moved the item into Quarantine.  If you still have that report, go ahead and choose "Quarantine Selected".

 

[longbeachlouise]

Okay. I just selected, Quarantine Selected.

[longbeachlouise]

Now, it says this, attached.

 

I can't believe it! I have to restart MY computer for this item to finish deleting? It was never ON my computer.

Please reply before I reboot my computer. This doesn't make sense to me.

[David H. Lipman]

You don't have to reboot.  Not for this.  Like I said, it is not active.

[longbeachlouise]

Okay, this is what it is saying.

You said it is not active. As long as it isn't a replicating thing designed to thwart Malwarebytes, which could be activated later, it is okay . . .

[David H. Lipman]

Yes.

[Porthos]

Malwarebytes will continue to bug you about restarting if you dont restart either now or later.