C:\resycled\boot.com is not a valid Win32 application

[egohere]

I can't open c: when double click on it but pop up a message
"C:\resycled\boot.com is not a valid Win32 application". Please help.
Empty your recycle bin and try again. Also try right clicking the drive and
select explore.
Neil

Make sure that your anti-malware software is running, then download the
latest signatures and run a full scan.

If you don't have comprehensive anti-malware software, that's like
driving a car without seats belts or air bags. Either way, you're
eventually going to get hammered. Install comprehensive anti-malware
software and learn how to use its features. A 'comprehensive' solution
scans for all types of malicious software in the background, on demand
and on schedule.

For now try scanning your system with /several/ of the better online
scanners, such as:
Kaspersky Antivirus (http://www.kaspersky.com/virusscanner)
Panda ActiveScan (http://www.pandasoftware.com/activescan)

Download HijackThis from www.trendsecure.com. Run it, save a log, and
post the log at one of the many sites that support HJT, such as
spywarewarrior.com, bleepingcomputer.com, and temerc.com -- but not
here. Within a day, sometimes within an hour, you'll have one-on-one
step-by-step advice from a security expert on cleaning up any
infestations—or you'll have a clean bill of health from the volunteer
expert.

Even the best detection and removal software can't fix every malware
infection. If none of the above remove the infection, you may want to
show the computer to a professional.

---
Leonard Grey
Errare Humanum Est

[laurie]

What do you mean exactly by it "didn't do anything"? Any error messages
at the cmd prompt? The commands have to be typed exactly. Is it the
C: drive? If not, you'd need to substitute the C: with whatever drive (letter)
you are having problems with.

To answer your question, yes, if you are getting the message
"C:\resycled\boot.com is not a valid Win32 application", then you apparently
have some sort of infestation.

Open a cmd prompt. Start > Run... [type in] cmd > Ok
At the prompt, enter the following commands:

attrib -h -r -s C:\Autorun.inf

del C:\Autorun.inf

attrib -h -r -s D:\Autorun.inf

del D:\Autorun.inf


etc.


(do this for every drive letter (C: D: E: etc) and do NOT open any drives with
Explorer until you're completed)

I have the same problem exept C: works fine, Its all my other hard drives
that this is happening to.

"Marks" wrote:

> I can't open c: when double click on it but pop up a message
> "C:\resycled\boot.com is not a valid Win32 application". Please help.
> Thanks.
>
>
>

[laurie]

i have read about a system 32 trojan
although system32 is crucial for windows??

[sylv]

I can't open c: , e: ,d: when double click on it but pop up a message
"C:\resycled\boot.com is not a valid Win32 application".
i try to scan with panda internet security,and malware when i double click c: there is no a message C:\resycled\boot.com is not a valid Win32 application
but when i double click d: and e: pop up a message
"C:\resycled\boot.com is not a valid Win32 application".
what should i do?
thx

On Sat, 6 Dec 2008 20:30:07 +0530, sylv wrote in message
<news:sylv.3k06ba@DoNotSpam.com>:

> I can't open c: , e: ,d: when double click on it but pop up a message
> "C:\resycled\boot.com is not a valid Win32 application".
> i try to scan with panda internet security,and malware when i double
> click c: there is no a message C:\resycled\boot.com is not a valid Win32
> application
> but when i double click d: and e: pop up a message
> "C:\resycled\boot.com is not a valid Win32 application".
> what should i do?
> thx

It's a virus, all right (as you might have suspected due to the misspelling
of "recycled").

Start Windows in safe mode, then click Start -> Run. Type in regedit and
click okay.

Now at the top of the registry editor, click Edit -> Find. Type boot.com
and click Find Next. Every time it finds a new boot.com, press the delete
key and then enter. It should find a dozen or so copies.

Now, plug in any external drives or flash drives you have used with this
computer. Open My Computer. Click Tools -> Folder Options -> View and
select "Show Hidden Files and Folders" and click okay.

For each drive, open it and delete the "resycled" folder and autorun.inf.
Back up each autorun.inf before deleting them off external drives, because
they might be important.

Restart the computer and the problem should be gone.

[negims82]

Attribute command of MS-DOS Prompt is a best answer.
See the Posts submitted by Bill Blanton
Post #3 and Post #9

Thanx Bill
It really helped me and worked perfectly.


Other Method as precisely described by Mr. egohere

You should do these steps after a fresh reboot or in safe mode.

1) Navigate to the problem drive(s) via the Explore option.

2) Click on TOOLS -> FOLDER OPTIONS

3) Click the button which says ‘Show hidden files and folders.

4) UNCHECK the following boxes:

Hide extensions for known file types
Hide protected operrating system files

5) Find and delete the autorun.ini file and the resycled folder on the root directory of all affected drives.

6) Check “c:\windows\system32\dllcache” for boot.com file and delete it if present.

7) Check “c:\windows\prefetch” for boot.com file and delete if present.

8) Delete all files from c:\windows\temp

(Some files may not delete, that’s ok, they’re in use by the system and not virus files.)

9) Delete all files from c:\Documents and Settings\[USER PROFILE]\Local Settings\Temp

(Again, a couple files may not delete, don’t worry.)

10) Run Regedit

11) Make sure you are at the very first entry of the registry hive. (y Computer should be hilighted) then click EDIT -> FIND

12) Search for “boot.com”. If it finds an entry, delete it. Keep hitting F3 until you’ve deleted all instances of boot.com in the entire registry.

13) Scroll the left comumn back up to the top and hilight the My Computer again at the top of the registry hive.

14) Click Edit -> Find again and search for ‘resycled’ and repeat as in step 13, deleting the entries as it finds them. (I found 2 of each)

15) Close registry editor and try opening the infected drives. They should work now.

[Hooptie]

negims82: Thank you. I created an account to tell you that. Your compilation of 15 steps that were dead on to correct the problem.

I had tried solutions at a few other sites, but the error was still coming up. All gone now.

Thanks again.

[jackie4]

try PRT , it fixed my probs when i had the Autorun virus

Just run it in safe mode

[eliminator]

hey, i just had this problem, and first i tried the :


attrib -h -r -s C:\Autorun.inf

del C:\Autorun.inf



but that didn't work
so i tried this right afterwards:


attrib -h -r -s C:\resycled\boot.com

del C:\resycled\boot.com

and that worked. . . .

and thanks to all you ppl

[susjoy]

To remove the "resycled" first download "deletedr.exe" software free from the internet. Then,for the drives, which do not open and give the message "\resycled\boot.com is not a valid Win32 application" do the following: double click the icon "deletedr.exe". A window will open. In the "browse" rectangle, write the name of the drive, then slash, and then, resycled, like "F:\resycled" and left click the tab with words "delet file on system restart". A new window will open. Here say "yes". Then restart the windows. After restart,the resycled danger will vanish, and you will be able to open the desired drive. Please note that you will have to first unhide all the folder options, as explained in previous posts. I hope that all the options suggested in this forum, and the option suggested by me will certainly solve the problem.

[judef]

Hello Everyone,
I followed the other method suggested by negims82 and Now i am get this error when i double click the "c:" drive
"the file does not have program associated with it for performing this action. create an association in the folder options control panel"
Any suggestion would be greatly appreciated. thanks in advance.

Regards,
Judef

[Shina]

hi judef,

i think i had the same probs as yours.

"the file does not have program associated with it for performing this action. create an association in the folder options control panel"

all you need is to follow the steps as said in 9th quote.

*the next step further to this i did was...

*clearing the browsing history. goto tools>delete browsing history.

*confirm ones again if no boot.com & resycled are present in the regedit.

close all the programs and then RESTART.

you will be able to open all the drives as b4!!!!

it worked for me.

btw thanks to negims32 for all those guidelines..