UGN Security
Posted By: Paragon What the...? (Little help please) - 07/02/02 11:37 AM
Um, someone was on my computer and they apparently deleted some stuff because my recycle bin is messed up. The icon shows it has stuff in it, and if I choose empty recycle bin, it says "Are you sure you want to delete these 5 items?" But when I look inside, there's nothing in there! I have it set to show all files, but still, nothing! I tried deleting a shortcut, and it shows up in there, but whatever else is in there doesn't show! Help!
Posted By: SilentRage Re: What the...? (Little help please) - 07/02/02 02:28 PM
I would take a look at the files in the recycle bin in the raw. I have Win2k, so keep that in mind if things aren't the same for you.

# Open up the command prompt, do what I type #

cd C:\RECYCLER
dir /a

# At this point you may see a very long folder #
# name, use the shorthand in order to cd into it #
# dir /a looks at ALL the files in the folder #
# To make this default, enter the following: #
# set DIRCMD=/a #

cd S-1-5-~1
dir /a
notepad desktop.ini
notepad INFO2

# In my empty recycle bin, I have 2 files #
# desktop.ini is in quite a few folders and may #
# not be useful to you - and didn't look special #
# to me. INFO2 however had some UNICODE strings #
# that was very interesting - perhaps some trash #
# left over from previously deleted files - looks#
# like it to me. You may try moving this file #
# somewhere else and see if that solves your #
# problem. For SURE, if there's any other files #
# move them as well. #

attrib -H INFO2
move INFO2 C:\

I noticed that after I did this. a new emtpy INFO2 file was immediately created. Then I deleted something and it didn't show in the recycle bin. do another "DIR" command and you'll see it in there. I simply moved it back out via the command-line and put my original INFO2 back into the folder to fix it. You may have to grab a INFO2 file from another computer to fix your recycle bin. OR, all you have to do is delete any extra files in that folder.

Tell me how things go.

(oh yeah, attrib is a program which changes file attributes. attrib -H <file> and attrib -S <file> and attrib -S -H <file> are all useful implementations of this utility. I had to remove INFO2's hidden attribute before I could move it.)
Posted By: Paragon Re: What the...? (Little help please) - 07/02/02 03:54 PM
Alright, I went to command.com and it showed the info2 file. BTW, I'm on win98.
I moved the file, sent it to the recycle bin, deleted it, and it doesn't seem to care. There's no new one made.
This is quite strange. The icon shows an empty bin. In explorer it says 0 files, and it's set to display ALL files (system and hidden). But when I say empty, it still says "Are you sure you want to delete these 5 items?" If I add another file to the bin the number goes up, etc. It acts just as if there are ultra hidden files in there. WTF?! I tried logging off, rebooting. Still the same.
Posted By: Gremelin Re: What the...? (Little help please) - 07/02/02 04:08 PM
For every hard drive the folder recycled exists. c:\recycled for drive c: Pending delete files are renamed in the recycle bin. For example, DC0.DOC, DC1.DOC, DC2.DOC, ect.. Typically the hidden file INFO2 contains the original name.

::change to c:\recycled
cd \recycled
:: list files
attrib *.*
:: open info2 with edit - to find filenames
edit info2
:: move files from recycle bin
move dc1.doc c:\windows\desktop\OldName.doc

god i'm bored.
Posted By: Paragon Re: What the...? (Little help please) - 07/02/02 04:17 PM
I've already looked in info2, and it's mostly gibberish. And It doesn't say what these 5 files are or why I can't see them.
Posted By: SilentRage Re: What the...? (Little help please) - 07/02/02 10:43 PM
Ok, I just checked out my roommates Win98 laptop. Looks like things are very simple. the INFO2 file exists if there's trash in the bin, but it is deleted if you have no more files. So do this at the command-prompt

attrib -H C:\RECYCLED\*.*
move C:\RECYCLED\desktop.ini C:\desktop2.ini
del C:\RECYCLED\*.*
move C:\desktop2.ini C:\RECYCLED\desktop.ini

And your problems should be solved.
Posted By: Paragon Re: What the...? (Little help please) - 07/03/02 12:23 PM
Actually, I already tried all that, and I don't even have a desktop.ini file in there!
Posted By: SilentRage Re: What the...? (Little help please) - 07/03/02 12:42 PM
You didn't do this command did you...

attrib -H C:\RECYCLED\*.*

that is very very important. While in Win2k, you can see all files by doing a "dir /a", this is NOT the case in Win98. You MUST remove the hidden flag for it to display all (unless the dir command has changed between Win98 and 2k.).
Posted By: Paragon Re: What the...? (Little help please) - 07/03/02 12:49 PM
Yeah, I did.
Posted By: SilentRage Re: What the...? (Little help please) - 07/03/02 06:46 PM
alright, then maybe you STILL can't see it, then I'd shoot in the dark:

notepad C:\RECYCLED\desktop.ini

If THAT doesn't work, then for sure it's not in there. You can type this at the Run prompt if ya want.
Posted By: Paragon Re: What the...? (Little help please) - 07/04/02 02:04 PM
Hmm, that's odd. I already emptied the recycle bin of these invisible items, because I'm about to reinstall windows anyway and I just wanted to see if that would fix the problem (it did). Now I have the desktop.ini file, and no info2.
Wait, didn't you say you only have that when there's stuff in there?
Maybe it was like that because it said there was stuff in there but there wasn't.
Posted By: SilentRage Re: What the...? (Little help please) - 07/04/02 03:09 PM
ya, my guess is that before you had a INFO2 file but no actual files in there. Perhaps that guy who screwed up your computer deleted them manually. Removing the INFO2 file woulda fixed it.
Posted By: Paragon Re: What the...? (Little help please) - 07/04/02 08:47 PM
...The weird thing is, I deleted the info2 file, and it came back exactly the same. And the "problem" was still there.
© UGN Security Forum