Did you notice that the Recycler and System Volume Information folder will appear at the root of your C: drive once you uncheck “Hide protected operating system files” from Folder Options?
So what is Recycler and System Volume Information all about? Why do I get the error message “C:\System Volume Information is not accessible. Access is denied” when I tried to access System Volume Information folder?
My anti-virus detected virus in System Volume Information but was unable to remove the virus. How to manually access System Volume Information folder and delete the virus?
What about the Recycler folder? What is the difference between Recycle Bin and Recycler? Is it safe to delete the Recycler folder? Actually I noticed these 2 folders long time ago but I didn’t care about it because I “assumed” that it belonged to Windows. Today I had a little bit of free time and I decided to check it out.
The System Volume Information folder is a hidden system folder that the System Restore tool uses to store its information and restore points. There is a System Volume Information folder on every partition on your computer. Quite often virus are found in System Volume Information folder because Windows has included the virus into a System Restore Point when it creates one. Problem is anti-virus scanner can’t access the folder. What you need to do is to give permission to the current logged on user full access to System Volume Information folder. Here is how you can gain access to System Volume Information folder if you’re using Windows XP.
1. Go to Control Panel -> Folder Options
2. Go to View tab, UNCHECK “Use simple file sharing“.
3. Open My Computer and go to your C:\ drive, right click on System Volume Information and select Properties.
4. Click the Security tab.
5. Click Add and then type the name of the user to whom you want to give access to the folder. Typically, this is the account with which you are logged on. Click OK, and then click OK again. You can now access the System Volume Information folder. Run a full scan with your anti-virus scanner, this time it should be able to remove viruses found in System Volume Information folder.
To access System Volume Information in Windows Vista, you have to take ownership.
1. Open My Computer and go to your C:\ drive, right click on System Volume Information and select Properties.
2. Click the Security tab.
3. Click Advanced button where it says For special permissions or advanced settings, click Advanced.
4. Click the Owner tab.
5. Click the Edit button.
6. CHECK “Replace owner on subcontainers and objects” and click OK.
You will get a Windows security warning that says “If you have just taken ownership of this objectm, you will need to close and reopen this object’s properties before you can view or change permissions. You should be able to access System Volume information in Vista.
Another method to remove the virus in System Volume Information by turning off System Restore. It will remove all your restore points. After turning System Restore off, restart your computer and then re-enable back the System Restore. It will create a new and good restore point without the virus. By default, System Restore is automatically turned on and you can turn it off from:
1. Go to Control Panel -> System
2. Click the System Restore tab.
3. Check “Turn off System Restore” and click OK.
Next is the Recycler folder. When you delete a file in Windows NT Explorer or My Computer, the file is stored in the Recycle Bin. The file remains in the Recycle Bin until you empty the Recycle Bin or restore the file. The Recycler folder is used only on NTFS partitions. The Recycler folder contains a Recycle Bin for each user that logs on to the computer, sorted by their security identifier (SID). It is safe to delete files inside the Recycler folder. Even if you delete the Recycler folder, it will be re-created once you delete a file.
If you’re unable to delete files inside the Recycle folder, you can use The Unlocker to unlock files that are being used.
In short, it is safe to delete files in Recycler folder but as for System Volume Information, in my opinion, it’s best you leave it as it is.
Related posts:
can we perform this sort of operations on window 7 regarding system volume information and recycler folder.
my pc have viruse recycler &system information
please help me.
About Recycler and System Volume Information Folder in XP and Vista All well and fine “if” the user has a folder listed in the ‘view’ tab, ref. “use simple file sharing”. But what about those of us who don’t find that tick box? I suppose the fact that in my case, the folder’s ‘security[ tab is missing has something to do with it, but I’ve tried enabling file sharing (thinking that since I never did, maybe that’s why the tab and the tick box are missing, but still no soap. Plus I even tried taking ownership of the external hard drives folder (which I dealing with in this scenario) and while I got it to list ‘everybody’ as full control, it ticks as full control but the process balks at X:\Recycle.Bin and X:\Recycler\S-1-blah-blah-blah file. And the ‘owner’ file permissions are pretty much all unticked, ie; no permissions. So now I’m left to trying to deal with this EHD’s permissions while using my W7 machine and still no soap. I can access the EHD’s files, that’s not the issue. The issue is I’m trying to follow steps to run a small program that fixes aberrantly named shortcuts, ie; thousands of them pointing to various (all wrong drive letters) caused by MS’s lack of affording users the right/ability to permanantly drive letter ‘our’ EHD’s, ie; and ‘we’ eventually find shortcuts pointing to whatever drive letter the damned machine chose to assign it whenwe had the EHD connected.
Hi Raymond,
I followed all the step suggested by you but the folder keeps recreating itself. If I delete these folders from one partition using ‘unlocker’ it recreates itself on a different partition immediately.
I am using Win XP SP3 Pro and it dual boots with linux on second HD.
In windows my recycle bin is disabled and the system restore service is disabled. Autorun.inf is disabled.
I started the comp in Linux and deleted both of these folders from all drives. and when i come back to windows it there in all it’s glory on all partitions again.
The only conclusion i can reach is that its resident in the boot sector itself.
Any ideas? Anyone?
very very useful …
very useful
nice info…
hi i have windows 7 and tried all ways to remove this virus ” recycler” and i don’t succeed please i need help
thank’s
I knew some of the stuff but your instructions were excellent. AVG found a Win32/Heu on a DLL file in a restore folder on a Win XP Media (it’s pro plus) and I was not sure what would happen if I let AVG remove it from the System Volume Information folder. Once I realised that I could remove the restore points and how to do it I felt reassured I had not broken anything. Thanks for that.
I did it and it worked
Thanks!
thanks! ur such a great man! love you!!! keep up the good work! may god always bless you! :)
hi…. $recycle.bin and system volume information folder in windows 7. ANY SOFTWARE 2 REMOVE IT??? PLEASE HELP
Hiii
we are discuss on issue in which we have a folder in every drive name RECYCLER. Have contain 2 folder shape of recycle bin name S-1-5-21-854245398-602162358-725345543-500 and S-1-5-21-854245398-602162358-725345543-1004.
i never know what is this it;s never given any problem but looks like virus.
This recycler virus creates system hidden folder called ” recycler, orginal recycle bin folder is Recycle”,
To delete that virus start in safe mode, open regedit find recycler, info2.exe, desktop.ini and delete it, after deleteing make sure that registry key is not automatically recreated, if its recreated delete the process from task manager.
Hi…..,
well there is a solution of all types of viruses,if you knows
the name of file which is still infected.
ubuntu is the operating system,which you have to install
in your system in any other device except your window’s
drive.and start that window.ubuntu or linux cannot support executable files.so you can easily delete all
type of infected files.just. . . . .
start–>ubuntu–>\open drive–>right click on file…..
and delete that file.
easy way 2 save system from viruses….
G@@D BYE…..
Thanks a lot……
they r appearing again n agin what should i do?
plz help me
but anyway thanx a lot sir
Superb post, thank a lot
That’s the good thing virus has come these day, it can hides itself to the deepest. i followed all the instructions, i have xp pro sp2 or sp3, still i can’t access System Volume Information and when you notice on “type” tab of windows explorer, system volume information is a folder. sometimes, when i double clicking this folder, it creates a recycler folder.. Any idea what’s going on?
wish your method did work, but it didnt. bec it doesnt eliminate the problem (virus). and Win XP Home and Pro are fundamentally different , what you are teaching is only good for the Pro ver.
hello, my computer recently got infected with the autorun, recycler and system volume information viruses..
i managed to delete the recycler virus but it keeps coming back..
also when i try to delete the autorun and sys volume information viruses.. these messages appear respectively.
“cannot del. folder was created by flash disinfector. cannot find the specified file”
“Access denied make sure the disk is not full or write protected and that file is currently not in use”
what should i do?
hey shiva
your problem was not finding the security tab right???
if its not late i have a solution 4 u..
go to my computers-tools-folder options-click on the view tab-and uncheck the box for “use simple file sharing (Recommended)” now u willl get the security tab u wanted
hi,,,
when i saw recycler in my computer every drive then i afraid that my computer is also infected with virus but thanks for suggesting me ……..IMRAN
yaha sub kar ke dekha liya par yaha folder delet nahi hota hai .
koi aur rasta hai isko virus ko delet karana ka???
thanks for the information virut is nasty virus that attaches it self to all .exe files and re appears from system restore points if not cleaned out
just go to any folder and then above option, click the tools then scroll down to folder option, there you’ll find view tab then to the last button unchecked it.,., DONE..
by the way Raymond What should i do with the recycler folder,, please i need more info…(Thahkz!!)
is it safe to disable the system volume info?
plz anybody there reply ,..,.,hehehe \m/
thnx………….
great information, It helps a lot…………..
Thaaaaaaaaanks… No More Trojans On My Computeeer…
good work…………………….
i dvd writer is not writing dvd and cd ,it only reads it. Is it due to a virus.what should i do.
Must have missed this posting – thanks Raymond.
i am not able to find the Security tab in my properties of “system volume information” can any one out ther help me up…..
hi , i am having xp sp2 os and these two folders are vexing me up i dont know are these folders belong to virus or not can any one help me.And i have followed the above procedure but i am not able to delete them …
merci raymond pour explication tu es vrement un grand anti verus héhé merci
Thanks Mr Raymond! I\’ve managed to delete the RECYCLER folder but the System Volume Information folder keeps appearing. But thanks anyway!
I\’ve linked this page in my blog. I hope that it\’s fine with you.
Thanks a lot!
thanks a lot dude!!!
for this problem i had format my system 3 times, but every time these folder were came after 3 to 4 days.
now i have got a perfect solution.
Thank you.
Kamalakar (India)
nice..but i would like to ask how to access my files if the virus was removed by AVG? coz i cant access anymore the files in both my external drive and flash drive..iva already tried ‘showing hidden files and folders’ yet i cant access them..please help..
اخي العزيز
استخدمت الاجراءات في المقدمة وحذفت المستخدمين كمان او مش عارفة أين اخطأت بالظبط
ودلوقت صعب ادخل على الويندوز بالإضافة لأني اصلا كنت اعاني من مشكلة تظبيط التاريخ
كلما اغير التاريخ يرجع لسنة 1980 مما اسهم في تفاقم المشكلة في المقام الاول وجعل صعوبة استخدام System Restore
دلوقت كيف ادخل على الجهاز ” اللاب توب” مرة اخرى رغم نجاح اجراءاتك في مسح الفيروس بس اول ما انطفئ الجهاز لم يعد يدخل في اليوم التالي بل يستمر في اعادة تشغيل نفسه ولا يصل لنقطة فتح الويندوز xp ابداً
أرجو المساعدة..
شاكرين لكم جهودكم
THnx a lot… it worked!!! thanx… have a happy christmas! : )
Hola a todos yo tenia el mismisimo problema, ese de que no podia entrar al system volume information, pero siguiendo los pasos ahora si pude entrar, cuando entre en la carpeta aparecieron dos archivitos inusuales: uno que era tracking (un documento de texto) y otro que era mount……y no me acuerdo que mas porque ya lo elimine, y cuando pense que me habia desecho del virus, las carpetas recycler seguian apareciendo, y mi pen drive seguia infectandose, mi pregunta es como puedo encontrar el programa que crea esas malditas carpetas y en donde esta instalado, porque me parece que es igual que el cftmon32.exe que estaba instalado en c:/windows, y que tambien ya lo elimine, agradeceria que me ayudaran por favor………..Bye Saludos
Thanks – AVG told me about suspicious files in here and it has taken me ages to figure out how to delete them :(. Now I know the answer!
As far as I know the “uncheck simple file sharing” method only works on XP Pro, not Home. XP Home uses simple file sharing and it cannot be deactivated. Sometimes people who use XP Pro explain how to do something without realizing that it doesn’t apply to Home.
Excellent just as usual!
hello, i followed your instructions on accessing volume information in windows vista but it did not work. please help!
addittion!!! all my files right. now having like…. .jpg , .mp3 , .mpg. ya.
i also have the same problems. my norton also can not detect the virus. i got this virus thru the phone. coz i wanted to upload some songs into my phone. from then onwards, i could not play Windows Media Player, also got this “Thumbs.db” file in every folders. and “System Volume Information” and “RECYCLER” in my D drive too. anyone??? help me pls??? thx
thank you very much raymond. you always have a good advice for someone who is lost.
Thanks GUys
I tried the option Ray gave and it seems to have worked for the C but on the D drive the folder is still not accessible.
what is the particular anti virus that can remove or can kill this problematic virus and thank’s ray now i got worth full ideas from u thank’s a lot
Thanks very much!
Don’t know why they made Vista so complicated.
thanks a lot abt system volume information
thanks a lot.
sorry System Volume Information and recycle virus didin\’t remov
Thanks it solved my problem on XP SP2
thank you
it was a very helpfull more than microsoft
thank you
I got a solution for many problems with my pc.
Thanks a lot
bom eu tenho u Avast anti viros ,eu fiz um escaneamemto hj e ele emcomtro mais ou menos um 70 viros na pasta System eu movi todo eles para a quarentena .Agora eu quero saber se posso excluir eles,ou se eu excluir ele o pc nao liga mais .o q eu faco.exclui ou deixo eles na quarentena .
for Brad, Jack, Michael Moniqueand Ron – as far as i kwon this option will be shown only if you have a network at your computer e.g. a router.
as for Jonathan – you will have one on each drive though the easiest way is gain access to it all is with the cacls command shown early here used a few times just change the driver letter each time you write the command. the should solve the problems.
And I have the EXACT same problem as Brad, Jack, Michael AND Monique!! Suggestions?
Thanks a lot….
I got a solution for all my problems with the PC..
I also understand that using this method we can remove the ntd1er.com, autorun.ini virus… Thanks a lot..
God Bless u…
I have the EXACT same problem as Brad, Jack AND Michael!! Ahh!! I feel so helpless!!!!!!
VERY HELPFUL. THANKS
Hey bro ,,, I System Volume Information Folder on all my drives !!!! My Comp faced a Trojan attack couple days back… and i had to reinstall OS and formated only My C drive ….. Is it normal to have System Volume Information Folder on all the drives ????…Please advice … Cheers !!!!
Thanks for the article Ray ….. The info was helpful…
It would appear that this is a bigger problem than \”one person screwing something up\”, since I have EXACTLY the same problem as Brad and Jack.
i have the same problem as brad, my guess is the virus removed it
it also removed the security tab on the Sharing and Security option on the right click menu.
any ideas?
Hello,
I tried to uncheck the box in Control Panel -> Folder Options…..View tab, and UNCHECK “Use simple file sharing. But the “Use simple file sharing” option isn’t there on my computer under this path. Now what do I do?
hi raymond i have a file called tracking in my system folder. so any advice.
nice nice… great post indeed… :)
disable system restore
or disable the service and reboot
start->run->cmd
dosbox opens
cd\
cacls “c:\System Volume Information” /E /G yourusername:F
now you could delete the file normaly
Never ever delete system volume information or its contents unless u know whats inside..
Or u will end up deleting all system restore checkpoints..!
You can use system restore if u are infected by a virus or when your system settings have been changes accidentally.!
Hi everybody,
I would like to add some informations on the system restore tweaks ,a while i ago i started seeing some wierd files with ip 127.0.0.1 in my port explorer log so i started investigating that issue but i ended up with a shock !
if you turned off system restore it doesn’t mean it is really off because some viruses will still inject itself in that as a fake system restore directory “unless” you activate system restore and disable it again to delete all these files and get rid of all these 127.0.0.1 files that says system.
more than that i started looking all over the net for a way to change the system restore size to be with 0 size limit while it is on but i couldn’t find one way to do that!
so what do you think Raymond ?
good article. but how can i access system volume information folder when there are no other users attached to my computer and i’m the only user/administrator? will i see “security tab” in this folder’s property? just wanna know how can i access this folder in other way. thanks.
owkei!!!
nice info..
thanks for the post.. :)
Nice post… now i know what is all about..
thanks ray keep up the good work!!! :)