What is $REAU6EX.EXE ?

doesn't it offer to quarantine or nuke them?

How can three files all share the same name?

Why not, if deleted at different times or in different directories? They are just files in the recycle bin, each with a unique ID within the file system. The name you see is just a mnemonic.

Anyway, if you don't believe me, try it out. I created Rubbish.txt on my desktop, then deleted it. Then created the same file again, and deleted it again. Both copies are in the recycle bin, and neither on the desktop.

The interesting question is what would happen if I tried to undelete both of them? I expect that the OS will deal with that effortlessly, but there's a nagging doubt. :)

because you can create fred.txt, delete it (so it goes into bin) create another file called fred.txt (either in the same place, or in a different place) delete that so it also goes in bin, repeat ad nauseum

The bin is an illusion, the names you see are only the names the files used to have, they're really stored under c:\$recycle.bin\users-unique-sid\

each deleted file gets renamed to $Rxxxxxxx.ext whrere xxxxxx is random name and a corresponding $Ixxxxxxxx.ext exists containing the original filename and other metadata.

I dont have windows.

I created Rubbish.txt on my

Ah. Recycle bin is a different system then

In a recycle bin you can have multiple files with the same name. Brian

Files that start with dollar signs tend to be temp files created and then not deleted correctly, and then they may get deleted by whatever clean up software you are running, ccleaner for instance.

Brian

A lot of legitimate software could be used by criminals, anything that tweaks the registry reveals passwords and the like. Brian

rather than going knife-and-forking into the innards of the recycle bin, what actual names do you see in the "proper" recycle bin folder?

I expect you could try it in linux, you know.

Probably because they are borderline PUPs or potentially hostile malware. It looks a bit like something that snoops on banking transactions based on a quick search for "REAU6EX"

I'd suggest doing a scan with malware bytes to see if it will give you the option to utterly destroy them to oblivion.

Or you could submit one of them to Total Virus and see what the combined forces of every known AV package makes of it.

I have seen a handful of websites compromised so well that on the day of the attack only one or two AV packages were able to detect it.

$R<anything> is just a random name given to anything in the guts of the recycle bin.

That's not the real name though.

The metadata file has the realname of the file, and it's an absolutepathname.

File Explorer should allow you to see the properties of the item, and the metadata file is used when the user wants to "put the file back in its original location".

Part of the problem with doing forensics from the Windows side, is permissions. There can be multiple SIDs in the recycle.bin. The intention was to prevent people from looking in each others Trash when a Windows machine supports multiple local user accounts.

Using nfi.exe , you can at least get the SIDs. The $MFT filenames which are earliest in the table, are likely the first account created on the machine when the OS was installed. The three clusters of digits are unique to each OS installation. The "1001" part, those start at 1000 and are user accounts. Administrator is 500.

File 38 \$RECYCLE.BIN\S-1-5-21-3768549767-1934788099-1503758287-1000 File 39 \$RECYCLE.BIN\S-1-5-21-3768549767-1934788099-1503758287-1000\desktop.ini

File 62 \$RECYCLE.BIN\S-1-5-21-3768549767-1934788099-1503758287-1000\$RSYXEP5.mp3 13MB

File 290 \$RECYCLE.BIN\S-1-5-21-3768549767-1934788099-1503758287-1000\$ISYXEP5.mp3 544 bytes

G:\FarmingToday-20200423.mp3

A picture from Linux Mint, showing the contents of the $I file with the pathname in it.

File 62 \FarmingToday-20200423.mp3

When I threw the file in the Trash, the file *continued* to stay in the File 62 slot. But, the details about its path changed, because now it was in the Recycle.bin thing.

When thrown in the trash, a new file, File 290 was created. And this is the Info file with the details of the (obfuscated) trash file and what the real name is.

So rather than $REAU6EX.EXE being some evil malware, the $IEAU6EX.EXE file would contain the absolute path of where it was stored originally. The file was an EXE before Kaspersky moved it, so the trash continues to note that it is an EXE. If you don't have access to File Explorer (like, while in Linux), then you can still get the info by hex dumping the $I file of the same root name.

If you haven't emptied the trash, the information about what the real name of the file is, will still be there. You have to figure out which SID bucket it ended up in. Some work is involved to get at it. Maybe HxD would work, but I haven't tested that it overcomes the permissions OK on its own. You could try running HxD as Administrator, and I bet Kaspersky would just love that :-/

E:$RECYCLE.BIN\S-1-5-21-325..<more stuff>\$IEAU6EX.EXE

When you empty the trash, both the $R and $I file will be removed. All that is required to remove the files, is flip one byte in File 62 table entry and File 290 table entry. Later, if the system needs a slot to store a file, it will reuse those (when it is good and ready). No overwrites occur. The file is not securely deleted. The clusters are there (until they too get overwritten, but in time and we don't know how long that will take). This means if your bank account number was part of the filename or part of a data cluster, it's recoverable for quite a while. Trashing doesn't trash anything. Only a single byte flips, and it's not a critical byte particularly. That's why UnErase utilities have such an easy time of it. It takes effort, to totally remove something. Not even "format" does that!

Summary: $REAU6EX.EXE is not the real filename. Googling that will get you squat for your trouble.

Paul

Doesn't have a recycle bin as such - not this distro.

Really? So, when you delete something, that's permanent? The version of linux I used definitely had a bin that I could extract things from.

OK, thanks for that info. Looks like nothing to worry about.

A server distro might have no use for a recycle bin.

And it [used to be ?] possible to bypass the Windows recyle bin with a "Shift-delete" (which is the same in Nautilus under Linux).

plus some metadata about when they were deleted.