5

I'm running Debian 9.1 with KDE and scanned some other hard drive with the open source AV ClamAv. I got plenty of findings, most of which are PUAs (and I suspect many or even all being false positives - it seems ClamAV shows literally all .dll and .exe files as "PUA"s and the remaining ones weren't detected by most other AVs).
Most of these were located under $RECYCLE.BIN/someid/someid/...
Earlier I ran Windows (including AV) with that hard drive and now I'm wondering if malware in such locations could have been dangerous as well. Can applications in recycle bins be executed? Or is there some mechanism that prevents deleted dlls and executables from being run?

2

Can applications in recycle bins be executed?

Depends on the method. Clicking no, certain Winapi calls yes.

But ... this doesn't matter. Not being an PE executable is no guarantee that it's not malicious. Thinks like (malicious) audio files, VBA macros, JS in the browser, etc., rely on bugs in the program that reads them (like some specific media player or MS Word) and/or insufficient sandboxing.

It's very well possible that there is malware that uses bugs in the special storage system of Windows recycle bin.

1

It is well known to all AV program that NOT TO BYPASS recycle bin.

IF malicious file found inside Linux samba shared folder recycle bin, that's mean some windows system connect to the shared folder is infected.

If it found inside Linux recycle bin without any file share, then you must assume your system are infected.

Because malware running inside the memory can hide a copy of the payload inside recycle bin.

Since you mentioned external drive, it is actually pretty safe, as long as your windows system doesn't have any malware lurking around. But as precautions, you should remove all malicious files inside the recycle bin when you scan it using Linux.

  • It was found in the recycle bin of my old Windows internal hard drive (without any shared folders). However most detections were PUAs (showing PUAs is an option of ClamAV that is disabled by default). I haven't completed shredding the bin yet. I'm not using Windows anymore now. – mYnDstrEAm Aug 7 '17 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.