I'm running Debian 9.1 with KDE and scanned some other hard drive with the open source AV ClamAv. I got plenty of findings, most of which are PUAs (Potentially Unwanted Applications) (and I suspect many or even all being false positives - it seems ClamAV shows literally all .dll and .exe files as "PUA"s and the remaining ones weren't detected by most other AVs).
Most of these were located under $RECYCLE.BIN/someid/someid/...
Earlier I ran Windows (including AV) with that hard drive and now I'm wondering if malware in such locations could have been dangerous as well. Can applications in recycle bins be executed? Or is there some mechanism that prevents deleted dlls and executables from being run?


3 Answers 3


Can applications in recycle bins be executed?

Depends on the method. Clicking no, certain Winapi calls yes.

But ... this doesn't matter. Not being an PE executable is no guarantee that it's not malicious. Thinks like (malicious) audio files, VBA macros, JS in the browser, etc., rely on bugs in the program that reads them (like some specific media player or MS Word) and/or insufficient sandboxing.

It's very well possible that there is malware that uses bugs in the special storage system of Windows recycle bin.


Can applications in recycle bins be executed? Or is there some mechanism that prevents deleted dlls and executables from being run?

Yes, executables in the recycling bin can be executed. The $RECYCLE.BIN has a special purpose in Windows Explorer so items inside of it cannot be interacted with. This does not prevent the executables from being listed as a service, startup entry, or used from command line.

Around 2007 I found a worm hiding in the $RECYCLE.BIN of a customer. When you plugged in a USB drive, the worm would overwrite the AUTORUN.INF file with an entry that looked like the "Open folder to view files". When you would plug the USB drive in a new computer and click the wrong "Open folder to view files" entry, it would drop the malware in your $RECYCLE.BIN and create a startup entry in the registry.

It was especially hard to manually clean up because the $RECYCLE.BIN is hard to access from windows. From the command line, I had to run dir /ah and dir /as just to navigate into it and see the malware.

Finally, $RECYCLE.BIN has SID "folders" for each user's recycling bin. This means you can put an SID that doesn't exist and nobody would ever see the files normally. It's possible temp-file cleaning tools might try to delete it, but the malware I've seen had permissions broken so that wouldn't always work. Fortunately nowdays, Antivirus—in my experience—checks $RECYCLE.BIN.


It is well known to all AV program that NOT TO BYPASS recycle bin.

IF malicious file found inside Linux samba shared folder recycle bin, that's mean some windows system connect to the shared folder is infected.

If it found inside Linux recycle bin without any file share, then you must assume your system are infected.

Because malware running inside the memory can hide a copy of the payload inside recycle bin.

Since you mentioned external drive, it is actually pretty safe, as long as your windows system doesn't have any malware lurking around. But as precautions, you should remove all malicious files inside the recycle bin when you scan it using Linux.

  • 1
    It was found in the recycle bin of my old Windows internal hard drive (without any shared folders). However most detections were PUAs (showing PUAs is an option of ClamAV that is disabled by default). I haven't completed shredding the bin yet. I'm not using Windows anymore now.
    – mYnDstrEAm
    Commented Aug 7, 2017 at 15:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .