Hello, I finally got round to asking this question. i am sure there is a perfectly good reason for it but i havent got a clue as to what it is!. I throw this one out to the forum.
Regards
Dave1234.
why would anybody scan something which is for deletion, there is no “active” files in recycle bin, you should empty trash, not scan trash…
They also can’t run from the trash bin.
In my opinion, it could be to ensure that the virus is actually removed. When any of the programs like ccleaner deletes / clears the files from recycle bin, the on access scanner of AV will detect it and request you to quarantine it. Deleting the file from quarantine will take the virus into system restore files, thereby the virus will still remain in the computer. When you delete the system restore folder, either manually or through turning off the ‘system restore’ feature, again the on access scanner will detect it and you would quarantine it making a recycle of the entire procedure.
And as far as I understand the ‘recycler’ mentioned therein is not the recycle bin but a hidden folder in C drive, which cannot be seen using explorer but can be seen as follows :
start>run>CMD
cd\recycler
I am not very much aware of the usage of this folder, but, I think it keeps deleted files in it, which are no more active.
Well, the hole was suppose to be fixed long ago but i remember loads of malware executing directly from the RECYCLER folder…
AFAIK, when recycler is in exclusion list, it will not scan the folder during scheduled scans, but if the malware try to execute itself (like a worm), it will be detected by CIS, if it is there in CIS’ signatures (this is just a guess, I have never tested it).
Any way, the first thing I do after installing a new version of CIS is to remove that exclusion (recycler) from antivirus!