"Ghost" Recycle Bin

Sabrina

Posts: 28   +0
I'm not sure where to start on this (or if I'm even posting in the correct area) as I don't seem to have virus problem and yet I'm not getting any funky errors. I do, however, have a "ghost" recycle bin on my desktop that's been hanging around ever since something happened while running TFC and having a computer crash in the middle of that function. At that time I ended up having to hard boot the computer. Since then, all has been well. The computer is running like a champ and TFC continues to be a useful and reliable tool.

I've attached a screenshot of my desktop. The ghost icon for the recycle bin is the last in the group of icons on the left of the screen. I've "deleted" this item several times to no avail. The "real" recycle bin is still present and functioning normally. This isn't a performance issue, it's merely an aesthetic one. How can I get this ghost to go away?
 

Attachments

  • Capture.JPG
    Capture.JPG
    178.9 KB · Views: 17
Right-click on the trashcan, then Properties. Show me what the dialog says, for both trashcans.

Also try following these steps to hide them, and then show them.
http://windows.microsoft.com/en-au/windows/show-hide-recycle-bin#1TC=windows-7

Go to C:\$Recycle.Bin and tell me how many Recycle Bins you have there.

Also try: start -> "desktop icon", click on the "show or hide common icons..." entry. Select the Empty Bin, reset icon to default.
 
Last edited:
Dialogue for both icons is attached (very different - one behaves like the recycle bin, the other behaves like any other icon).

Images for the desktop with and without the recycle bin box checked are attached. Each time the only icon affected was the real recycle bin.

Image of C:\$Recycle.Bin attached. There are 2 files in that folder.

Resetting the icon to default yielded no change.
 

Attachments

  • $Recycle Folder.JPG
    $Recycle Folder.JPG
    65.6 KB · Views: 5
  • Desktop with recycle bin shown.JPG
    Desktop with recycle bin shown.JPG
    191.2 KB · Views: 4
  • Desktop with recycle bin hidden.JPG
    Desktop with recycle bin hidden.JPG
    188.9 KB · Views: 4
  • Ghost bin properties.JPG
    Ghost bin properties.JPG
    49 KB · Views: 6
  • Real Recycle Bin Properties.JPG
    Real Recycle Bin Properties.JPG
    47.1 KB · Views: 5
The one with the two folders is locked (see the lock symbol) and the reason it is impossible to delete it is down to the two folders with the odd names. These are actually created by a rather special user who is now an 'unknown' user, and will probably be found to 'own' the old recycle bin. I can tell you this sort of strange thing has been happening in win 7 for at least 4 years or more with no action or solution from MS. There never will be either.

Examples of the unknown user S-1-5-21-etc.... are :- a previous administration user now replaced by a new administrator for certain reasons (computer pre-owned, or OS updated from earlier OS version), or quite commonly a user generated by backup software installed to do drive imaging and since removed from the system. Such a super-user has to have super-full rights in order to be able to image a complete drive.

Here is an example of the sort of thing people try to remove such folders which can no longer be processed. http://answers.microsoft.com/en-us/...ders-how/3160990a-e723-45dc-84e8-3e493ef57c89
I can only report that most times, nothing can be done to remove those problems, but they don't cause any futher trouble, just frustration. To complicate matters, that unknown super-user will also be found in the registry in several places.
 
Last edited:
Ghost-bin location says that the Bin is actually located on a server or file share somewhere.

It seems that your computer is running Win7 Pro (or higher), is/was attached to a domain, and had folder redirection activated at some point. E.g. a company computer.

Is this computer still owned by the company? If yes, then I'm not going to help you further, apart from telling you how you can hide the ghost Bin icon:
Open up My Computer, click on Desktop, click Organize (top-left), Folder and Search Options, Hidden files and folders, Don't show hidden files. OK.



If it's an ex-company computer or something similar, let us know..
 
It's my computer, but yes, I have it on the company network for ease of use. The "hiding" worked just fine, though. So thank you!
 
I see. Well, that's good.

The second 'ghost' bin is there if you delete something from your Desktop or Documents folder that is sync'd to the server. It goes into the Ghost Bin. A 'copy' is made in your normal recycle bin. Most people should have hidden files not showing anyway.

That's the cause of this problem. :)
 
Do they intentionally hide this recycle bin for security reasons, so that no one can delete files?
 
Because your computer is attached to a domain, some of your files are actually stored on a file server for that domain. For efficiency's sake, copies of those files are replicated to your local computer. You can add or change those files locally, and the next time your computer is attached to the corporate network, all changes made locally are copied to the file server (and vice versa, if applicable).

Check out the following steps. You will likely have to do additional research, but this framework should be something to start with.

STANDARD DISCLAIMER: Some of the below steps have the potential to really mess you over, like lose all of your valuable files and make the planet spin backwards. So I'm telling you the same tired but appropriate advice about backing up your computer and, ultimately, being prepared to reload Windows if you mess it up bad. But you've heard all this before.

You will need to know how to log on to your computer as the affected user as well as an Administrator. If you can't get on as Administrator, using cmd in Safe Mode might do it. If Administrator is merely disabled, I'm thinking maybe you could get into Safe Mode and use:
net user administrator /active:yes
net user administrator password
to enable the Administrator login and assign the password as password so you won't have to use Safe Mode. I've used those commands, but not from Safe Mode, so maybe they won't work there.

If you know how to boot from a rescue disk, Linux, or a Windows boot disc, then you can use that instead of using the Administrator login when deleting files. Depending on how you use it and what you do, you'd be able to bypass step 5 and could perhaps do 6B without a lot of fuss. A lot of the problems are simply having to get past Windows security.

When "show hidden files" was turned on in File Explorer, there were TWO recycle bins, one real, the other a "ghost" (the "ghost" one was marked hidden, which is why it was a ghost). There were multiple permissions problems, and the user couldn't recycle any files, although using shift-delete would work to actually delete the file. Clearly, the recycle bin had problems.

To fix it all:

1. As the affected user, turn off the "real" recycle bin. (right-click) Recycle Bin -> Properties. For all of the listed Locations, change the function to immediate delete instead of recycle.

2. As the affected user, eliminate the Recycle Bin icon. (Right-Click) Desktop -> Personalize [-> Themes] -> Desktop Icons, uncheck Recycle Bin.
After the above two steps, you will have only the "ghost" recycle bin remaining. If you now choose "delete" from the File Explorer context menu for a file, it will actually delete the file.

3. As Administrator, search the C:\Users\username folder for any $RECYCLE.BIN and delete them all. Due to the CSC (see below), you likely won't see them all. Note, you can't be logged in as the affected user!

4. Log on to the file server and delete all $RECYCLE.BIN from that user's profile. Obviously, if you're not a domain administrator, then you won't be able to do this, the best you can do would be to fix everything locally and hope errors won't replicate back. Otherwise you may need to get your corporate admins involved.

5. IF YOU HAVE PERMISSIONS PROBLEMS on any of this, you may need to run these as Administrator:
takeown /F "Full Path of Folder or File"
takeown /F "Full Path of Folder or File" /r /d y
icacls "Full Path of Folder or File" /grant Administrators:F
icacls "Full Path of Folder or File" /grant Administrators:F /t​
I did a CD to the containing directory and just used $RECYCLE.BIN instead of the "full path of folder or file".
I also added " Everyone:F" after "Administrators:F", just to make sure anyone could do anything -- I.e., so that security wouldn't be a problem. NOTE THAT USING Everyone:F MEANS THAT ALL USERS AND ANY PROGRAM WILL HAVE COMPLETE ACCESS TO YOUR USER FILES ON YOUR SYSTEM. So don't use it if you don't need to.

6. Unfortunately, there's another wrinkle, and that's the CSC, which is also in the mix. So if things still act wonky, you may need to go into the CSC and delete $RECYCLE.BIN as appropriate. Even more unfortunate is that CSC is heavily protected because Microsoft didn't want people futzing with it.
Your choice is either (B) to go in there manually and edit it (heavens to Betsy!), or (A) to re-initialize the CSC and letting the system re-establish it.
A. Re-initialize via adding Registry string (the following is on a single line):
REG ADD "HKLM\System\CurrentControlSet\Services\CSC\Parameters" /v FormatDatabase /t REG_DWORD /d 1 /f​
You could also manually use regedit to add this entry to the registry.
This will delete all files in the CSC on the machine and will re-initialize it from the server when sync'ed again. If there was a sync error between the server and local copy, too bad, since the local copy will be erased. This means that if you've made local changes to files that haven't been copied to the file server, you will lose those changes! So make sure you don't have any outstanding sync errors. I cannot stress firmly enough the ugly consequences of not ensuring local files sync'ed correctly to the file server!
IIRC, reinitializing the CSC affects ALL the users on that machine -- so everyone needs to be sync'ed OK or there could be data loss. If it's a personal machine, then it's just you that you need to care about.
B. The CSC structure looks like:
C:\Windows\CSC\v2.0.6\namespace\Files\Users\username
and is protected (even from Administrators!) from the top of the hierarchy. You'll have to use the above takeown, etc commands to get access to it. It's protected because screwing with it can lead to inconsistency in files between the file server and the user's visible profile. The CSC is essentially what the user maps to locally when he sees his files.
Note that using the above commands to make the CSC visible potentially reduces the security and integrity of your system because this area now becomes available to unauthorized change. At the same time, since it's your files anyway, any malicious actor could just use "normal" methods to change stuff. I.e., I don't see it as a big deal if you're the only user of the computer.
Nevertheless, (A) is preferable to (B) **IF** you can ensure you're sync'ed correctly with the file server. If you've been away from the file server for a while and done work and need to fix this, you SURELY WON'T want to do (A)!

As Administrator, search the relevant username in the CSC for any $RECYCLE.BIN and delete them all.

7. After ALL the $RECYCLE.BIN is deleted from all the directories in the affected user's file hierarchy, then you can go back as that user and re-enable the icon then re-enable the Recycle Bin wherever you need. If you've used (A) to delete the CSC, you'll need to connect to the corporate network to get your files copied back when you login and sync.

I had this problem ALMOST licked early on -- the only problem was that there was always a "ghost" icon (because it had the "hidden" attribute) on the desktop that got recreated quickly after being deleted from the Desktop. Everything else worked OK, it's just that there were two Recycle icons, the real one (which was solid and could be removed by step 1, above), and the "ghost" one, which always magically came back. I deleted it from the Desktop multiple times, and from the file server as well (sometimes it didn't even show on the file server, sometimes it did). I was NOT satisfied with merely turning off the display of hidden files because I KNEW that thing was still there.
The solution FINALLY was to go into the CSC as documented above and delete it.
In retrospect, it makes sense, since if it was in the CSC, it would show back on the visible Desktop as well as replicate to the server at whatever times these would refresh.

Hope this helps a bit. I had to do about 5 hours' work and lots of Googling to get this. Plus all the time to write it up. <sigh>
 
Last edited:
Because your computer is attached to a domain, some of your files are actually stored on a file server for that domain. ....
That's a GREAT POST -- complete and appropriate warnings. You will be a great asset to TechSpot :) (y) (Y)
 
Back