Photos gone forever? Please help!

Chocoholic84

OK I am literally about to cry - I have a 16GB Kingston memory stick that I store all my pics on (have about 2000 on there so far) A couple of weeks ago, I went to a pharmacy to get some of them printed, grand - put the mem stick in machine, selected the pics I wanted to print, fine. Got them printed.

Today, I have just tried to look at my pics on the stick (1st time I used it since getting pics printed) and none of them will open! Whenever I click on a folder the following error msg comes up "The item daiiweb.scr that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly. Do you want to delete this shortcut?"

WTF? I have no idea what daiiweb.scr is, it shouldn't be a shortcut, and I'm just really worried - is this something to do with the pharmacy's machine I used when printing? As the pics on stick were fine before that...i'm sooo worried I've lost my pics forever!

spurious

Can you see your files on the stick?
Are they in the correct format (jpg or whatever you saved them as)?

If you open something like Paintshop can you open them from within that program (i.e. not by double clicking)?

If you want to email me one photo I can see do I have trouble opening it.
Let me know and I'll PM you my address.

bhickey

Chocoholic84 wrote: »

Whenever I click on a folder the following error msg comes up "The item daiiweb.scr that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly. Do you want to delete this shortcut?"

What program would you normally use to view the files? If you don't know, then what operating system are you using?

Try starting the image viewing program first and then open the images from within it (e.g. click on File > Open and browse to the folder(s) containing the images). It sounds like, for whatever reason, your computer maybe doesn't know what to do with images.

3DataModem

The data is probably still there, and may be recoverable. Do as the above posters say, if that doesn't work go to a data recovery professional.


And FFS everyone backup your photos and videos! One copy on a stick, or disk, or hard drive, ain't enough.

chin_grin

Seeing that the files are on a removable stick you could try the following?

http://www.piriform.com/recuva

Chocoholic84

spurious wrote: »

Can you see your files on the stick?
Are they in the correct format (jpg or whatever you saved them as)?

If you open something like Paintshop can you open them from within that program (i.e. not by double clicking)?

If you want to email me one photo I can see do I have trouble opening it.
Let me know and I'll PM you my address.

No I cant see them- see I have them all in different folders (eg. Christmas 2010, Holidays 2010 etc).
I tried paintshop but it just says no files found. And I can't email you a photo unfortunately as I can't access any of them

Jumpy

Are you accessing it through a drive under explorer or my computer?

.scr is a shortcut file. You will get an error if the shortcut target has moved location.

Also does "daiiweb" mean anything to you? A google search only shows a trojan by that name.

Chocoholic84

bhickey wrote: »

What program would you normally use to view the files? If you don't know, then what operating system are you using?

Try starting the image viewing program first and then open the images from within it (e.g. click on File > Open and browse to the folder(s) containing the images). It sounds like, for whatever reason, your computer maybe doesn't know what to do with images.

I use Windows Photo Gallery to view the pics - tried doing File, open but again, just says no photos found Also tried Adding folder to Gallery but same thing comes up!

Jumpy

Does the drive show up in Windows Explorer or My Computer?

Chocoholic84

Jumpy wrote: »

Are you accessing it through a drive under explorer or my computer?

.scr is a shortcut file. You will get an error if the shortcut target has moved location.

Also does "daiiweb" mean anything to you? A google search only shows a trojan by that name.

Acessing it through My Computer - always did.
"daiiweb" means absolutely nothing to me - never heard of it! which is why I'm so confused...is it possible there would have bee some kinda virus on the chemist's machine that caused all my pics to be lost?

Jumpy

doubtful. those machines are contained units.

Its more likely your machine, however the replacement of a shortcut or script file is odd.

Jumpy

But you can see the drive yes?

Chocoholic84

Jumpy wrote: »

But you can see the drive yes?

Yep I can see it - all the folders with the names are there I just can't open them - so frustrating!

bhickey

Chocoholic84 wrote: »

Yep I can see it - all the folders with the names are there I just can't open them - so frustrating!

So in Windows Explorer, you can see the folders and the image files within the folders? Can you copy them to a folder on your computer's hard drive?

tricky D

Chocoholic84 wrote: »

.is it possible there would have bee some kinda virus on the chemist's machine that caused all my pics to be lost?

YES

Jumpy

Chocoholic84 wrote: »

Yep I can see it - all the folders with the names are there I just can't open them - so frustrating!

And if you double click on one of those folders what happens?

Is that when you get the daiiweb message?

Chocoholic84

bhickey wrote: »

So in Windows Explorer, you can see the folders and the image files within the folders? Can you copy them to a folder on your computer's hard drive?

No I can't see the image files - just the folders!
It's really weird I just went to Start, and in the search field I typed in the name of one folder...and I can access the pics that way! But not any of the other folders with my other pics!

Chocoholic84

Jumpy wrote: »

And if you double click on one of those folders what happens?

Is that when you get the daiiweb message?

exactly!

Jumpy

tricky D wrote: »

YES

NO.

The machines are set to only view and process from the removable device.
Files cannot transfer back to the system. So how could it be infected?

bhickey

Chocoholic84 wrote: »

No I can't see the image files - just the folders!
It's really weird I just went to Start, and in the search field I typed in the name of one folder...and I can access the pics that way! But not any of the other folders with my other pics!

In Windows Explorer, if you right click on one of the inacessible folders and then click on properties, what does it say? It would normally indicate whether or not there are files within the folder. Can you try the USB stick on another computer and see if the same thing happens?

Jumpy

Chocoholic84 wrote: »

exactly!

If you press Ctrl-Alt-Del and select task manager. Click the Processes tab.

Can you see anything called DAIIWEB.EXE running in there?

Jumpy

Also right-click on one of the folders, select properties, then tell us what is displayed under the General tab.

Chocoholic84

bhickey wrote: »

In Windows Explorer, if you right click on one of the inacessible folders and then click on properties, what does it say? It would normally indicate whether or not there are files within the folder. Can you try the USB stick on another computer and see if the same thing happens?

Again, nothing
Just gives the address of the shortcut - when I try click on the General and Details tabs it won't let me - just says the address in target box isn't valid!
I don't have a PC here with me...will have to wait and try it on my work one on Monday...

Chocoholic84

Jumpy wrote: »

If you press Ctrl-Alt-Del and select task manager. Click the Processes tab.

Can you see anything called DAIIWEB.EXE running in there?

Yes there is! Should I end that process?

Jumpy

Chocoholic84 wrote: »

Again, nothing
Just gives the address of the shortcut - when I try click on the General and Details tabs it won't let me - just says the address in target box isn't valid!
I don't have a PC here with me...will have to wait and try it on my work one on Monday...

Ah, we have got something, here, if you need to click on the General Tab then its not a folder. Folders will open on the General tab by default.

This means it is probably a shortcut.

Can you verify the default tab is "Shortcut" if so can you copy and paste everything from the "Target" field.

Jumpy

Chocoholic84 wrote: »

Yes there is! Should I end that process?

Ah crap.

Can you verify all locations you have used this device since the Shop?

Jumpy

Ok this is typical malware behaviour. Your folders have been replaced by a shortcut triggering the malware file.

Do you have a virus scanner?

spurious

Don't bring it near a work PC.

Jumpy

Chocoholic84 wrote: »

Yes there is! Should I end that process?

It may not let you, but try.

Quarantine this machine. Do not put any other USB drives etc in it, and do not use that USB key on any other machines.

Jumpy

Also do NOT go near banking websites or anything else while this machine is infected.

Chocoholic84

Jumpy wrote: »

Ah, we have got something, here, if you need to click on the General Tab then its not a folder. Folders will open on the General tab by default.

This means it is probably a shortcut.

Can you verify the default tab is "Shortcut" if so can you copy and paste everything from the "Target" field.

Yes default tab is shortcut.
the target field is H:\daiiweb.scr Christmas 2010 though...do you mean just copy that and paste somewhere? I tried but paste is greyed out so can't...

Chocoholic84

Jumpy wrote: »

It may not let you, but try.

Quarantine this machine. Do not put any other USB drives etc in it, and do not use that USB key on any other machines.

OK I clicked on End Process and it looks to have disappeared.
Oh no! How do I cure the machine?! (as well as get my pics back...)(sorry all, I'm not the most technical minded)

Jumpy

Do you have any technical friends?
This machine and that key need to be cleaned.

I wouldnt hold out hope for full picture recovery, however depending on the method that was used to delete/replace them some should be recoverable by software.

Clean the key first though! It will infect any other machine its used on.

Its very hard to find out where this came from, you might have been infected from a downloaded program, its unlikely that it was the photo machine, although I suppose it could be possible.

Jumpy

The problem is that DAIIWEB only has one obscure reference on a spyware site. Its not listed by McAfee or any other company so you will only find out the real name of the virus when its cleaned by software.
This means I cant tell you what the payload is (what it is written to do). One of them is obviously "transfer self to removable devices / replace autorun / replace folders with script launch shortcut" , however it may have done more.

As I said, avoid using any personal websites, do not plug in USB drives unless you want them wiped the same way. Get this cleaned by a tech or professional.

Do NOT use the infected key on any other machine.

bhickey

Chocoholic84 wrote: »

Oh no! How do I cure the machine?! (as well as get my pics back...)(sorry all, I'm not the most technical minded)

Try the following to start with :

1. Reboot into 'Safe Mode with Networking'. To do this. keep tapping the <F8> key a few times a second while the computer is booting up and you should be presented with a menu. Select the 'Safe Mode with Networking' option. If you don't see the menu then reboot and try again.

2. Download, install, update and then scan your PC with Malwarebytes. The scan could take a while so be patient. When it's finished it will display the results in a text file. Save this text file on your Desktop.

3. Reboot the PC normally again and then copy the contents of the Malwarebytes text file into a post here.

Jumpy

+1 Its a brilliant program.

However with viruses, its not always a free program that can cure them, thats why I always say a person who is familiar with malware should clean machines.
But this is a good idea, this will tell us what the actual malware name is. Then we will know the full payload.

mordeith

I wonder could the OP use the DOS prompt to transfer the files? Would they malware still cause issues with the shortcuts? I don't know enough about DOS to suggest what commands to try but maybe someone here might.

Also a similar thing happened to a friend of mine before. Put his SD card into one those machines, printed a few images and when he tried the card in work about 30 minutes later he could no longer access the images. Seems like there is a way for malware to be transferred. Presumable there must be some storage area on the machine where the images can be edited before printing. Perhaps this allows viruses to reside on the machine and transfer to other users cards / sticks?

bhickey

mordeith wrote: »

Also a similar thing happened to a friend of mine before. Put his SD card into one those machines, printed a few images and when he tried the card in work about 30 minutes later he could no longer access the images. Seems like there is a way for malware to be transferred. Presumable there must be some storage area on the machine where the images can be edited before printing. Perhaps this allows viruses to reside on the machine and transfer to other users cards / sticks?

I'd say that if you open up these machines there are just plain old Windows computers inside that are very poorly looked after (if at all). They're subject to the same vulnerabilities as other computers and with all the crappy infected memory cards that are put into them it'd be no wonder if they get infected.

Jumpy

They are windows, however they are set as kiosks. Nothing should be allowed to run memory resident.

Jumpy

Secondly, if something were running memory resident it would alter the folders before accessing them. Therefore failing before they could be printed.

Jumpy

One wonders how long it will be before USB keys will get a read-only switch like the old 1.44 disks used to.

bhickey

Jumpy wrote: »

Secondly, if something were running memory resident it would alter the folders before accessing them. Therefore failing before they could be printed.

I wouldn't be certain yet that the folder's or contents have been altered. It could simply be that attempts to access them are redirected by an infection of some sort on this particular computer. Let's wait and see if Malwarebytes sheds any light.

Jumpy

bhickey wrote: »

I wouldn't be certain yet that the folder's or contents have been altered. It could simply be that attempts to access them are redirected by an infection of some sort on this particular computer. Let's wait and see if Malwarebytes sheds any light.

They are no longer folders. They are shortcuts. The shortcut is pointing towards a script.
I already got this confirmed earlier.

bhickey

Jumpy wrote: »

They are no longer folders. They are shortcuts. The shortcut is pointing towards a script.
I already got this confirmed earlier.

Maybe, maybe not. You shouldn't always believe your eyes when it comes to viruses, especially if it's an infected machine that is providing the information on which you make a decision. It's possible that you might see something different if the USB drive were plugged into another machine.

threeleggedhors

A very similar thing happened myself a while back. It was a virus, shortcuts instead of the actual file. Problem is when you clean it with antivirus software you'll lose your files. I basically lost everything on my memory stick. Best of luck, hindsight's a great thing, backup backup backup ...

Jumpy

bhickey wrote: »

Maybe, maybe not. You shouldn't always believe your eyes when it comes to viruses, especially if it's an infected machine that is providing the information on which you make a decision. It's possible that you might see something different if the USB drive were plugged into another machine.

You would see another machine infected.

Capt'n Midnight

Jumpy wrote: »

One wonders how long it will be before USB keys will get a read-only switch like the old 1.44 disks used to.

Most USB keys had read only switches, back in the day of 32Mb and 64MB , but that feature was dropped


SD cards have the switches. Get a USB reader in the pound shops

Capt'n Midnight

use photorec to recover the pictures

it doesn't write to the drive so won't make things worse

(insert name)

Jumpy wrote: »

Are you accessing it through a drive under explorer or my computer?

.scr is a shortcut file. You will get an error if the shortcut target has moved location.

Also does "daiiweb" mean anything to you? A google search only shows a trojan by that name.

Scr is a type of script. A shortcut has the extension .lnk

Your memory stick is infected with the Trojan jumpy mentioned but your anti virus seems to have quarantined the script that cannot be found and may be restricting access to the stick. Your photos should still be there of you use a pc with no antivirus. Try use a mac or a games console as they cannot be affected by a windows based virus.

You'll also need to find what computer infected your stick and clean it too. Maybe inform the chemist where you printed the photos as they might have given you the virus or else you may have passed it on to them and by extension their customers.

(insert name)

Jumpy wrote: »

You would see another machine infected.

Not if is running Linux, osx or if it is an embedded device such as a ps3 or games console

chessguy

Boot from say a Ubuntu live cd mount the usb stick with the photos , copy all files you want over to another usb stick,

now use the second usb stick in another pc or laptop should hopefully get you sorted

you can get ubuntu live cd here , just boot from the cd you do not need to install it ##

http://www.ubuntu.com/desktop/get-ubuntu/download