Photos gone forever? Please help!

Jumpy

(insert name) wrote: »

Scr is a type of script. A shortcut has the extension .lnk

Your memory stick is infected with the Trojan jumpy mentioned but your anti virus seems to have quarantined the script that cannot be found and may be restricting access to the stick. Your photos should still be there of you use a pc with no antivirus. Try use a mac or a games console as they cannot be affected by a windows based virus.

You'll also need to find what computer infected your stick and clean it too. Maybe inform the chemist where you printed the photos as they might have given you the virus or else you may have passed it on to them and by extension their customers.

Yep, I corrected the scr thing later.

Guys, this virus replaces the folders with Shortcut files. Shortcut files are not containers.

Using this stick on another system will not give access to photos.

Only a recovery utility will give access to some of the files, depending on how they were removed/replaced.

The photo machine most likely did not infect this stick. The stick would have been erased and replaced by the running process before being accessed to get the photos. If the photos were printed off by the OP this indicated that its unlikely.

Secondly. The daiiweb.exe process ran into memory on the OPs machine. This means the Anti-Virus did not catch it.

Hence why I think the OPs machine was infected by one of the viruses other methods of distribution and transferred to the stick by the OPs system.

Someone technical needs to check this machine, identify the malware, determine its payload and clear it.

Otherwise this machine needs to be formatted and rebuilt.

Capt'n Midnight

Jumpy wrote: »

Otherwise this machine needs to be formatted and rebuilt.

if you format you will loose all data on the mahine, make sure you have any photos on it backed up first

again, photorec will pull the photos off the USB key, (unless they have been encrypted


photorec ignores formats, folders and file names and goes straight to the 1's and 0's

most other recovery packages modify the usb key and so may do more harm than good, photorec is reasd only

if you try the USB key on someone elses pc then make sure they have up to date antivirus in case the USB key is infected with an autorun or something

Jumpy

^

THIS.

Oop sometimes forget not everyone works in IT.

Yes. Format means everything is gone.

Sorry.

jholland79

Try this:
Open the drive using My Computer.
On the Toolbar toward the top of the windows, click on Tools.
If you are using Vista or 7, you might need to press ALT first.
Select Folder Options and then View.
Select "Show hidden files, folders, and drives"
Clear Hide extensions for known file types.
Clear Hide protected operated system files (you will getting a warning here, just click yes)
Click OK.
Does anything else show open on the drive?
Some infections hide the folders and create executables files with the same names as the original folders, so you might now see the original folders with the folder icon shaded out.
If you are lucky, this might allow you to see the photos to copy them to the pc.

In any case, the Key and PC will need to be cleaned of infections.
Malwarebytes is certainly a good place to start.

Capt'n Midnight

http://www.cgsecurity.org/wiki/PhotoRec does what it says on the tin

Nothingbetter2d

Chocoholic84 wrote: »

OK I am literally about to cry - I have a 16GB Kingston memory stick that I store all my pics on (have about 2000 on there so far)

this is high risk........ save them on a hard disk drive.... all it takes is close proximity to a strong magnet (a speaker for example) and bam your files are corrupt.

Jumpy

No it doesnt.

Its not magnetic media.

JDxtra

Either way, I would not store any data that I needed on a memory stick without having another copy somewhere else.

They are fine for temporary storage, but they fail regularly and should not be used for permanent storage of important files (college work, photos etc).

Hope the OP gets his photos back.

CCTV_Ireland

I use [EMAIL="active@undelete"]active@undelete[/EMAIL] to recover my client's files. It works very well. But it sounds like a file association issue