How I Manually Recovered the Virus Infected Digicam Files

Just this morning, one of my students approached and asked me if can I help to get her Digicam pictures from its memory card back. Without hesitation I asked her back rightaway what has happened and when did it happen. She told me that she has used it earlier and was still able to see the pictures but when her digicam's memory card was plugged in to the other pc, everything that was in the memory card where replaced by folder links. All the files in the memory card where replaced by files with .lnk file extensions indicating that they are link shortcuts. Obviously, the digicam's memory card is virus infected. My student then asked me if can there still be a chance to get her pictures back and I just answered "We'll try".

So I plugged in her memory stick to my computer while pressing the "Shift" key. Pressing the shift key avoids autoruns. Upon checking the contents of her memory card (do not click on the memory card's icon in "My Computer", Use the folder tree at least)I noticed that there where six lnk files with zero bytes of file size. But I checked properties of the memory card , it shows more than 400 MB of used file size out of the total of 2 GB capacity. This is odd, so I checked on for the folder options if there are hidden files but I found none. The other option to check if files are given with attributes is by using the NT Command Prompt.


To Use the NT Command Prompt

1. Press "Win+R" then type in "cmd"

2. Once your are in the command prompt, go to the root directory of your memory card and in my case it's on dive e:. So typed in "e:"

3. It should now display E:\> and type "attrib/s". You should see some files with attributes like "r","a","s","h". If you see such attributes, remove them by typing in "attrib/s -r -a -s -h".

4. Once the attributes are removed, type "dir" to see all files. As I executed this, I found seacao.exe and jauaco.exe. These files are not familiar and just as I suspected. I found out by searching on google that these are worms. So I deleted them by typing in "del seacao.exe,juauco.exe".

5. As I deleted those files, the lnk files still remained and still not pictures found. So I decided to to check each lnk file to be treated as a directory.

6. So I typed in "cd documents.lnk" where "document.lnk" is the name of one of the lnk files. To my surprise, I was able to enter "documents.lnk" directory. So I then checked for possible files by typing in "dir". Then I saw a lot of files with .jpg and .mov file extensions, at last I found them! And so I copied the files by typing in "copy *.* d:" where d: is the directory where I'll be placing the recovered image files so I can format the memory card.

I was then able to format the memory stick and transferred the recovered image files from drive d: back to the newly formatted memory card successfully and returned it its owner. If you feel this method is way too technical for you, you might want to consider using a good software to automatically recover your corrupted digital camera files.