Member Avatar for dasd

I am on travel and was advised my Win Vista machine had supposedly been infected with the 'interpol' virus approximately one month ago. A family member noticed some odd behavior and took the PC to an 'in-store' tech center for a diagnostic. This center stated the machine was infected and made some general comments about resetting default setting but did not specify any changes they may or may not have applied.

Btw, this same place was all too eager to have this machine sent off to their repair facility for a hefty fee so they could further assess the situation. My relative declined and brought the machine back home but now he cannot access the most important item on that machine, which is an multi-year archive of family photos. I did not perform a backup (I know, I know...) as I was away on travel a great deal and this PC was basically used for image storage.

I am trying to investigate this virus and determine whether it truly is the cause for the loss of access to the images. I'm also curious as to how this virus penetrated Norton Security and was also not detected by my new install of McAfee?

BOTTOM LINE: The most important thing for me is to recover those images, so I'd like to know 1) If anyone reading this is familiar with the interpol virus? 2) Whether this virus would seem a likely suspect for this situation? and 3) Is there forensic tool/ data recovery app that could be used to recover the images/ data?

Don't need any commentary about not backing up - there was just not enough of me to go around. So please respond with a solution ASAP. It would be greatly appreciated

Thanks!

  • 3 Contributors
  • 2 Replies
  • 396 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by mechbas

Dani AI

Generated

Short, practical recovery plan focused on preserving the photos first. ’s photos are the priority; and raised sensible starting points. The key gap is a forensics-first workflow: stop altering the disk, create a bit-for-bit image, then attempt recovery from that image rather than the original device.

Immediate steps (high level): power down and disconnect the PC from networks. Remove the drive and attach it to a clean system via a SATA-USB adapter or through a hardware write-blocker. Create a full disk image (raw/dd or E01) to an external drive at least as large as the source. Tools commonly used for imaging include FTK Imager (Windows) or GNU ddrescue (Linux) — the goal is an exact copy so the original stays untouched. Record device IDs and timestamps.

Work from the image only. Scan the image with offline malware tools to identify active threats. If the filesystem/partition table is damaged, run TestDisk on the image to try partition/MFT recovery. For missing or unreadable photos use file-carving tools (PhotoRec, R-Studio, etc.) to extract JPEG/RAW data independent of the filesystem. Verify recovered files by checking file headers (JPEGs start with 0xFFD8FF) to detect encryption or truncation. Avoid running CHKDSK or other write operations on the original disk — repairs can overwrite recoverable data.

If the drive shows physical failure or the steps above are not comfortable, use a reputable data-recovery lab rather than a retail repair counter. Contacting Norton (as suggested) is reasonable for malware removal, but that should come after imaging. If the infection is ransomware that encrypted files, recovery without keys may be impossible; imaging keeps options open for later analysis or law-enforcement/cryptanalysis.

Recommended Answers

All 2 Replies

Member Avatar for rubberman

The question is whether the images themselves have been compromised, or if some malware on the system is blocking access to them. I would suggest that you boot a live linux cd/dvd/usb drive, mount the windows partition, and then see if Linux can access the photos. If so, then it is the malware that is blocking access, and you can backup the data to a thumb drive. If not, then you are fubar'd... although a Linux or Windows A/V program may be able to fix the situation.

So, what have you tried so far?

Member Avatar for mechbas

If Norton was on the PC and you are also, infact a paid up customer, then contact them for an answer and solution.
From what I've been able to determine is that the pesky bug is "MalWare" and a removal process should be fairly easy. Its also doubful that your files are damaged. Seldom, if ever, does that ever actuallly happen.
Even if you paid the alledged "fee" its unlikely that you'll get your files back that way. No one ever does. Keep your money in your pocket at least until you've gotten word back from Norton.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.