File extension changed to .datawait [Solved/Closed]

Posts
3
Registration date
Monday November 5, 2018
Status
Member
Last seen
November 6, 2018
-
hi

my jpeg and cr2 file change extension like(sample.jpeg.datawait and sample cr2.datawait)

i already format and reinstall windows and make new partitions.

all jpeg and cr2 file in my external hard disk .and i recopy to desktop after reinstalling window but file cant open


uplode 3 file here: [XXXXXXX]



please give me a solution.
thank you
See more 

11 replies

Best answer
2
Thank you
Have you connected to a UNIX server over a local network or VPN.?

To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a report.

1. Open this link and download ZHPDiag :
http://www.nicolascoolman.fr/download/zhpdiag/
(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message, ignore it.) Click on the download button

2. Save the file on your Desktop.

3. Double click on ZHPDiag.exe and follow the installation instructions.

(For Vista, Win 7, 8 and 10 users, click right to ensure you run with admin right)

4. Double click on the short cut ZHPDiag on your Destktop.

5 Click on scan
Wait for the tool to finished (maybe a long time)

6. Close ZHPDiag.

7. To transmit the report, click on this link :

http://www.tinyupload.com/index.php

8. Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt).
9. Copy the url link obtained from tinyupload and paste it here in your reply.

CCM Community Manager and Virus/Security Contributor

Say "Thank you" 2

A few words of thanks would be greatly appreciated. Add comment

CCM 6776 users have said thank you to us this month

Anonymous User > lamalolipop -
KMSpico
> Anonymous User -
what should i do?
Anonymous User > lamalolipop -
Purchase a Windows license.
bryanyam1999
Posts
1
Registration date
Monday November 12, 2018
Status
Member
Last seen
November 12, 2018
-
Anonymous User > bryanyam1999
Posts
1
Registration date
Monday November 12, 2018
Status
Member
Last seen
November 12, 2018
-
@bryanyam1999

Thanks for the report.

Indeed your system is badly infected all kinds of malware: Trojan, adware, Toolbar.Agents and Hijacker. We can clearly where see where .datawait has lodged itself.

However, you also are using an illegal software to activate Windows programmes. For that reason, we cannot help you remove the viruses and the datawait ransomware.

Sorry
Posts
18317
Registration date
Monday February 15, 1999
Status
Webmaster
Last seen
September 10, 2019
767
2
Thank you
Hello,

Datawait is a Ransomware, which means a malware that encrypts your file and ask for money in order to decrpyt them.

If, by chance, this ransomware did not corrupt your restore points, you can try to restore your system to a restore point before the computer was infected.

Say "Thank you" 2

A few words of thanks would be greatly appreciated. Add comment

CCM 6776 users have said thank you to us this month

Posts
12974
Registration date
Monday June 3, 2013
Status
Moderator
Last seen
September 10, 2019
1366
0
Thank you
upload a screenshot. I beleive another moderator has already explained that Datawait is a sign of a virus. If your files have changed formats, and you DID NOT INSTALL anything, IT IS A VIRUS!
hanif_99
Posts
3
Registration date
Monday November 5, 2018
Status
Member
Last seen
November 6, 2018
-
hi

my jpeg and cr2 file change extension like(sample.jpeg.datawait and sample cr2.datawait)

i already format and reinstall windows and make new partitions.

all jpeg and crs file in my external hard disk and recopy to desktop.but file cant open


uplode 3 file here: [XXXXX removed. We cannot offer posible virus infected files to be distributed. We asked for a screen shot, not of the files. Thank you for understanding. Mark Moderator]

please give me a salution.
thank you
Posts
3
Registration date
Monday November 5, 2018
Status
Member
Last seen
November 6, 2018
0
Thank you
hi thank you for replay.

sir i am already format hardisk make new partition and reinstall window . i have avast pro and antimalawerbit. before format hardisk i save all jpeg and cr2 file in my external harddisk.than i recopy my jpeg and cr2 file on c: desktop. no virus found. here link of my files .for better you understand my problem.

<REMOVED as it links to an infected file]
0
Thank you
Just what I expected.

Your external hard disk is infected by a worm and as soon as you connect and open your external hard disk you also reinfect your computer with the same worm.

No antivirus software can prevent worm infections. Having two antivirus software will create conflicts, you should have only one.

Do you wish to know how to get rid of the worm virus?

P.S. It's not replay by reply.:-)
i have this problem how can I fi it please help
Posts
1
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 9, 2018
0
Thank you
Same here, any help?
Posts
1
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 9, 2018
0
Thank you
help me ,virus in my pc , message virus
==================================!ATTENTION PLEASE!===========================================

Your databases, files, photos, documents and other important files are encrypted and have the extension: .DATAWAIT
The only method of recovering files is to purchase an decrypt software and unique private key.
After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.
Only we can give you this key and only we can recover your files.
You need to contact us by e-mail BM-2cXonzj9ovn5qdX2MrwMK4j3qCquXBKo4h@bitmessage.ch send us your personal ID and wait for further instructions.
For you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.
Discount 50% avaliable if you contact us first 72 hours.

===============================================================================================

E-mail address to contact us:
BM-2cXonzj9ovn5qdX2MrwMK4j3qCquXBKo4h@bitmessage.ch

Reserve e-mail address to contact us:
XXXXXXX

Your personal id:
XXXXXXX
0
Thank you
and my pc infected by virus , this message from virus


==================================!ATTENTION PLEASE!===========================================

Your databases, files, photos, documents and other important files are encrypted and have the extension: .DATAWAIT
The only method of recovering files is to purchase an decrypt software and unique private key.
After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.
Only we can give you this key and only we can recover your files.
You need to contact us by e-mail ***@*** send us your personal ID and wait for further instructions.
For you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.
Discount 50% avaliable if you contact us first 72 hours.

===============================================================================================

E-mail address to contact us:
***@***

Reserve e-mail address to contact us:
***@***

Your personal id:
003zS4VZvMkabFnY14Vkdq6lt6m9L2x0DtGR9XJ1zuV




any help
Anonymous User > renegard
Posts
6
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 10, 2018
-
I will publish a solution on this thread here tomorrow. Just stay tune.

P.S. Did you ever open an email from an unknown source or attachment thereof ?
aftab.eq
Posts
2
Registration date
Saturday November 10, 2018
Status
Member
Last seen
November 12, 2018
> Anonymous User -
Time is running out dear jules... Kindly provide solution for the problem.
renegard
Posts
6
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 10, 2018
-
No. But it seems there was a worm included with a downloaded file from a program offer.
Unfortunately my Virus / Malware protection program did not recognize the worm!!
Please let me updated. Tks Attached you'll find more information comming for gangsters channel!!
renegard
Posts
6
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 10, 2018
-
Sorry ... of course not attached, but below.
i have same problem i run an installer thinking it is an external windows updater but turned out to be a ransomware, it has a purple dinosaur icon and its name is installer, it was giving me the message ( please don't turn off your pc your updates are being installing ) now all my files, programs, docs, ppt and every type of data is corrupt

will there be any possible solution to retrieve my data? (Jules- ST-Germain)
thank in advance
Posts
1
Registration date
Saturday November 10, 2018
Status
Member
Last seen
November 10, 2018
0
Thank you
i have a same problem, DATAWAIT... n malware too .
i already try to clean it, but it not works.
i found File virus with name qlscxb.ex* n try to delete it with cmd promt nbut it cant .
i hope someone can help me to fix the problem
ty
Posts
6
Registration date
Friday November 9, 2018
Status
Member
Last seen
November 10, 2018
0
Thank you
Here is the statement you'll receive from the gangsters (savefiles@india.com) if you ask, to get the decrypt software to restore the infacted .datawait files:

Hello!

Your test decrypted files attached to the letter.

You need to purchase an decrypt software and unique private key.
After you will get software, start it and decrypt all your data.

Price of private key and decrypt software is 0.05 bitcoin.
0.05 bitcoin ~ 290 usd.

Before paying you can send to us up to 3 files for free decryption.
Send us your personal ID too.
Please note that files must NOT contain valuable information.

After payment we answer all your questions about server safety.
Now strictly recommend close internet connection on server.

The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price.
Video manual:

1 - You need register localbitcoins account:
REMOVED

2 - Buy bitcoins in localbitcoins video:
REMOVED

3 - Send your bitcoins to our wallet video manual:
REMOVED

Any bitcoin exchangers:
REMOVED

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
0
Thank you
Greetings to you all

.datawait is a ransomware which encrypts files. Those of you who became the victims probably have done so by downloading and opening an email attachment or a malicious website.

Changing the file extension is useless. Restoring your system is also useless. There is no third party software able to decrypt the files. The malware can be removed from your computer but the files will remain encrypted do not waste your money with a 3rd party software.

Now paying the pirates will encourage them to continue their evil deed, develop more ransomware even to infect your computer again. Keep in mind that the pirates are dishonest thieves, they have no honour. Suppose you send them money there is no guarantee that they will send you the decryption formula (if there is one) especially that the same formula could be distributed on all forum such as this one for free.

According to our experience, pirates know how to encrypt but don't know the solution to decrypt or clean their own dirt.

Nowadays, most ransomware and scam call centres seems to origin from India.

In order to find if there is an existing decrypting tool, we must identify the variant of the ransomware.

I would appreciate if any two of you members would go to the following site fill the form and report the results here.

Here is the site

https://id-ransomware.malwarehunterteam.com/

Also, could one of you go to #3 above and produce a ZHP Diag log, which may help me to identify all the systems files which were infected or malware.

Good luck

Jules
Community Manager and Virus/Security Contributor
Hi

You have not uploaded the proper file.

Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt)

The file we want is a .txt file.
i have the text file
aftab.eq
Posts
2
Registration date
Saturday November 10, 2018
Status
Member
Last seen
November 12, 2018
> faysalamin -
Do u have the same problem faisal.... Are u from Pakistan???
Anonymous User > faysalamin -
Then please follow my instructions about uploading on tinyupload.
lamalolipop
Posts
2
Registration date
Monday November 12, 2018
Status
Member
Last seen
November 12, 2018
-
i sent you a .txt file
pls help us