File extension changed to .datawait [Closed]

Posts
3
Registration date
Monday November 5, 2018
Last seen
November 6, 2018
- Nov 5, 2018 at 04:58 PM - Latest reply:
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 13, 2018 at 04:12 AM
hi

my jpeg and cr2 file change extension like(sample.jpeg.datawait and sample cr2.datawait)

i already format and reinstall windows and make new partitions.

all jpeg and cr2 file in my external hard disk .and i recopy to desktop after reinstalling window but file cant open


uplode 3 file here: [XXXXXXX]



please give me a solution.
thank you
See more 

46 replies

Best answer
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 5, 2018 at 06:13 PM
1
Thank you
Have you connected to a UNIX server over a local network or VPN.?

To help you and prescribe the remedy, I must make a diagnostic and to do so, I require a report.

1. Open this link and download ZHPDiag :
http://www.nicolascoolman.fr/download/zhpdiag/
(Don't be alarmed is the site is in French, it sometimes happens, the tool will take your system language and allow the download if you get a warning message, ignore it.) Click on the download button

2. Save the file on your Desktop.

3. Double click on ZHPDiag.exe and follow the installation instructions.

(For Vista, Win 7, 8 and 10 users, click right to ensure you run with admin right)

4. Double click on the short cut ZHPDiag on your Destktop.

5 Click on scan
Wait for the tool to finished (maybe a long time)

6. Close ZHPDiag.

7. To transmit the report, click on this link :

http://www.tinyupload.com/index.php

8. Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt).
9. Copy the url link obtained from tinyupload and paste it here in your reply.

CCM Community Manager and Virus/Security Contributor
Jules St-Germain

Community Manager - CCM.net

Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
> lamalolipop - Nov 12, 2018 at 06:59 PM
KMSpico
lamalolipop >
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 12, 2018 at 11:48 PM
what should i do?
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
> lamalolipop - Nov 13, 2018 at 04:12 AM
Purchase a Windows license.
Posts
1
Registration date
Monday November 12, 2018
Last seen
November 12, 2018
- Nov 12, 2018 at 02:28 PM
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
>
Posts
1
Registration date
Monday November 12, 2018
Last seen
November 12, 2018
- Nov 12, 2018 at 05:26 PM
@bryanyam1999

Thanks for the report.

Indeed your system is badly infected all kinds of malware: Trojan, adware, Toolbar.Agents and Hijacker. We can clearly where see where .datawait has lodged itself.

However, you also are using an illegal software to activate Windows programmes. For that reason, we cannot help you remove the viruses and the datawait ransomware.

Sorry
Posts
10849
Registration date
Monday June 3, 2013
Status
Moderator
Last seen
November 15, 2018
- Nov 5, 2018 at 05:02 PM
0
Thank you
upload a screenshot. I beleive another moderator has already explained that Datawait is a sign of a virus. If your files have changed formats, and you DID NOT INSTALL anything, IT IS A VIRUS!
Posts
3
Registration date
Monday November 5, 2018
Last seen
November 6, 2018
- Nov 5, 2018 at 05:57 PM
hi

my jpeg and cr2 file change extension like(sample.jpeg.datawait and sample cr2.datawait)

i already format and reinstall windows and make new partitions.

all jpeg and crs file in my external hard disk and recopy to desktop.but file cant open


uplode 3 file here: [XXXXX removed. We cannot offer posible virus infected files to be distributed. We asked for a screen shot, not of the files. Thank you for understanding. Mark Moderator]

please give me a salution.
thank you
Posts
3
Registration date
Monday November 5, 2018
Last seen
November 6, 2018
- Updated by ac3mark on 7/11/18 at 02:44 PM
0
Thank you
hi thank you for replay.

sir i am already format hardisk make new partition and reinstall window . i have avast pro and antimalawerbit. before format hardisk i save all jpeg and cr2 file in my external harddisk.than i recopy my jpeg and cr2 file on c: desktop. no virus found. here link of my files .for better you understand my problem.

<REMOVED as it links to an infected file]
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 6, 2018 at 05:41 PM
0
Thank you
Just what I expected.

Your external hard disk is infected by a worm and as soon as you connect and open your external hard disk you also reinfect your computer with the same worm.

No antivirus software can prevent worm infections. Having two antivirus software will create conflicts, you should have only one.

Do you wish to know how to get rid of the worm virus?

P.S. It's not replay by reply.:-)
i have this problem how can I fi it please help
Posts
1
Registration date
Friday November 9, 2018
Last seen
November 9, 2018
- Updated by Pduke on 9/11/18 at 10:54 AM
0
Thank you
Same here, any help?
Posts
1
Registration date
Friday November 9, 2018
Last seen
November 9, 2018
- Updated by ac3mark on 13/11/18 at 08:45 AM
0
Thank you
help me ,virus in my pc , message virus
==================================!ATTENTION PLEASE!===========================================

Your databases, files, photos, documents and other important files are encrypted and have the extension: .DATAWAIT
The only method of recovering files is to purchase an decrypt software and unique private key.
After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.
Only we can give you this key and only we can recover your files.
You need to contact us by e-mail BM-2cXonzj9ovn5qdX2MrwMK4j3qCquXBKo4h@bitmessage.ch send us your personal ID and wait for further instructions.
For you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.
Discount 50% avaliable if you contact us first 72 hours.

===============================================================================================

E-mail address to contact us:
BM-2cXonzj9ovn5qdX2MrwMK4j3qCquXBKo4h@bitmessage.ch

Reserve e-mail address to contact us:
XXXXXXX

Your personal id:
XXXXXXX
0
Thank you
and my pc infected by virus , this message from virus


==================================!ATTENTION PLEASE!===========================================

Your databases, files, photos, documents and other important files are encrypted and have the extension: .DATAWAIT
The only method of recovering files is to purchase an decrypt software and unique private key.
After purchase you will start decrypt software, enter your unique private key and it will decrypt all your data.
Only we can give you this key and only we can recover your files.
You need to contact us by e-mail ***@*** send us your personal ID and wait for further instructions.
For you to be sure, that we can decrypt your files - you can send us a 1-3 any not very big encrypted files and we will send you back it in a original form FREE.
Discount 50% avaliable if you contact us first 72 hours.

===============================================================================================

E-mail address to contact us:
***@***

Reserve e-mail address to contact us:
***@***

Your personal id:
003zS4VZvMkabFnY14Vkdq6lt6m9L2x0DtGR9XJ1zuV




any help
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
>
Posts
6
Registration date
Friday November 9, 2018
Last seen
November 10, 2018
- Nov 9, 2018 at 07:18 PM
I will publish a solution on this thread here tomorrow. Just stay tune.

P.S. Did you ever open an email from an unknown source or attachment thereof ?
Posts
2
Registration date
Saturday November 10, 2018
Last seen
November 12, 2018
>
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 10, 2018 at 03:39 PM
Time is running out dear jules... Kindly provide solution for the problem.
Posts
6
Registration date
Friday November 9, 2018
Last seen
November 10, 2018
- Nov 10, 2018 at 02:04 PM
No. But it seems there was a worm included with a downloaded file from a program offer.
Unfortunately my Virus / Malware protection program did not recognize the worm!!
Please let me updated. Tks Attached you'll find more information comming for gangsters channel!!
Posts
6
Registration date
Friday November 9, 2018
Last seen
November 10, 2018
- Nov 10, 2018 at 02:06 PM
Sorry ... of course not attached, but below.
i have same problem i run an installer thinking it is an external windows updater but turned out to be a ransomware, it has a purple dinosaur icon and its name is installer, it was giving me the message ( please don't turn off your pc your updates are being installing ) now all my files, programs, docs, ppt and every type of data is corrupt

will there be any possible solution to retrieve my data? (Jules- ST-Germain)
thank in advance
Posts
1
Registration date
Saturday November 10, 2018
Last seen
November 10, 2018
- Nov 10, 2018 at 01:00 PM
0
Thank you
i have a same problem, DATAWAIT... n malware too .
i already try to clean it, but it not works.
i found File virus with name qlscxb.ex* n try to delete it with cmd promt nbut it cant .
i hope someone can help me to fix the problem
ty
Posts
6
Registration date
Friday November 9, 2018
Last seen
November 10, 2018
- Updated by ac3mark on 12/11/18 at 04:38 PM
0
Thank you
Here is the statement you'll receive from the gangsters (savefiles@india.com) if you ask, to get the decrypt software to restore the infacted .datawait files:

Hello!

Your test decrypted files attached to the letter.

You need to purchase an decrypt software and unique private key.
After you will get software, start it and decrypt all your data.

Price of private key and decrypt software is 0.05 bitcoin.
0.05 bitcoin ~ 290 usd.

Before paying you can send to us up to 3 files for free decryption.
Send us your personal ID too.
Please note that files must NOT contain valuable information.

After payment we answer all your questions about server safety.
Now strictly recommend close internet connection on server.

The easiest way to buy bitcoin is LocalBitcoins site.
You have to register, click Buy bitcoins and select the seller by payment method and price.
Video manual:

1 - You need register localbitcoins account:
REMOVED

2 - Buy bitcoins in localbitcoins video:
REMOVED

3 - Send your bitcoins to our wallet video manual:
REMOVED

Any bitcoin exchangers:
REMOVED

Attention!
Do not rename encrypted files.
Do not try to decrypt your data using third party software, it may cause permanent data loss.
Posts
1
Registration date
Saturday November 10, 2018
Last seen
November 10, 2018
- Nov 10, 2018 at 02:23 PM
0
Thank you
Hi.
I have the same problem.
To better diagnose the problem - here is my story.
- Everything was fine until something suspiscious happened to windows defender. There was no warning - just the program froze. Nothing was happening, so I ignored it.
- And it happened - only a message appeared: Windows update in progress.
- It was doing its thing, but something was not quite right, so I aborted the process.
- System froze and I was not able to do anything
- I restarted the computer and system was not responding in the beginning, then I just opened my external HD wanting to watch some movies
- I tried to open files, but system couldn´t recognize them
- AND IT WAS THE MOMENT I FOUND OUT - I AM HACKED!
- I found the same txt file as MAHDI97 posted above

I formatted PC - that is not the problem.
Now I am just broken. Because all my files and photos stored on external drive are unable to open.

PLEASE, HELP!
IS THERE A WAY TO DECRYPT FILES WITHOUT PAYING THOSE THIEVES?
THANK YOU!
the exact same problem happened to me
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Updated by Jules_St-Germain on 10/11/18 at 05:34 PM
0
Thank you
Greetings to you all

.datawait is a ransomware which encrypts files. Those of you who became the victims probably have done so by downloading and opening an email attachment or a malicious website.

Changing the file extension is useless. Restoring your system is also useless. There is no third party software able to decrypt the files. The malware can be removed from your computer but the files will remain encrypted do not waste your money with a 3rd party software.

Now paying the pirates will encourage them to continue their evil deed, develop more ransomware even to infect your computer again. Keep in mind that the pirates are dishonest thieves, they have no honour. Suppose you send them money there is no guarantee that they will send you the decryption formula (if there is one) especially that the same formula could be distributed on all forum such as this one for free.

According to our experience, pirates know how to encrypt but don't know the solution to decrypt or clean their own dirt.

Nowadays, most ransomware and scam call centres seems to origin from India.

In order to find if there is an existing decrypting tool, we must identify the variant of the ransomware.

I would appreciate if any two of you members would go to the following site fill the form and report the results here.

Here is the site

https://id-ransomware.malwarehunterteam.com/

Also, could one of you go to #3 above and produce a ZHP Diag log, which may help me to identify all the systems files which were infected or malware.

Good luck

Jules
Community Manager and Virus/Security Contributor
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
- Nov 11, 2018 at 05:03 AM
Hi

You have not uploaded the proper file.

Search the directory where you installed ZHPDiag (usually C:\desktop\zhpdiag.txt)

The file we want is a .txt file.
i have the text file
Posts
2
Registration date
Saturday November 10, 2018
Last seen
November 12, 2018
> faysalamin - Nov 12, 2018 at 02:08 AM
Do u have the same problem faisal.... Are u from Pakistan???
Posts
290
Registration date
Friday October 26, 2018
Status
Moderator
Last seen
November 16, 2018
> faysalamin - Nov 12, 2018 at 05:28 AM
Then please follow my instructions about uploading on tinyupload.
Posts
2
Registration date
Monday November 12, 2018
Last seen
November 12, 2018
- Nov 12, 2018 at 01:56 PM
i sent you a .txt file
pls help us