.datawait file type (1 Viewer)

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
Dear Developers,
I ran in to a virus problem of my all office docs including access files.
The problem is all my files and docs has been renamed to filename.filetype.datawait

And i dont know why it happened , any solution please help me. thank you
 

Ranman256

Well-known member
Local time
Today, 02:03
Joined
Apr 9, 2015
Messages
4,336
did you try to rename a file and remove the '.datawait' and see if the file worked ok?
if so, you can use the code to rename all files to remove the .datawait.
(coming soon)
 

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
did you try to rename a file and remove the '.datawait' and see if the file worked ok?
if so, you can use the code to rename all files to remove the .datawait.

Tried it, but saying unrecognized database format .
 

isladogs

MVP / VIP
Local time
Today, 06:03
Joined
Jan 14, 2017
Messages
18,164
You said all Office files had been renamed. Are you sure this file is/was a database?

Try opening the file in a text editor such as Notepad. Assuming it's not encrypted with a password you should be able to see some intelligible info in there.
If you can, first make a backup then try DECOMPILING which will remove any corrupt code and possibly fix your problem.
Please do NOT upload your files here until you have fixed this issue. :eek:
Good luck
 

Ranman256

Well-known member
Local time
Today, 02:03
Joined
Apr 9, 2015
Messages
4,336
Code:
Public Sub ScanSubfolders()
'---------
Dim FileSystem As Object
Dim HostFolder As String

HostFolder = "G:\Documents\DIY\"

Set FileSystem = CreateObject("Scripting.FileSystemObject")
Do1Folder FileSystem.GetFolder(HostFolder)
End Sub


'---------
private Sub Do1Folder(Folder)
'---------
Dim SubFolder
 Dim oFile
Dim i As Integer
Dim vOld, vNew, vDir
Const kFIND = ".datawait"
'Const kFIND = ".jpg"

    For Each SubFolder In Folder.SubFolders
           'Debug.Print SubFolder
        Do1Folder SubFolder
    Next
    
    vDir = Folder & "\"
    For Each oFile In Folder.Files
          If InStr(oFile.Name, kFIND) > 0 Then
                vOld = oFile
                 i = InStr(oFile.Name, kFIND)
                vNew = vDir & Left(oFile.Name, i - 1)
                
                  MsgBox vOld & vbCrLf & vNew
                ' Name vOld As vName
          End If
    Next
End Sub
 

Minty

AWF VIP
Local time
Today, 06:03
Joined
Jul 26, 2013
Messages
10,346
The files are almost certainly encrypted by the virus. I hope you have backups.

We had a attack of this nature at work, we literally watched one of our file servers files being systematically renamed and encrypted on the fly. It was scarily fast. Luckily we have nightly secured backups, so only lost a very small amount of work.
 

isladogs

MVP / VIP
Local time
Today, 06:03
Joined
Jan 14, 2017
Messages
18,164
Minty
Just out of interest, how was this virus able to get 'past security' and onto the server?
 

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
Code:
Public Sub ScanSubfolders()
'---------
Dim FileSystem As Object
Dim HostFolder As String

HostFolder = "G:\Documents\DIY\"

Set FileSystem = CreateObject("Scripting.FileSystemObject")
Do1Folder FileSystem.GetFolder(HostFolder)
End Sub


'---------
private Sub Do1Folder(Folder)
'---------
Dim SubFolder
 Dim oFile
Dim i As Integer
Dim vOld, vNew, vDir
Const kFIND = ".datawait"
'Const kFIND = ".jpg"

    For Each SubFolder In Folder.SubFolders
           'Debug.Print SubFolder
        Do1Folder SubFolder
    Next
    
    vDir = Folder & "\"
    For Each oFile In Folder.Files
          If InStr(oFile.Name, kFIND) > 0 Then
                vOld = oFile
                 i = InStr(oFile.Name, kFIND)
                vNew = vDir & Left(oFile.Name, i - 1)
                
                  MsgBox vOld & vbCrLf & vNew
                ' Name vOld As vName
          End If
    Next
End Sub

-----------------------------------------------------------

It worked for changing the file type, but i cannot open the file , Do needful, thank you.
 

Minty

AWF VIP
Local time
Today, 06:03
Joined
Jul 26, 2013
Messages
10,346
Minty
Just out of interest, how was this virus able to get 'past security' and onto the server?

Someone opened something they shouldn't have, and our corporate anti-virus just didn't see it. The file server was exactly that, a office centralised file storage location, that everyone has access to. That server was isolated from all the others directly so nothing spread from there. At the time it was a very new variant of whatever ransomware thing it was.

But I'd like to think that AV programs have got smarter at spotting this type of nasty and the processes they use these days.
 

Uncle Gizmo

Nifty Access Guy
Staff member
Local time
Today, 06:03
Joined
Jul 9, 2003
Messages
16,224
Just as a warning to anyone that is using Google Drive and having their files synchronized. You might have the impression that you are safe, however don't forget, the corrupted/infected files will be uploaded/synchronized to Google Drive. So you won't have a decent backup. Always have a physically separate backup say on Amazon or best of all I reckon, USB sticks.

Sent from my SM-G925F using Tapatalk
 

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
You said all Office files had been renamed. Are you sure this file is/was a database?

Try opening the file in a text editor such as Notepad. Assuming it's not encrypted with a password you should be able to see some intelligible info in there.
If you can, first make a backup then try DECOMPILING which will remove any corrupt code and possibly fix your problem.
Please do NOT upload your files here until you have fixed this issue. :eek:
Good luck


it says unrecognize file type. how can i decompile that file?


while trying to decompile i am getting that message like unrecognizable file type.
 
Last edited:

isladogs

MVP / VIP
Local time
Today, 06:03
Joined
Jan 14, 2017
Messages
18,164
I have used decompiling many times to fix databases where it says unrecognised file format.
However, I've never needed to do so after a virus attack.
Obviously I don't know what the virus has done to your files so it may well not be possible.
Have you run a full virus scan of your hard drive?

In case you don't know how to decompile, see http://www.fmsinc.com/microsoftaccess/Performance/Decompile.asp
 

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
I have used decompiling many times to fix databases where it says unrecognised file format.
However, I've never needed to do so after a virus attack.
Obviously I don't know what the virus has done to your files so it may well not be possible.
Have you run a full virus scan of your hard drive?

In case you don't know how to decompile, see http://www.fmsinc.com/microsoftaccess/Performance/Decompile.asp


yes, i have anti virus and i cleaned the whole drives, but office files are not going to opening....!
 

Minty

AWF VIP
Local time
Today, 06:03
Joined
Jul 26, 2013
Messages
10,346
They won't open with anything.
They have almost certainly been encrypted, rendering them useless. If you have backups that mean you haven't lost much work, simply reload them.

If not you've probably either lost the information or will have to pay someone to unlock it for you.
 

isladogs

MVP / VIP
Local time
Today, 06:03
Joined
Jan 14, 2017
Messages
18,164
You and I can't.
There is a company that can do so but it's expensive.
Do a search for EverythingAccess.com
 

Reshmi mohankumar

Registered User.
Local time
Today, 11:33
Joined
Dec 5, 2017
Messages
101
Hi I just recovered a .jpg file from virus, but the same process for next image its not working, but if i randomly one after another somewhere its works, but in between files are still encrypted. So any will help me to resolve by using recovered file?? Thank you
 

Minty

AWF VIP
Local time
Today, 06:03
Joined
Jul 26, 2013
Messages
10,346
As we have said more than once, if the files are encrypted, then unless you pay someone to decrypt them, they won't be retrievable.

We don't have some magic bullet to get around the problem, sorry.
The firm I work for does hardware level data recovery and even we can't get around proper encryption. It's used for a reason.
 

abu5515

New member
Local time
Today, 10:03
Joined
Nov 27, 2018
Messages
3
hello eveeryone
i have been hit by ransomware .DATAWAIT which changed all my files extensions and need to be decrypt all files are on other HDD after i formatted the system can anyone help please?
 

Users who are viewing this thread

Top Bottom