DataWait Ransomware

DataWait Ransomware belongs to STOP Ransomware family as it is similar to other file-encrypting threats from it, for example, PUMA Ransomware, KEYPASS Ransomware, etc. The malware encrypts data on the infected device and appends .DATAWAIT extension to it. Afterward, it ought to open a ransom note that says the threat’s developers have decryption tools, which could restore all data to the way it was. Unfortunately, they do not mean to give the needed tools free of charge, as they want to get 290 US dollars. What’s more, victims interested in paying the ransom are supposed to contact the DataWait Ransomware’s developers for further instructions. It may not be a good idea given there are no reassurances the promised tools will be delivered as promised. This is why we do not recommend putting up with any demands if you are not willing to risk your savings.

In the rest of the article, we explain more about the malicious application. For starters, we ought to discuss where DataWait Ransomware might come from. Our researchers say it is most likely the malware could be spread via Spam emails, or it might be dropped on the system by exploiting unsecured RDP (Remote Desktop Protocol) connections. Consequently, we advise doing two particular things as a start if you wish to protect your computer from threats alike. Firstly, you should never open attachments received with Spam or from unknown senders without scanning them with a reliable antimalware tool first. Secondly, you should make sure your system has no vulnerabilities that could be exploited, which means you should change old passwords, update outdated software, and so on. In addition, we suggest installing a legitimate antimalware tool that could help you keep the system protected.

Next, we should talk about what happens if DataWait Ransomware infects a device. At first, the threat might open a window saying the system is installing necessary updates. In reality, the malware should be encrypting private files of the computer’s user. During this process, the malicious application might block user’s Task Manager to prevent him from stopping the encryption. Also, our researchers noticed that the malware might make the explorer.exe crash from time to time. Before too long, it should create text documents called !readme.txt with a ransom note inside of them. According to the message, DataWait Ransomware encrypted all valuable data, and there is no other way to recover it without special decryption tools that only the hackers behind the threat have. To learn how much it would cost and how to transfer the ransom, users are asked to email the malicious applications developers. There is also an additional condition that says victims have to email hackers within 72 hours.

The sum is quite huge as some hackers ask for less than 50 US dollars, but it is not the largest one either. Thus, you should decide for yourself if you are willing to risk throwing 290 US dollars away, since there is a possibility that something could go wrong. As you see, DataWait Ransomware’s developers could change their mind and demand for more money. Not to mention they may not bother sending promised tools as once the payment is transferred, there is no way to take it back. In case, you do not want to take any chances or have a backup, for example, on removable media devices or cloud storage, from which you can restore all your data, we advise deleting DataWait Ransomware.

Removing the malicious application manually could be a difficult process as it creates a lot of various files upon its installation. Nonetheless, if you feel up to the task, we offer the instructions located below. They explain where to search for the malware’s data and how to delete it step by step. Still, if the task looks too complicated, you should not hesitate to employ a reliable antimalware tool, as ensuring the threat gets erased is essential for your system’s security. It is possible that while it is on the system it could restart with the operating system, and encrypt new data, which is another reason we do not recommend leaving DataWait Ransomware unattended.

Restart the computer in Safe Mode

Windows 8/Windows 10

1. Tap Win+I for Windows 8 or open Start menu for Windows 10.
2. Press the Power button.
3. Click and hold Shift then click Restart.
4. Pick Troubleshoot and choose Advanced Options.
5. Go to Startup Settings and click Restart.
6. Press F5 and restart the PC.

Windows XP/Windows Vista/Windows 7

1. Navigate to Start, select Shutdown options, and pick Restart.
2. Press and hold F8 when the PC starts restarting.
3. Mark Safe Mode with Networking.
4. Select Enter and log on.

Eliminate DataWait Ransomware

1. Click Win+E.
2. Find these locations:
   %TEMP%
   %USERPROFILE%\desktop
   %USERPROFILE%\downloads
3. Look for the threat’s installer, e.g., updatewin.exe; then right-click it and press Delete.
4. Then find these paths:
   %USERPROFILE%\Local Settings\Application Data
   %LOCALAPPDATA%
5. Search for malicious .exe files with random names, right-click them, and press Delete.
6. Recheck these paths:
   %LOCALAPPDATA%
   %USERPROFILE%\Local Settings\Application Data
7. Look for folders with long random titles, e.g., Afefd188-12fe-81Ae-cFb1-do6a241B4671, right-click them, and choose Delete.
8. Then check these paths one last time:
   %USERPROFILE%\Local Settings\Application Data
   %LOCALAPPDATA%
9. Locate files called script.ps1 or similarly, right-click them and press Delete.
10. Exit File Explorer.
11. Press Win+R.
12. Type Regedit and press Enter.
13. Go to this path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
14. Locate a value name called SysHelper, right-click it and press Delete.
15. Exit Registry Editor.
16. Empty Recycle bin.
17. Restart the system.