Datahelp@iran.ir is an email address that cyber criminals use to contact victims of malware, which belongs to STOP (DJVU) ransomware family. Ransomware is a type of malicious software that blocks access to files by encrypting them, until the victim pays a ransom.
Screenshot of the contents of the ‘_readme.txt’ file (ransom demand message)
Datahelp@iran.ir virus locks up the files using AES-RSA technology, that makes it impossible to unlock the encrypted data by the victim without obtaining a key and a decryptor, which is the only way to decrypt affected files. It can be obtained only in the case of payment of the required ransom through cryptocurrency wallet. The ransomware virus encrypts almost of database, videos, documents, music, web application-related files, archives and images, including common as:
.wbm, .srf, .ibank, .tax, .docx, .mov, .raf, .xll, .raw, .arw, .desc, .wpd, .rb, .xld, .slm, .jpe, .doc, .itdb, .pef, .ai, .avi, .sum, wallet, .t13, .wps, .map, .wdb, .dbf, .itm, .cfr, .kdc, .wsd, .sidd, .ztmp, .vpk, .dwg, .pdd, .wpb, .mcmeta, .accdb, .flv, .iwi, .icxs, .das, .wpt, .d3dbsp, .3fr, .cas, .qic, .rar, .nrw, .wcf, .x3d, .rofl, .xwp, .wmv, .svg, .asset, .upk, .xy3, .arch00, .bkp, .xmind, .xyw, .mp4, .yal, .orf, .0, .xlsx, .zi, .wmf, .sie, .wma, .psk, .vfs0, .x, .menu, .cr2, .qdf, .pdf, .dmp, .xls, .mef, .ysp, .ntl, .fpk, .wire, .xlgc, .m2, .kdb, .pptx, .sb, .xdl, .wri, .zdb, .odm, .zdc, .wpe, .vtf, .csv, .wdp, .wbk, .mdbackup, .wsh, .vpp_pc, .pkpass, .sidn, .1, .sav, .1st, .z3d, .odp, .docm, .wn, .wbz, .txt, .zip, .lbf, .big, .ltx, .xlsb, .bik, .wot, .lrf, .py, .w3x, .r3d, .itl, .rgss3a, .sid, .db0, .tor, .mdb, .indd, .zabw, .wpd, .snx, .sql, .hkdb, .wma, .crw, .wp4, .eps, .odb, .wbc, .mddata, .p12, .layout, .m3u, .xbplate, .re4, .rtf, .vdf, .esm, .3dm, .xls, .sr2, .x3f, .y, .wps, .wp5, .pptm, .xf, .ptx, .cdr, .wm, .yml, .odc, .der, .cer, .wmo, .wbd, .psd, .wb2, .xml, .wp, .xlsx, .x3f, .ws, .t12, .wsc, .png, .z, .dng, .2bp, .js, .ncf, .bc7, .xlsm, .zip, .wav, .xlsm, .dxg, .p7c, .ppt, .odt, .sis, .gho, .wp6, .forge, .dcr, .iwd, .hkx, .jpeg, .fsh, .wpw, .wpa, .srw, .bc6, .xar, .xlk, .pak, .gdb, .wmd, .zw
With the encryption process is finished, all encrypted files will now have a new extension appended to them. In every directory where there are encrypted files, Datahelp@iran.ir virus drops a file called ‘_readme.txt’. This file contains a ransom note that is written in the English. The ransom message directs victims to make payment in exchange for a key needed to unlock personal files.
Summary
| Email address | datahelp@iran.ir |
| Related ransomware | STOP (DJVU) family |
| Ransom note | _readme.txt |
| Ransom amount | $980/$490 |
| Removal | Free Malware Removal Tools |
| Decryption | Free STOP Djvu Decryptor |
Text presented in “_readme.txt”:
ATTENTION!
Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-4NWUGZxdHc
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
datarestorehelp@firemail.cc
Reserve e-mail address to contact us:
datahelp@iran.ir
Your personal ID:
If you find files called ‘_readme.txt’, then your computer is the victim of ransomware attack. First you need to find and remove Datahelp@iran.ir virus. We recommend using free malware removal tools. Only after you are completely sure that the virus has been removed, start decrypting the files.
How to decrypt files encrypted by datahelp@iran.ir virus
Using the STOP decryptor is not difficult, just follow the few steps described below.
STOP Djvu decryptor
- Download STOP Djvu decryptor from here (scroll down to ‘New Djvu ransomware’ section).
- Run decrypt_STOPDjvu.exe.
- Add the directory or disk where the encrypted files are located.
- Click the ‘Decrypt’ button.
