• Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools

My AntiSpyware

Free antispyware software, Online Scanners, Instructions on how to remove spyware and malware.

Menu
  • Downloads
  • Threats
    • Adware
    • Browser Hijacking
    • Rogue Anti Spyware
    • Virus
  • Questions and Answers
  • Recover Encrypted Files
  • Free Malware Removal Tools
Home › Virus › Datahelp@iran.ir ransomware virus

Datahelp@iran.ir ransomware virus

Myantispyware team December 1, 2019     No Comment    

Datahelp@iran.ir is an email address that cyber criminals use to contact victims of malware, which belongs to STOP (DJVU) ransomware family. Ransomware is a type of malicious software that blocks access to files by encrypting them, until the victim pays a ransom.

Datahelp@iran.ir

Screenshot of the contents of the ‘_readme.txt’ file (ransom demand message)

Datahelp@iran.ir virus locks up the files using AES-RSA technology, that makes it impossible to unlock the encrypted data by the victim without obtaining a key and a decryptor, which is the only way to decrypt affected files. It can be obtained only in the case of payment of the required ransom through cryptocurrency wallet. The ransomware virus encrypts almost of database, videos, documents, music, web application-related files, archives and images, including common as:

.wbm, .srf, .ibank, .tax, .docx, .mov, .raf, .xll, .raw, .arw, .desc, .wpd, .rb, .xld, .slm, .jpe, .doc, .itdb, .pef, .ai, .avi, .sum, wallet, .t13, .wps, .map, .wdb, .dbf, .itm, .cfr, .kdc, .wsd, .sidd, .ztmp, .vpk, .dwg, .pdd, .wpb, .mcmeta, .accdb, .flv, .iwi, .icxs, .das, .wpt, .d3dbsp, .3fr, .cas, .qic, .rar, .nrw, .wcf, .x3d, .rofl, .xwp, .wmv, .svg, .asset, .upk, .xy3, .arch00, .bkp, .xmind, .xyw, .mp4, .yal, .orf, .0, .xlsx, .zi, .wmf, .sie, .wma, .psk, .vfs0, .x, .menu, .cr2, .qdf, .pdf, .dmp, .xls, .mef, .ysp, .ntl, .fpk, .wire, .xlgc, .m2, .kdb, .pptx, .sb, .xdl, .wri, .zdb, .odm, .zdc, .wpe, .vtf, .csv, .wdp, .wbk, .mdbackup, .wsh, .vpp_pc, .pkpass, .sidn, .1, .sav, .1st, .z3d, .odp, .docm, .wn, .wbz, .txt, .zip, .lbf, .big, .ltx, .xlsb, .bik, .wot, .lrf, .py, .w3x, .r3d, .itl, .rgss3a, .sid, .db0, .tor, .mdb, .indd, .zabw, .wpd, .snx, .sql, .hkdb, .wma, .crw, .wp4, .eps, .odb, .wbc, .mddata, .p12, .layout, .m3u, .xbplate, .re4, .rtf, .vdf, .esm, .3dm, .xls, .sr2, .x3f, .y, .wps, .wp5, .pptm, .xf, .ptx, .cdr, .wm, .yml, .odc, .der, .cer, .wmo, .wbd, .psd, .wb2, .xml, .wp, .xlsx, .x3f, .ws, .t12, .wsc, .png, .z, .dng, .2bp, .js, .ncf, .bc7, .xlsm, .zip, .wav, .xlsm, .dxg, .p7c, .ppt, .odt, .sis, .gho, .wp6, .forge, .dcr, .iwd, .hkx, .jpeg, .fsh, .wpw, .wpa, .srw, .bc6, .xar, .xlk, .pak, .gdb, .wmd, .zw

With the encryption process is finished, all encrypted files will now have a new extension appended to them. In every directory where there are encrypted files, Datahelp@iran.ir virus drops a file called ‘_readme.txt’. This file contains a ransom note that is written in the English. The ransom message directs victims to make payment in exchange for a key needed to unlock personal files.

Summary

Email address datahelp@iran.ir
Related ransomware STOP (DJVU) family
Ransom note _readme.txt
Ransom amount $980/$490
Removal Free Malware Removal Tools
Decryption Free STOP Djvu Decryptor

 

Text presented in “_readme.txt”:

ATTENTION!

Don't worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-4NWUGZxdHc
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.

To get this software you need write on our e-mail:
datarestorehelp@firemail.cc

Reserve e-mail address to contact us:
datahelp@iran.ir

Your personal ID:

If you find files called ‘_readme.txt’, then your computer is the victim of ransomware attack. First you need to find and remove Datahelp@iran.ir virus. We recommend using free malware removal tools. Only after you are completely sure that the virus has been removed, start decrypting the files.

How to decrypt files encrypted by datahelp@iran.ir virus

Using the STOP decryptor is not difficult, just follow the few steps described below.
 

STOP Djvu decryptor

STOP Djvu decryptor

  • Download STOP Djvu decryptor from here (scroll down to ‘New Djvu ransomware’ section).
  • Run decrypt_STOPDjvu.exe.
  • Add the directory or disk where the encrypted files are located.
  • Click the ‘Decrypt’ button.

1 Star2 Stars3 Stars4 Stars5 Stars (1 votes, average: 5.00 out of 5)
Loading...
Virus

Author: Myantispyware team

Myantispyware is an information security website created in 2004. Our content is written in collaboration with Cyber Security specialists, IT experts, under the direction of Patrik Holder and Valeri Tchmych, founders of Myantispyware.com.

Leave a Reply Cancel reply




New Guides

Mo22.biz
How to remove Mo22.biz pop-ups (Virus removal guide)
gtlbin.pro
How to remove Gtlbin.pro pop-ups (Virus removal guide)
New-message.co pop-ups
How to remove New-message.co pop up scam (Virus removal guide)
Maxcooper.club
How to remove Maxcooper.club pop-ups (Virus removal guide)
Mo21.biz
How to remove Mo21.biz pop-ups (Virus removal guide)

Follow Us

Search

Useful Guides

adwcleaner
AdwCleaner – Review, How to use, Comments
DNSChanger
How to remove DNSChanger malware virus [Updated Apr. 2018]
Managed by your organization chrome virus
Chrome Managed by your organization malware removal guide
How to reset Google Chrome settings to default
How to remove browser hijacker virus (Chrome, Firefox, IE, Edge)

Recent Posts

.Hets file extension. Remove Hets virus. Recover, Decrypt .hets files.
Msop virus
.Msop file extension. Remove Msop virus. Restore .msop files.
hentaifap.land
How to remove Hentaifap.land pop up ads [Chrome, Firefox, IE, Edge]
redlabellondon.com
How to remove Redlabellondon.com pop-ups (Virus removal guide)
How to remove Vnse52.xyz redirect (Virus removal guide)

MYANTISPYWARE.COM

  • About Us
  • Contact Us
  • Privacy Policy

NEED A HELP ?

If you're seeing unwanted pop-ups or ads in your web-browser, you might have an adware installed on your computer. Use the following guide to stop pop-up ads and remove malicious software. Or ask for help here.

Links

  • Downloads
  • Instructions
  • Questions and Answers
  • Free Malware Removal Tools
Copyright © 2004 - 2020 My AntiSpyware - Free antispyware programs and Spyware Removal Instructions.