DEHD ransomware aims to restrict access to files on your computer
Contents
DEHD ransomware is a new computer virus variant originating from the infamous STOP/DJVU ransomware family. After sneaking into the target system, it encrypts all files stored on it using robust encryption algorithms. During the attack, the virus marks each affected file with .dehd extension. For example, a file previously named as 1.jpg appears as 1.jpg.dehd and so on. After compromising the system, this ransomware leaves the _readme.txt file in all directories. The note contains a message from virus operators who suggest that the only way to recover files is to pay a ransom and get the DEHD decryption tool in return. Government authorities strongly advise not to contact any cybercriminals in any circumstances.
The DEHD virus attacks the victim’s computer data by encrypting it with the military-grade algorithm. Files are not damaged by ransomware but are not usable with any software until decryption is applied. Hackers are hoping that computer users do not have a backup for recovery. The purpose is that scared person has lost important information (documents, pictures, video and, etc.); in this desperate situation, the decision would be made to contact them via provided emails: manager@mailtemp.ch and helpsupportmanager@airmail.cc
Provided information in generated note pushes the victim to make a reckless decision urgently paying money for a personal ID key to decrypt all data. Motivating to transfer money instantly (max within 72 hours), criminals offer even a discount of 50%. If not enough time to correctly evaluate the stressed situation ransom amount will be doubled from $490 to $980. All conditions and prices are given to seducing money.
If they succeed in enticing you to write an email about the lost data and the redemption amount, you will get strict guidelines for further process. First of all, they hide identity very well, and money will be accepted just in specified cryptocurrency. This communication way is completely untraceable because the crypto should be transferred to a virtual wallet generated from them. This move makes them unreachable by any government agency to make justice by federal law. This allows them to use the crime freely to find more and more victims who pay money.
All worldwide experts, professionals, government institutions, the FBI pressingly advise not even think about contacting hackers. First, of all, it is illegal and forbidden by authorities in any country. Paying money will not guarantee that data will be recovered. By doing this, you will support cyber criminals and be involved in crime, possibly making even bigger harm for yourself and others. However, sometimes you can get one recovered file as proof that the rest data will be restored just after the payment is received, but it is zero guarantee that it will be done.
Receiving any files or emails directly from criminals is extremely risky. Even with one click, you can install data-stealing software. It is very popular to install Trojans like AZORULT and VIDAR, and these apps will work secretly on the operating system without any visible harm like data locking or etc. The worm will collect all your sensitive data: user names and passwords, addresses, bank card details, virtual wallets. Then all information will be collected, and trojan transfers it to developers. They can sell your data on the dark web, they can steal from you directly; also, they can compel you to pay big money for it.
Computer owners who have suffered harm from the STOP/DJVU ransomware family straightway need to isolate the PC from the local network. This will secure other working devices. It is very important to remove DEHD virus completely. This will make safe your not encrypted data. The most trusted and easy way to get rid of this unpleasant situation is trustable antivirus software the newest version will detect it and remove it automatically, just in a couple of clicks. Based on our experience, the INTEGO Antivirus will do the job perfectly. Another step is also very important. It is recommended to scan and check damaged Windows OS files. For this difficult task, you should use RESTORO this software which will do its job automatically.
Ransomware Summary
Name | DEHD Ransomware Virus |
Type | Ransomware; Crypto-malware; Virtual Extortion Virus |
Family | STOP/DJVU |
Encryption type | RSA 2048 + Salsa20 |
Previous versions | KAAA, BGJS, BGZQ (find full list here) |
Version | 369th |
Extension | .dehd |
Cybercriminal emails | manager@mailtemp.ch, helprestoremanager@airmail.cc |
Additional malware dropped | Azorult or Vidar Trojan |
Damage | The ransomware attacks files on victim’s PC system and encrypts them, using .dehd file marker which it appends to the original file name. The virus leaves _readme.txt ransom notes in every folder it affects. This ransomware is known to drop information-stealing Trojans on the system. The ransomware deletes Volume Shadow Copies to prevent access to existing System Restore Points. Some versions may also edit Windows HOSTS file to block access to a specific cybersecurity-related domains. |
Ransom note | _readme.txt |
Ransom demand | $490-$980 in Bitcoin |
Distribution | Victims often download this ransomware along illegal torrent downloads, cracked software, activators, key generators or tools like KMSPico. |
Known software cracks to contain this malware | Corel Draw, Tenorshare 4ukey, Adobe Photoshop, Cubase, Adobe Illustrator, Internet Download Manager, Tally, League of Legends. |
Detection names | Trojan:Win32/Sabsik.FL.B!ml (Microsoft), Trojan.GenericKDZ.82051 (B) (Emsisoft), UDS:Trojan.Win32.Generic (Kaspersky), Gen:Variant.Babar.30049 (BitDefender), Trojan.Agent.UKED (Malwarebytes), ML.Attribute.HighConfidence (Symantec) see all detection name variations on VirusTotal |
Removal | Remove ransomware and related malware from your PC using professional software of your choice. We highly recommend using INTEGO Antivirus. To repair virus damage on Windows OS files, consider scanning with RESTORO. |
REPAIR VIRUS DAMAGE
Scan your system for FREE to detect security, hardware and stability issues. You can use the scan results and try to remove threats manually, or you can choose to get the full version of software to fix detected issues and repair virus damage to Windows OS system files automatically. Includes Avira spyware/malware detection & removal engine.
Ransomware Distribution Ways
The most popular ways to distribute STOP/DJVU ransomware, same as the newest variant DEHD virus, are via P2P networks, fake updaters, third-party downloaders, pirate software, illegal software “key generators” same as “crack” application infiltrates into computer operation system malicious files. Cybercriminals tags the most popular and searchable applications with the newest virus editions. We provided a list of popular software downloaded or activated, not in a legal way.
- Cubase;
- Adobe Photoshop;
- 2K22;
- Tenorshare 4ukey;
- Internet Download Manager;
- AutoCAD;
- Opera browser;
- Adobe Photoshop;
- VMware Workstation;
- Adobe Illustrator;
- Minecraft;
- KMSPico (illegal Windows activation tool).
The only safe and legal way to obtain a wanted product or application is official websites with offers listed for each item. Also, you can get desired app or game from official partners, and it is completely safe. Victims usually search for an illegal way of software download or activation. For this decision, they are not saving but losing much more. This way, official developers lose money and are being robed. For this activity, breaking copyright rules are infringed, which can cause financial fines by local government law to compensate the developer losses. Another “reward” is infected computers, lost files, and sensitive data. Also, this way, you support cybercriminals. Note that malicious files are not spreading in legal ways. Ninety-nine percent of them come from torrents and other illegal ways.
We need to mention that criminals use another channel to spread malicious files via email. They simply attach Microsoft Office files like (PDF, DOCX, XLS) and just only one sloppy download will infect a computer. All these files have macro functions or enabled JavaScript. Usually, ordinary users do not use them, but not hackers. Due to these advanced options virus locks the rest files on the hard drive.
In the technology age, there is no limit to the progress of modern techniques to spread computer viruses. Even advanced users can be caught on this trick. Hackers try to fake real emails by adding symbols instead of letters. This helps them to pretend friends, business partners, colleagues. All emails that you didn’t expect are potentially malicious. Even more, received email can be professionally designed as official eBay, FedEx, Amazon Prime created content for you. Sometimes they try to hide the sender’s email addresses by using spoofing techniques. If you haven’t done any activity: selling, buying, sending, or receiving smth, the received information probably is a shot to catch new victims.
For infected STOP/DJVU ransomware users, we strongly advise not to rush finding decryptors on the internet. It is 100% that decryption code for the newest extensions is not developed yet. It takes time for programmers to find a way to unlock each new version, even not always able to do it. After infection, if you find offers for decryptors, it is probably a fake ZORAB STOP/DJVU decryptor. This action can damage your files completely, and later the original decryptor won’t help.
Comprehensive Technical Information About the Virus
This paragraph detailed explains the activity of DEHD virus contagion of the Operating System. This is useful for the experienced user who has IT skills removing ransomware manually. The very first action after the malicious file is opened in the computer regenerates build.exe or build2.exe and winupdate.exe. Then it generates duplicated windows screen letting it hide illegal actions. The worm collects information about your workstation: Region, Country, City, Location (latitude and longitude), Zipcode Time zone, and etc. Now it’s time to go online using your network to make the connection to https[:]//api.2ip.ua/geo.json All stolen information is saved on the geo.json file on the hacker’s server online mentioned before.
Same time another document is generated and delivered to them – the information.txt file. All confidential details like IP addresses, Mac addresses, Hardware, Software are saved on it.
STOP/DJVU ransomware family developers for all created extensions made a rule exception. Their system scans countries of infected users and if it detects: Russian Federation, Belarus, Ukraine, Syria, Crimea, Uzbekistan, Armenia, Tajikistan, Kazachstan, and Kyrgyzstan. If it detects that you are on it, it will stop doing any further actions, you won’t get any harm, and your files won’t be locked, the worm will pass away from the system. Differently, if you are not on the list and belong to the rest of the world, infiltrating steps will go further. Command&Control server generates a unique encryption key directly linked to personal ID. All these important details will be saved to bowsakkdestx.txt and PersonalID.txt files.
Now is the most important part of it. If encryption goes smoothly and successfully will be created online key. This variant is bad news to the victim because it is zero chance to recover files without the original key. Any decryptor or programmer can help with this. If encryption doesn’t go smoothly and has some difficulties, an offline key will be generated. It is really good news because it has great chances to get lost data back. Both variants lock files by the military-grade algorithm ( Salsa20 & RSA-2048). The question is hot to recognize which type of encryption is applied? It is very easy to recognize even for a beginner in hackers demand you will get unique personal ID if the last two letters are t1 it is offline decryption, any another variant is online.
The final stage – computer users cannot open files with any application, for example, picture affected by ransomware changes extension, in this case by DEHD virus, Holidays.jpg has changed to Holidays.dehd also nearby in the same directory _readme.txt note will be left.
Some STOP/DJVU ransomware edition has extra functions, and it will delete. Then, the malware will delete Volume Shadow preventing computer users from the ability to use Windows OS function recover to existing System Restore Point. It helps to recover computer data and files to date it was created restore point. Hackers also created their own blacklist of websites with free recovery instructions like ours to the Windows HOSTS file. Browsers won’t load the blocked websites, showing DNS_PROBE_FINISHED_NXDOMAIN error; you can fix it by reading provided guide.
Delete DEHD Virus and Repair Encrypted Files
If you don’t have antivirus software or you are using it, but it passed DEHD virus, our suggestion is to download one of the most powerful apps – INTEGO Antivirus it will delete ransomware leftover files and prevent further harm. Also recommended to use the application to repair or rewrite damaged Windows OS files, for possible damage, use a free scan powered by RESTORO if it will detect errors for the repair, you will need to buy a license.
To feel secure, we strongly recommend changing all existing passwords you use on this machine (online and offline). Use your backups from HDD, flash, or cloud storage to recover lost data. Also recommended reporting this attack to local law institutions to help them track and investigate criminals. Exam this informative article decrypt files encrypted by certain STOP/DJVU variants to check the newest extensions available to decrypt. Follow our guidelines to remove DEHD ransomware completely.
OUR GEEKS RECOMMEND
Our team recommends removing malware using a professional antivirus software.
REMOVE THREATS WITH ROBUST ANTIVIRUS
Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.
Use INTEGO Antivirus to remove detected threats from your computer.
GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.
DEHD Ransomware Virus Removal Guidelines
Method 1. Enter Safe Mode with Networking
Step 1. Start Windows in Safe Mode with Networking
Before you try to remove DEHD Ransomware Virus virus, you must start your computer in Safe Mode with Networking. Below, we provide the easiest ways to boot PC in the said mode, but you can find additional ones in this in-depth tutorial on our website – How to Start Windows in Safe Mode. Also, if you prefer a video version of the tutorial, check our guide How to Start Windows in Safe Mode on Youtube.
Instructions for Windows XP/Vista/7 users
- First of all, turn off your PC. Then press the Power button to start it again and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. This launches the Advanced Boot Options menu.
- Use arrow keys on the keyboard to navigate down to Safe Mode with Networking option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Open Windows Start menu, then press down the Power button. On your keyboard, press down and hold the Shift key, and then select Restart option.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Networking. In this case, it is the F5 key.
Step 2. Remove files associated with the virus
Now, you can search for and remove DEHD Ransomware Virus files. It is very hard to identify files and registry keys that belong to the ransomware virus, Besides, malware creators tend to rename and change them repeatedly. Therefore, the easiest way to uninstall such type of a computer virus is to use a reliable security program such as INTEGO Antivirus. For virus damage repair, consider using RESTORO.
Special Offer
Compatibility: Microsoft Windows
See Full Review
RESTORO is a unique PC Repair Tool which comes with an in-built Avira scan engine to detect and remove spyware/malware threats and uses a patented technology to repair virus damage. The software can repair damaged, missing or malfunctioning Windows OS files, corrupted DLLs, and more. The free version offers a scan that detects issues. To fix them, license key for the full software version must be purchased.
Method 2. Use System Restore
In order to use System Restore, you must have a system restore point, created either manually or automatically.
Step 1. Boot Windows in Safe Mode with Command Prompt
Instructions for Windows XP/Vista/7 users
- Shut down your PC. Start it again by pressing the Power button and instantly start pressing F8 button on your keyboard repeatedly in 1-second intervals. You will see Advanced Boot Options menu.
- Using arrow keys on the keyboard, navigate down to Safe Mode with Command Prompt option and press Enter.
Instructions for Windows 8/8.1/10/11 users
- Launch Windows Start menu, then click the Power button. On your keyboard, press down and hold the Shift key, and then choose Restart option with the mouse cursor.
- This will take you to Windows Troubleshoot screen. Choose Troubleshoot > Advanced Options > Startup Settings > Restart. Tip: If you can't find Startup Settings, click See more recovery options.
- In Startup Settings, press the right key between F1-F9 to enter Safe Mode with Command Prompt. In this case, press F6 key.
Step 2. Start System Restore process
- Wait until system loads and command prompt shows up.
- Type cd restore and press Enter, then type rstrui.exe and press Enter. Or you can just type %systemroot%system32restorerstrui.exe in command prompt and hit Enter.
- This launches System Restore window. Click Next and then choose a System Restore point created in the past. Choose one that was created before ransomware infection.
- Click Yes to begin the system restoration process.
After restoring the system, we recommend scanning the system with antivirus or anti-malware software. In most cases, there won't be any malware remains, but it never hurts to double-check. In addition, we highly recommend checking ransomware prevention guidelines provided by our experts in order to protect your PC against similar viruses in the future.
Alternative software recommendations
Malwarebytes Anti-Malware
Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.
System Mechanic Ultimate Defense
If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.
Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.
Decrypt DEHD files
Fix and open large DEHD files easily:
It is reported that STOP/DJVU ransomware versions encrypt only the beginning 150 KB of each file to ensure that the virus manages to affect all files on the system. In some cases, the malicious program might skip some files at all. That said, we recommend testing this method on several big (>1GB) files first.
- Create a copy of encrypted file to a separate folder using Copy > Paste commands.
- Now, right-click the created copy and choose Rename. Select the DEHD extension and delete it. Press Enter to save changes.
- In the prompt asking whether you want to make the changes as file might become unusable, click OK.
- Try opening the file.
STOP/DJVU decryption tool usage guide
STOP/DJVU ransomware versions are grouped into old and new variants. DEHD Ransomware Virus is considered the new STOP/DJVU variant, just like KAAA, BGJS, BGZQ (find full list here). This means full data decryption is now possible only if you have been affected by offline encryption key. To decrypt your files, you will have to download Emsisoft Decryptor for STOP DJVU, a tool created and maintained by a genius security researcher Michael Gillespie.
Note! Please do not spam the security researcher with questions whether he can recover your files encrypted with online key - it is not possible.
In order to test the tool and see if it can decrypt DEHD files, follow the given tutorial.
- Download the decryption tool from Emsisoft.
- Click the little arrow next to your download and choose Show in Folder.
- Now, right-click the file and choose Run as Administrator. If asked, enter administrator's password.
- In UAC window, click Yes.
- Click Yes to agree to software terms in both windows.
- The tool will automatically include C:// disk as a location to decrypt. The file recovery tool will prepopulate the locations to scan, including connected data storage drives or network drives. Click Add folder if you wish to add additional locations.
In Options tab, you can choose to keep encrypted file copies. We recommend leaving this option selected, especially if you do not know if the decryption tool will work. - Click Decrypt to start restoring DEHD files. You will see the progress in the Results tab. Here, you can see messages from the tool, such as whether the decryption procedure is successful, or you need to wait for an update.
You might also be informed that online key was used to encrypt your files. In such case, the decryption tool won't work for you, and the only way to recover your files is to use a data backup.
Meanings of decryptor's messages
The DEHD decryption tool might display several different messages after failed attempt to restore your files. You might receive one of the following messages:
Error: Unable to decrypt file with ID: [example ID]
This message typically means that there is no corresponding decryption key in the decryptor's database.
No key for New Variant online ID: [example ID]
Notice: this ID appears to be an online ID, decryption is impossible
This message informs that your files were encrypted with online key, meaning no one else has the same encryption/decryption key pair, therefore data recovery without paying the criminals is impossible.
Result: No key for new variant offline ID: [example ID]
This ID appears to be an offline ID. Decryption may be possible in the future.
If you were informed that an offline key was used, but files could not be restored, it means that the offline decryption key isn't available yet. However, receiving this message is extremely good news, meaning that it might be possible to restore your DEHD extension files in the future. It can take a few months until the decryption key gets found and uploaded to the decryptor. We recommend you to follow updates regarding the decryptable DJVU versions here. We strongly recommend backing up your encrypted data and waiting.
Report Internet crime to legal departments
Victims of DEHD Ransomware Virus should report the Internet crime incident to the official government fraud and scam website according to their country:
- In the United States, go to the On Guard Online website.
- In Australia, go to the SCAMwatch website.
- In Germany, go to the Bundesamt für Sicherheit in der Informationstechnik website.
- In Ireland, go to the An Garda Síochána website.
- In New Zealand, go to the Consumer Affairs Scams website.
- In the United Kingdom, go to the Action Fraud website.
- In Canada, go to the Canadian Anti-Fraud Centre.
- In India, go to Indian National Cybercrime Reporting Portal.
- In France, go to the Agence nationale de la sécurité des systèmes d’information.
If you can't find an authority corresponding to your location on this list, we recommend using any search engine to look up "[your country name] report cyber crime". This should lead you to the right authority website. We also recommend staying away from third-party crime report services that are often paid. It costs nothing to report Internet crime to official authorities.
Another recommendation is to contact your country's or region’s federal police or communications authority.
Frequently Asked Questions
You can only open DEHD files if you have the decryption key, or if you were affected by offline encryption type.
To figure out whether you were affected by offline encryption, please go to C:/SystemID/PersonalID.txt and see if the string inside of it ends in t1. You can also try using Emsisoft Decryptor for STOP/DJVU.
Please follow the guidances provided by the official DEHD decryption tools and believe what they say. If they say it is impossible to decrypt, it really is so. There is no magic tool or human capable of decrypting your files hiding somewhere. Encryption is a technique created to be nearly impossible to decrypt without a special private key (held by the criminals).
We advise scanning with anti-virus, anti-malware, malware removal tools or software like RESTORO to eliminate virus damage on the system. If you do not trust using a single tool, try running one after another. However, we do not recommend keeping several security programs on a computer at once as they can interfere with each other's work.
Beware of fake DEHD decryption tools circulating around the web. Cyber criminals are uploading them to various shady websites, also might be promoting them via suspicious Youtube videos. These programs can infect your computer even more heavily (Trojans, miners, etc.). We suggest being extremely cautious around the web. If there will be an official STOP/DJVU decryption tool available, it will be widely discussed in public media.
Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.
Leave a Reply