Geek's Advice

LEZP ransomware leaves no chances to recover encrypted data

LEZP ransomware is the latest variant (221th version) of STOP/DJVU file-encrypting virus. The virus was discovered by malware researcher M. Gillespie. The malware operates by encrypting all personal files on victim’s computer or network. Following a successful attack, the ransomware marks corrupted files with .lezp file extension, which is where the virus name comes from. Lastly, the virus creates text notes called _readme.txt, which present cybercriminals’ demand to pay a specified ransom (ranging between $490 or $980 in Bitcoin) to decrypt data. The attackers suggest writing them via provided emails, helpdatarestore@firemail.cc or helpmanager@mail.

LEZP virus is extremely dangerous and stealthy as it also installs AZOrult password-stealing malware on the system. The purpose of this is to steal all of victim’s login credentials and transmit to the cybercriminals. Exposing personal details to attackers can have fatal consequences, so make sure you remove the malware from your system safely – use instructions supplied by our experts.

The 221th version of DJVU virus, namely LEZP ransomware, tends to infect the computer system stealthily. It starts encrypting personal files, such as documents, photos, videos, databases, and other data types. Meanwhile, the ransomware tends to display a fake Windows update screen to trick the victim into believing that there is simply a regular Windows process running, and there is nothing to worry about.

However, the virus is set to apply military-grade encryption on victims files, and as it does so, it also marks them with specific extensions to make the affected files distinguishable. As a result, encrypted files appear to be LEZP file type, and cannot be opened with any program.

In addition, LEZP virus modifies Windows HOSTS file and adds various computer or cybersecurity-themed website URLs to it. This results in web browsing restrictions preventing the victim from visiting these sites. It is believed that this virus creates such URL blocking list so that the victim could not find any information regarding ransomware removal or decryption methods.

Before you start searching for data recovery methods or related information, we strongly encourage you to remove LEZP ransomware virus and the malware it installed first. You can do so by using anti-malware software. Make sure you follow the instructions explaining how to prepare your system for the virus removal – you can find them below this article.

_readme.txt note holds a message from criminals

The virus creates and drops a message from criminals in _readme.txt notes, which it saves in each affected file directory. The message begins by informing the victim that the only way to decrypt .lezp files is to pay the ransom and receive the decryption key from the attackers.

Don’t worry, you can return all your files!
All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.

The criminals then go on by stating that they can prove the effectiveness of the decryption tool. They suggest the victim to send one encrypted file to them.

What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.

The attackers then introduce the ransom price – the price of the decryption software. They suggest that the victim can get 50% discount if one contacts the criminals within 72 hours.

Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.

Finally, the ransom note provides contact emails –helpdatarestore@firemail.cc and helpmanager@mail.ch.

We strongly suggest you not to pay the ransom and not support the evil malware development business. If you pay up, you simply speed up the malware industry, which results in even more attacks and more victims.

Threat Summary

The main question – can you recover files with .lezp extension?

Victims affected by the LEZP file virus firstly look for ways to decrypt their data. They start searching for data decryption tools, recovery tools and other software, hoping to find an easy fix for the problem.

Unfortunately, in probably 99% of cases, it is impossible to decrypt files locked by LEZP virus without having a data backup created prior to the attack.

However, let’s discuss the remaining 1%. To be precise, these percentage proportions are for general understanding – they are not based on a research, but they do reflect the actual, practical situation. Now let’s get into the data decryption explanation.

When new STOP/DJVU version infects a computer, it attempts to connect to its remote server, used to generate unique encryption/decryption key pairs for victims. If the internet connection is available on the infected computer, and if the server responds, the victim’s files gets encrypted with so-called online key, and then it is impossible to recover files without paying. There is no other way to get the decryption tool. No matter how important your files were, it is impossible and there is no way to revert the encryption process yourself. It is the whole point of encryption.

However, when LEZP ransomware fails to connect to its server, it uses a so-called offline encryption key. In other words, computers on which the virus fails to get the online encryption key, all are affected by the same encryption key. And if someone pays the ransom, gets the key and shares it with Emsisoft security researchers – STOP/DJVU decryption tool gets updated.

In all cases, you can recover encrypted files if you do have a data backup stored on an external data storage device.

STOP/DJVU distributes versions via illegal downloads

LEZP file virus, just like previous DJVU versions (JOPE, OPQZ, LALO, MADO) hides in malicious online downloads. The developers of the virus tend to inject the virus into files that many victims look up online to download for free. In other words, the most common ransomware hiding locations are software cracks, keygens, and tools like KMSPico.

Many DJVU victims report downloading something “they shouldn’t have”, which includes software, game cracks. Instead of installing their desired software and activating its licensed version illegally, they end up with piles of corrupted data. We strongly recommend you to never employ such practices, as you can never know which download will contain a trigger for a malicious payload.

To prevent ransomware or other malware-type attacks, stay away from illegal downloads, suspicious sites or emails altogether. These are the most common malware distribution channels.

Eliminate LEZP ransomware and get your files back

The first thing you should do now is to remove LEZP ransomware virus from your computer safely. This will help to secure your computer as it is currently more prone to further malware attacks. We strongly recommend you to follow the instructions presented below, which explain how to start your PC in Safe Mode and then run a trustworthy security program to eliminate the said virus along with malware it installed alongside it.

LEZP virus removal relies on elimination of malicious processes and files, and such operations should be done either automatically or by advanced computer specialist. We do not recommend doing it manually as you might miss some important computer locations to clean. Finally, you should change all of your passwords after deleting malware from your system due to Azorult malware activity.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Matt Corey

Matt Corey is passionate about the latest tech news, gadgets and everything IT. Matt loves to criticize Windows and help people solve problems related to this operating system. When he’s not tinkering around with new gadgets he orders, he enjoys skydiving, as it is his favorite way to clear his mind and relax.