Geek's Advice

Pezi virus is a 228th version of STOP/DJVU ransomware virus family

Pezi ransomware is a malicious computer virus originating from DJVU ransomware family, also known as STOP ransomware. Once this virus scans and modifies personal files and marks them with .pezi file extension, all information becomes no longer accessible. The virus warns the victim to pay a ransom in a specifically crafted ransom note, which is named _readme.txt. The malware assures that the victim could not open files with any program.

At first, the virus imitates a Windows update screen to distract people from the infection. During this time, all information stored on the computer, including pictures, video, audio, and document files are being encrypted with AES-256 cryptography algorithm.

PEZI virus and similar ransomware-type threats like ZIPE or SQPC corrupt all files on the computer in order to obtain monetary benefits from the victim, also known as a ransom. Following the infection, it drops _readme.txt file as a ransom note. It explains that the information on the infected computer is encrypted, and the only way to reaccess it, is to pay a ransom.

Additionally, cybercriminals warn that there is no other way to get your files back rather than get a decryption tool from them. It is a unique sequence of characters that unlocks files with .pezi file extension.

Usually, victims are asked to transfer a desired amount of money to a particular BitCoin account. This payment mechanism is untraceable. Thus, it is impossible to identify the cyber criminals behind this ransomware.

According to the victims’ of other versions of this virus, such as ZWER, KKLL, COVM, MZLQ or SQPC, the starting amount of the ransom is $490. However, if the computer user refuses to pay it within 72 hours, it increases to $980.

What is more, the ransom note encourages victims to contact the cybercriminals via e-mail. Pezi ransomware virus indicates helpmanager@mail.ch and restoremanager@firemail.cc e-mails as their contact addresses.

Even though theoretically there is a low chance to decrypt the infected files, collaborating with cybercriminals may lead to even more losses. Numerous people report that after paying the ransom, they never received a decryption tool.

DO NOT PAY THE RANSOM TO CRIMINALS.

By paying the ransom, you risk losing your money and supporting cyber crime industry!

Scott Bolton

Therefore, those who agree to pay the asked amount of money risk to not only lose their files forever but also suffer from financial damage. Our security experts suggest you to remove Pezi virus and never agree to the attacker’s demands.

If you have a backup of your files, you can quickly perform Pezi ransomware removal with professional antivirus software. Our top choice is RESTORO that can easily get rid of the virus. Afterward, you can restore your files using a backup.

Threat Summary

Name	Pezi ransomware virus
Type	Ransomware, file-encrypting virus
Extension	.pezi
Family	STOP/DJVU ransomware
Versions	228th versions, others include MZLQ, SQPC, etc.
Ransom note	_readme.txt
Contact e-mail	helpmanager@mail.ch, restoremanager@firemail.cc
Ransom amount	$490-$980
Damage	Displays a fake Windows update screen and encrypts files; Later, they are no longer accessible for the user. The virus steals all passwords saved in victim’s browsers with the help of AZORULT Trojan
Distribution	Spam e-mails, or software cracks on P2P networks
Removal	Remove the malware using instructions given below. To eliminate virus damage for the system, consider using RESTORO

Ransomware spreads via spam e-mails or software cracks on P2P networks

As most of other ransomware variants, this cyber threat reaches its victims either via spam e-mails or downloads from peer-to-peer (P2P) networks. Both ways victims are tricked to download or open links that are embedded with a malicious code to trigger automatic installation of Pezi ransomware.

Cybercriminals send an enormous amount of spam e-mails to people. Usually, they imitate legitimate companies and ask to fill a form or log in into user’s account via the provided link. Unfortunately, the link holds a malicious code that starts an automatic installation of the ransomware.

Since the spam e-mails look exceptionally legit, even the most advanced computer users can be fooled to click on the displayed link. Therefore, our Geek’s Advice team strongly encourages you to take a good look at the e-mail before clicking on anything.

The easiest way to identify an attempt to attack your system is to check the e-mail address. Even though it may contain words of a legitimate company, it can also contain numbers or other characters that reveal a potential cyber attack attempt.

Another way to identify a spam e-mail is to look for grammar mistakes or poorly photoshopped logo images. They may contain poor graphics or even simple misspells. Therefore, always look closely before opening or even clicking on any types of electronic letters.

Furthermore, Pezi ransomware might try to infiltrate your system via fake software downloads on peer-to-peer (P2P) file-sharing websites. Usually, these pages offer to download software cracks or other applications obtained illegally.

Unfortunately, most cybercriminals take advantage of such sites and distribute ransomware under disguise of a well-known software. Therefore, most people fall into the trap and download a file-encrypting virus instead of a desired and promised application.

For this reason, you should avoid trying to get payed software for free at any cost. Instead, protect your computer from cyber attacks and download programs only from verified and official websites.

Pezi ransomware removal instructions

Ransomware-type viruses are the most dangerous ones that can completely corrupt your files. Their elimination requires expertise in IT field and highly developed tech skills. Thus, regular computer users can only remove Pezi virus with the help of a robust antivirus.

If you still don’t have a professional security software or the one you have is not powerful enough, we suggest to download RESTORO. It is an expert recommended program that can not only get rid of the ransomware remains, but also repair virus damage.

Open the application and run a full system scan. Once it detects the malware-related files and quarantines them, you can perform an automatic Pezi ransomware removal. RESTORO then can fix virus damage and help your computer to go back to normal. Follow the instructions at the end of this article for further information.

However, decrypted files require a unique decryption tool. If you don’t have backups, we strongly suggest you read STOP/DJVU decryption article to help you regain access to your data on the infected computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Alternative software recommendations

Malwarebytes Anti-Malware

Removing spyware and malware is one step towards cybersecurity. To protect yourself against ever-evolving threats, we strongly recommend purchasing a Premium version of Malwarebytes Anti-Malware, which provides security based on artificial intelligence and machine learning. Includes ransomware protection. See pricing options and protect yourself now.

System Mechanic Ultimate Defense

If you're looking for an all-in-one system maintenance suite that has 7 core components providing powerful real-time protection, on-demand malware removal, system optimization, data recovery, password manager, online privacy protection and secure driver wiping technology. Therefore, due to its wide-range of capabilities, System Mechanic Ultimate Defense deserves Geek's Advice approval. Get it now for 50% off. You may also be interested in its full review.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Decrypt .pezi files (free decryptor)

If you’re wondering how to decrypt .pezi files, you should download and run STOP Decrypter by Emsisoft (see a full tutorial on how to use it).

Once you download the decryptor, agree to its terms and read the provided conditions when the tool CAN and CANNOT decrypt your files. It is a limited decryptor provided as a free service by Emsisoft. In most cases, you can decrypt your files if they were affected by offline key only.

Once you start the decryptor, choose a folder to decrypt.

At this point, the decryptor will decrypt your files (if encrypted with offline key) or display a message that your files were affected with online key and cannot be recovered. In such case, the only way to restore files affected by Pezi virus is to use data backups.