Ccza ransomware (virus) - Recovery Instructions Included

Ccza virus Removal Guide

What is Ccza ransomware?

Ccza ransomware locks users' personal files until they pay for a decryption tool

Ccza ransomwareCcza ransomware is a Windows virus that specializes in locking all personal data

Ccza ransomware is a dangerous virus that can damage the operating system and lock users' personal files, like photos, videos, and documents. It belongs to the Djvu malware family that releases new variants weekly. We previously wrote about other variants, like Cceq, Cceo, Vvyu, and many others.

When it infiltrates the system, it appends the affected files with the .ccza extension. So if a file was previously named picture.jpg, after encryption,[1] it would look like this – picture.jpg.ccza. The icons are also changed to blank pages, so thumbnails are unavailable.

Shortly after the encryption process is done, a ransom note named “_readme.txt” is generated on the machine. Here, the cybercriminals state their conditions. The main goal of a ransomware attack is to extort money from innocent people. We recommend reading our guide fully to learn about your options.

NAME Ccza ransomware
TYPE Ransomware, cryptovirus, data locking malware
MALWARE FAMILY Djvu ransomware
DISTRIBUTION Infected email attachments, torrent sites, malicious ads
RANSOM NOTE _readme.txt
RANSOM AMOUNT $490/ $980
ELIMINATION Scan your machine with anti-malware software to eliminate the malicious files
SYSTEM FIX Windows reinstallation can be avoided with FortectIntego maintenance tool

The ransom note

The full _readme.txt ransom note reads as follows:


Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:

Reserve e-mail address to contact us:

Your personal ID:

Cybercriminals say that there is nothing to worry about and that victims can recover their data if they pay. The price for the decryption tool is $490 in the first 72 hours. After that, it doubles and is set to $980. Usually, ransomware developers choose to receive payment by cryptocurrencies,[2] particularly Bitcoin, because it provides anonymity.

Threat actors provide victims with the ability to send one file for decryption to prove that they can do it. However, we strongly suggest not to contact them or pay them because they cannot be trusted. Many ransomware victims say that they never received the promised decryption keys after sending the payment. Besides, getting the cryptocurrencies back after they are sent to another wallet is impossible.

Ccza ransomware virusCcza stems from a well-known malware family known as Djvu

Distribution methods

There are some general tactics that threat actors use to spread ransomware. The malicious code[3] usually gets introduced by an executable file (.exe) that may have been in a zip folder, embedded within a Microsoft Office document’s macros, or disguised as another attachment.

Malicious files can infiltrate the system during “cracked” software[4] installations. Platforms that distribute them, like Torrent websites,[5] and peer-to-peer file-sharing platforms, are unregulated – the perfect breeding ground for all kinds of malware. Almost all downloads usually contain some kind of malicious files, and they are hard to identify for the average user.

Cybercriminals can also use email to deliver ransomware to Windows systems. This can be done by embedding malicious links or attachments in the email. Always be careful, and do not open emails from unknown senders. Even if you received an attachment from someone on your friend list, it is better to double-check with them through another platform before opening.

Another common distribution channel is for hackers to use the operating system and software vulnerabilities. That is why it is vital to keep everything updated. Software developers regularly release security updates for newly found vulnerabilities, so they should be installed as soon as they come out.

Ransomware removal with anti-malware tools

If the machine is not located at your workplace but in your home, plugging out the ethernet cable is enough to disconnect from the network. You have to do this if other devices use the same network because they can be infected too. After that, you have to remove the malicious files that are performing the tasks in the background.

If you try to recover your data first, it can result in permanent loss. Also, the files can keep getting encrypted again and again until you eliminate the cause. It would be best if you did not try removing it yourself unless you have IT knowledge. Using anti-malware tools like SpyHunter 5Combo Cleaner or Malwarebytes to scan your system will give you the best chance of removal being complete. This security software should find all the related files and entries and remove them automatically for you.

If you cannot open security software, the code might be preventing the program from being able to function. Proceed with accessing Safe Mode, where you will be able to deploy the antivirus safely:

Windows 7 / Vista / XP

  1. Click Start > Shutdown > Restart > OK.
  2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
  3. Select Safe Mode with Networking from the list.Windows XP/7

Windows 10 / Windows 8

  1. Right-click on Start button and select Settings.
  2. Scroll down to pick Update & Security.Update & Security
  3. On the left side of the window, pick Recovery.
  4. Now scroll down to find Advanced Startup section.
  5. Click Restart now.Recovery
  6. Select Troubleshoot.Choose an option
  7. Go to Advanced options.Advanced options
  8. Select Startup Settings.Startup settings
  9. Click Restart.
  10. Press 5 or click 5) Enable Safe Mode with Networking.Press F5 to enable Safe Mode with Networking

File recovery using third-party software

Third-party programs cannot always decrypt the files, but you should at least try it. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed Ccza ransomware.

It is devastating to know, but if you do not have backups, this might be your only chance at recovery because only hackers hold the decryption key, which can unlock your files.

First, we recommend trying data recovery software that may work for at least some of your files:

  • Download Data Recovery Pro.
  • Double-click the installer to launch it.
    Ccza ransomware
  • Follow on-screen instructions to install the software.Install program
  • As soon as you press Finish, you can use the app.
  • Select Everything or pick individual folders which you want the files to be recovered from.
  • Press Next.
  • At the bottom, enable Deep scan and pick which Disks you want to be scanned.Select Deep scan
  • Press Scan and wait till it is complete.
  • You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
  • Press Recover to retrieve your files.Recover files

Your other chance is by using the dedicated decrytpion software from Emsisoft. Keep in mind that it only works if your files were encrypted with an offline ID, which is usually not the case.

  • Download the app from the official Emsisoft website.Ccza ransomware
  • After pressing the Download button, a small pop-up at the bottom titled decrypt_STOPDjvu.exe should show up – click it.
    Ccza ransomware
  • If User Account Control (UAC) message shows up, press Yes.
  • Agree to License Terms by pressing Yes.
    Ccza ransomware
  • After Disclaimer shows up, press OK.
  • The tool should automatically populate the affected folders, although you can also do it by pressing Add folder at the bottom.
    Ccza ransomware
  • Press Decrypt.
    Ccza ransomware

From here, there are three available outcomes:

  1. Decrypted!” will be shown under files decrypted successfully – they are now usable again.
  2. Error: Unable to decrypt file with ID:” means that the keys for this version of the virus have not yet been retrieved, so you should try later.
  3. This ID appears to be an online ID, decryption is impossible” – you are unable to decrypt files with this tool.

The operating system can be damaged after an attack

Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are expected after a malware infection. These types of infections can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it.

This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.

  • Download the application by clicking on the link above
  • Click on the ReimageRepair.exe
    Reimage download
  • If User Account Control (UAC) shows up, select Yes
  • Press Install and wait till the program finishes the installation processReimage installation
  • The analysis of your machine will begin immediatelyReimage scan
  • Once complete, check the results – they will be listed in the Summary
  • You can now click on each of the issues and fix them manually
  • If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.Reimage results

Additional instructions are provided for corporate environments on isolating the infected machine and stopping the malicious program from affecting the entire network at the bottom of this post. You will also find information on where you can report your attack. Doing it will give you a better chance of having your perpetrators caught.

do it now!
Fortect Happiness
Intego Happiness
Compatible with Microsoft Windows Compatible with macOS
What to do if failed?
If you failed to fix virus damage using Fortect Intego, submit a question to our support team and provide as much details as possible.
Fortect Intego has a free limited scanner. Fortect Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Fortect, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

Getting rid of Ccza virus. Follow these steps

Isolate the infected computer

Some ransomware strains aim to infect not only one computer but hijack the entire network. As soon as one of the machines is infected, malware can spread via network and encrypt files everywhere else, including Network Attached Storage (NAS) devices. If your computer is connected to a network, it is important to isolate it to prevent re-infection after ransomware removal is complete.

The easiest way to disconnect a PC from everything is simply to plug out the ethernet cable. However, in the corporate environment, this might be extremely difficult to do (also would take a long time). The method below will disconnect from all the networks, including local and the internet, isolating each of the machines involved.

  • Type in Control Panel in Windows search and press Enter
  • Go to Network and Internet Network and internet
  • Click Network and Sharing Center Network and internet 2
  • On the left, pick Change adapter settings Network and internet 3
  • Right-click on your connection (for example, Ethernet), and select Disable Network and internet 4
  • Confirm with Yes.

If you are using some type of cloud storage you are connected to, you should disconnect from it immediately. It is also advisable to disconnect all the external devices, such as USB flash sticks, external HDDs, etc. Once the malware elimination process is finished, you can connect your computers to the network and internet, as explained above, but by pressing Enable instead.

Report the incident to your local authorities

Ransomware is a huge business that is highly illegal, and authorities are very involved in catching malware operators. To have increased chances of identifying the culprits, the agencies need information. Therefore, by reporting the crime, you could help with stopping the cybercriminal activities and catching the threat actors. Make sure you include all the possible details, including how did you notice the attack, when it happened, etc. Additionally, providing documents such as ransom notes, examples of encrypted files, or malware executables would also be beneficial.

Law enforcement agencies typically deal with online fraud and cybercrime, although it depends on where you live. Here is the list of local authority groups that handle incidents like ransomware attacks, sorted by country:

Internet Crime Complaint Center IC3

If your country is not listed above, you should contact the local police department or communications center.

How to prevent from getting ransomware

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.

If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.


Recover files after data-affecting malware attacks

While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files. More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.

Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, Data Recovery Pro can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection. 


About the author
Lucia Danes
Lucia Danes - Virus researcher

If this free guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Lucia Danes
About the company Esolutions