Ccza ransomware (virus) - Recovery Instructions Included

What is Ccza ransomware?

Ccza ransomware locks users' personal files until they pay for a decryption tool

Ccza ransomware is a Windows virus that specializes in locking all personal data

Ccza ransomware is a dangerous virus that can damage the operating system and lock users' personal files, like photos, videos, and documents. It belongs to the Djvu malware family that releases new variants weekly. We previously wrote about other variants, like Cceq, Cceo, Vvyu, and many others.

When it infiltrates the system, it appends the affected files with the .ccza extension. So if a file was previously named picture.jpg, after encryption,^[1] it would look like this – picture.jpg.ccza. The icons are also changed to blank pages, so thumbnails are unavailable.

Shortly after the encryption process is done, a ransom note named “_readme.txt” is generated on the machine. Here, the cybercriminals state their conditions. The main goal of a ransomware attack is to extort money from innocent people. We recommend reading our guide fully to learn about your options.

The ransom note

The full _readme.txt ransom note reads as follows:

ATTENTION!

Don’t worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-sac7bmVIKJ
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that’s price for you is $490.
Please note that you’ll never restore your data without payment.
Check your e-mail “Spam” or “Junk” folder if you don’t get answer more than 6 hours.

To get this software you need write on our e-mail:
support@bestyourmail.ch

Reserve e-mail address to contact us:
supportsys@airmail.cc

Your personal ID:

Cybercriminals say that there is nothing to worry about and that victims can recover their data if they pay. The price for the decryption tool is $490 in the first 72 hours. After that, it doubles and is set to $980. Usually, ransomware developers choose to receive payment by cryptocurrencies,^[2] particularly Bitcoin, because it provides anonymity.

Threat actors provide victims with the ability to send one file for decryption to prove that they can do it. However, we strongly suggest not to contact them or pay them because they cannot be trusted. Many ransomware victims say that they never received the promised decryption keys after sending the payment. Besides, getting the cryptocurrencies back after they are sent to another wallet is impossible.

Ccza stems from a well-known malware family known as Djvu

Distribution methods

There are some general tactics that threat actors use to spread ransomware. The malicious code^[3] usually gets introduced by an executable file (.exe) that may have been in a zip folder, embedded within a Microsoft Office document’s macros, or disguised as another attachment.

Malicious files can infiltrate the system during “cracked” software^[4] installations. Platforms that distribute them, like Torrent websites,^[5] and peer-to-peer file-sharing platforms, are unregulated – the perfect breeding ground for all kinds of malware. Almost all downloads usually contain some kind of malicious files, and they are hard to identify for the average user.

Cybercriminals can also use email to deliver ransomware to Windows systems. This can be done by embedding malicious links or attachments in the email. Always be careful, and do not open emails from unknown senders. Even if you received an attachment from someone on your friend list, it is better to double-check with them through another platform before opening.

Another common distribution channel is for hackers to use the operating system and software vulnerabilities. That is why it is vital to keep everything updated. Software developers regularly release security updates for newly found vulnerabilities, so they should be installed as soon as they come out.

Ransomware removal with anti-malware tools

If the machine is not located at your workplace but in your home, plugging out the ethernet cable is enough to disconnect from the network. You have to do this if other devices use the same network because they can be infected too. After that, you have to remove the malicious files that are performing the tasks in the background.

If you try to recover your data first, it can result in permanent loss. Also, the files can keep getting encrypted again and again until you eliminate the cause. It would be best if you did not try removing it yourself unless you have IT knowledge. Using anti-malware tools like SpyHunter 5Combo Cleaner or Malwarebytes to scan your system will give you the best chance of removal being complete. This security software should find all the related files and entries and remove them automatically for you.

If you cannot open security software, the code might be preventing the program from being able to function. Proceed with accessing Safe Mode, where you will be able to deploy the antivirus safely:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

File recovery using third-party software

Third-party programs cannot always decrypt the files, but you should at least try it. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed Ccza ransomware.

It is devastating to know, but if you do not have backups, this might be your only chance at recovery because only hackers hold the decryption key, which can unlock your files.

First, we recommend trying data recovery software that may work for at least some of your files:

• Download Data Recovery Pro.
• Double-click the installer to launch it.
  
• Follow on-screen instructions to install the software.
• As soon as you press Finish, you can use the app.
• Select Everything or pick individual folders which you want the files to be recovered from.
• Press Next.
• At the bottom, enable Deep scan and pick which Disks you want to be scanned.
• Press Scan and wait till it is complete.
• You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
• Press Recover to retrieve your files.

Your other chance is by using the dedicated decrytpion software from Emsisoft. Keep in mind that it only works if your files were encrypted with an offline ID, which is usually not the case.

• Download the app from the official Emsisoft website.
• After pressing the Download button, a small pop-up at the bottom titled decrypt_STOPDjvu.exe should show up – click it.
  
• If User Account Control (UAC) message shows up, press Yes.
• Agree to License Terms by pressing Yes.
  
  
• After Disclaimer shows up, press OK.
• The tool should automatically populate the affected folders, although you can also do it by pressing Add folder at the bottom.
  
• Press Decrypt.
  
  

From here, there are three available outcomes:

1. “Decrypted!” will be shown under files decrypted successfully – they are now usable again.
2. “Error: Unable to decrypt file with ID:” means that the keys for this version of the virus have not yet been retrieved, so you should try later.
3. “This ID appears to be an online ID, decryption is impossible” – you are unable to decrypt files with this tool.

The operating system can be damaged after an attack

Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are expected after a malware infection. These types of infections can alter the Windows registry database, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it.

This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

Additional instructions are provided for corporate environments on isolating the infected machine and stopping the malicious program from affecting the entire network at the bottom of this post. You will also find information on where you can report your attack. Doing it will give you a better chance of having your perpetrators caught.