Remove Lezp ransomware (checked October 2026)

What to remove by hand

The write-ups we read name few concrete traces of Lezp.

Below is every one they give, plus the places to look for the rest. Use our removal plan for the clicks, and run a full Microsoft Defender scan first so the scanner does the main cleanup.

Files to find and keep as evidence, not to open:

• _readme.txt in every folder with locked files, which is the ransom note.
• Files that end in .lezp, such as 1.jpg.lezp, which are your encrypted data. Do not delete them until a decryptor or backup has been tried.
• The program that brought the infection: a crack, key generator, activation tool or fake updater in Downloads or on the Desktop. Delete the installer after the scan.

Settings to check and repair:
– The Windows hosts file at C:\Windows\System32\drivers\etc\hosts. Open it with Notepad as administrator. Lines that point security or removal sites to a wrong address, which the write-ups say Djvu infections add, can be deleted.

Leave lines you do not understand if the file is large and ask for help.
– Settings, Apps, Installed apps, sorted by install date, for a program you did not install around the time files locked.
– Settings, Apps, Startup, and Task Scheduler Library for items with random names that started on the day of the infection.
– Windows Security, Protection history, for the name of the file Defender blocked or quarantined.

No guide we read names a registry key, a service or a folder path that belongs only to Lezp, so we do not list any. Our reading is that the family changes these names between builds. If a scan finds nothing, the check list above is still the place to confirm that no startup item or odd program remains.