Emsisoft Decryptor for STOP Djvu will allow for the decryption of files held hostage by the STOP Djvu strain of ransomware.

The STOP Djvu ransomware encrypts victim's files with Salsa20, and appends one of dozens of extensions to filenames including ".djvu", ".rumba", ".radman", ".gero", etc.

The ransom note "!readme.txt" will contain the following:


There are limitations on what files can be decrypted. For all versions of STOP Djvu, files can be successfully decrypted if an offline key encrypted them that Emsisoft has. For Old Djvu, files can also be decrypted using encrypted/original file pairs submitted to the STOP Djvu Submission portal; this does not apply to New Djvu after August 2019.

  Download