Program file
stopdecrypter.exe: the decryptor for STOP ransomware
stopdecrypter.exe is STOPDecrypter, a free tool by the researcher Michael Gillespie that decrypts files locked by STOP ransomware (the Djvu family, with extensions such as .zatrov or .puma). The name means a decrypter for STOP, not a tool that stops decryption. It works only for older variants and files locked with an offline key.
Prefer to check it yourself? The manual checks follow.
A copy of stopdecrypter.exe downloaded from its author's release is a recovery tool, not malware. It runs only when you start it, decrypts files for free and does not need to be installed or left running. It cannot open files locked after August 2019 with an online key.
Fake decryptors exist, and a real one never asks for money. A file with this name that arrived by email, from a crack or from a pop-up, or that runs at start-up, is not the researcher's tool. Check where it came from before you run it on your files.
- Author
- Michael Gillespie, ransomware researcher
- Purpose
- Decrypts files locked by STOP ransomware (Djvu and the earlier STOP, Puma and Promo variants)
- Price
- Free; the author's release lists it as free software
- Latest version listed
- 2.2.0.0, updated 21 October 2019. The old page named 2.1.0.9 as the latest
- Platform
- A 32-bit program for Windows XP, Vista, 7, 8 and 10; it also runs on 64-bit Windows
- What it can decrypt
- Files locked with an offline key, or by variants whose key is known; not files locked with an online key after August 2019
- Folder
- No fixed folder: you save and extract it yourself, so the path is wherever you put it
- Starts with Windows
- No. It runs only when you open it and should not appear in start-up or as a service
- Windows file
- No. It is not part of Windows and Windows does not need it
- Replacement tool
- A STOP Djvu decryptor for the same family, released 18 October 2019 together with Gillespie by a security company, version 1.0.0.5
What stopdecrypter.exe does
stopdecrypter.exe is STOPDecrypter, a ransomware decryptor written by Michael Gillespie, a researcher who analysed the STOP ransomware. Victims who paid the ransom or whose files were locked with an offline key can use it to get pictures, music, video, documents and other files back without paying. The name is read "STOP decrypter": STOP is the name of the ransomware family, and a decrypter reverses the encryption.
STOP is one of the most widely spread ransomware families. The old page dated its release to December 2018, and its Djvu sub-family later appended dozens of different extensions to locked files. STOP was spread by adware bundles that posed as software cracks, pirated games and free downloads. Gillespie's tool was updated for each new variant until the criminals changed how they lock files.
In 2019 the criminals moved from offline keys, which are the same for every victim and can be recovered, to online keys that exist only on their server. Those files cannot be decrypted by this tool. On 18 October 2019 a second decryptor for the same family was released by Gillespie and a security company; it needs a working internet connection, because it asks that company's server for keys. It covers 148 variants and the offline keys it has, but not files locked after August 2019 with an online key.
About .exe files. An .exe file is a program. It runs as a process you can see in Task Manager, so its name, folder and publisher are what to check.
How to check it
A decryptor is a tool you start yourself. These checks separate the researcher's tool from a file that only has its name.
- Think about where you got it. The tool is distributed from its author's release page as a download that you chose to get while looking for a way to recover files. A file that arrived by email, a pop-up, a crack, a keygen or a file-sharing site is not that.
- See whether it runs when you did not start it. Press Ctrl+Shift+Esc and open the Details tab. stopdecrypter.exe should be there only while you have the program open. A copy that runs after every start-up is not the decryptor.
- Find the file's folder. In Task Manager, right-click the row and choose Open file location. A folder you chose, such as Downloads, is expected. C:\Windows, System32 or a Temp folder is not.
- Look at the version. Right-click the file and open Properties > Details. The latest release the author lists is 2.2.0.0. The old page named 2.1.0.9 as an earlier one.
- Look for ransom notes next to it. STOP leaves a note named _readme.txt that asks $980, or $490 within 72 hours, and gives an email address. A decryptor never has such a note. If one appears after you run a file named stopdecrypter.exe, the file was the ransomware.
- Read the README. The old page said the tool comes with a README.txt that answers most questions and gives the instructions. A download without it is worth a second look.
- Scan the file. Run a full scan and an offline scan with Microsoft Defender (Windows Security > Virus & threat protection > Scan options) when the source of the file is unclear.
Nothing here proves a file is the author's tool. If you cannot show where it came from, download it again from the author's release and compare.
Do you need stopdecrypter.exe?
Keep it only until you have recovered your files. It does not need to stay on the PC, and the tool does not remove ransomware.
- Remove the ransomware first. Encryption of the files and infection of the PC are two separate things. The old page advised removing the ransomware before decrypting, using reputable security software, because not every STOP variant is recognised by every scanner and a second scan with another tool can be needed. Microsoft Defender's full and offline scans are the starting point.
- Do not delete the encrypted files. Keep copies of the locked files and the ransom note. A tool that fails today may support your variant after a later key or release.
- Run the tool. Read the README.txt first, then click the STOPDecrypter shortcut, answer Yes and open the program. The old page described a simple window. For some variants you provide the ransom note, the personal ID and the MAC address, other cases need contact with the author.
- Delete the tool when you are done. It is a portable download. Delete the folder where you extracted it and the shortcut. If it appears in Settings > Apps > Installed apps, uninstall it from there.
- Back up and then repair. After the files are back, copy them to a drive that is not always connected. If Defender found damage to system files, run:
sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth
Warning signs
| What you see | What it means |
|---|---|
| The file asks for payment or a Bitcoin address | The real decryptor is free. A file asking for money is a scam or the ransomware itself. |
| Files get new extensions after you run it | A decryptor does not lock files. A file named stopdecrypter.exe that renames or locks files is malware, and fake decryptors that encrypt files a second time have been reported. |
| A _readme.txt ransom note appears next to it | The note is the ransomware's. The decryptor does not write ransom notes. |
| It starts with Windows, runs as a service or has a scheduled task | A decryptor is run once by hand. Treat anything that starts itself as suspect. |
| It came by email, pop-up, crack or file-sharing site | STOP itself spread through cracks and free-download bundles. The genuine tool is something you go looking for. |
| It sits in C:\Windows, System32 or a Temp folder | There is no reason for the decryptor to be there. Check the file and run a scan. |
| It asks you to install other software or disable protection first | Not part of the real tool's use. Stop and scan the file. |
Everyday problems
stopdecrypter.exe does not decrypt my files
The usual cause is the key. In 2019 the criminals moved from offline keys to online ones that only they hold. The tool needs an offline key. The old page said that the newest variants, with online keys, cannot be decrypted by it and that other tools were limited to the first 148 variants.
Files locked after August 2019 with an online key cannot be decrypted by this tool or the later one. Keep the encrypted copies and the ransom note in case a key is released.
Which variants can it open?
The tool lists many offline extensions, among them .djvu, .djvuu, .udjvu, .puma, .pumax, .pumas, .shadow, .stone, .lanset, .zatrov, .gero, .hese and .coharos. The old page said that Coharos, Gero and Hese do not work and that Heroset, Stone and Lanset (OFFLINE) do; the tool's own list names Coharos, Gero and Hese too, so the key type decides, not the extension.
The old page also said that uppercase extensions such as .KEYPASS, .PAUSA, .DATASTOP and .INFOWAIT work well, and that the Puma branch, which uses a simple XOR encryption, can be decrypted without problems.
It worked for a friend but not for me, with the same extension
The same extension does not mean the same key. The old page said the tool may fail if the PC contacted the criminals' server while it was locking the files, since that produces an online key. If the malware could not reach the server, the key is offline and the outcome can be positive.
The later decryptor tells you which case you are in, because it only attempts files that match a known offline key.
Error: Unable to decrypt file with ID
Readers of the 2019 announcement reported this message from the later decryptor for STOP Djvu. The wording points to the same limit: the decryptor has no key for the personal ID in the ransom note, which is the online-key case. That decryptor needs a working internet connection to ask for keys, so check the connection first.
If the message stays after that, the files were most likely locked with an online key and cannot be decrypted.
I cannot find the file or it is damaged
The tool is not installed by any program and is not part of Windows. If it is missing or will not start, download it again from the author's release, extract the archive and open the program from the extracted folder. Do not take a copy from a link in an email or a forum post.
Run the scan before you start it, then compare its version with the 2.2.0.0 release.
There are several copies on my PC
Every download or archive you extracted is another copy; the tool does not copy itself. Keep the one from a release you trust and delete the others. A copy outside your Downloads folder that you did not put there needs a scan.
High CPU, or it keeps running
A decryptor is busy while it works through thousands of files and stops when it finishes. If stopdecrypter.exe stays in Task Manager long after, or uses CPU with the program closed, it is not behaving like the decryptor. End the task, find its folder and scan the file.
Questions people ask
What is stopdecrypter.exe?
stopdecrypter.exe is STOPDecrypter, a free ransomware decryptor by the researcher Michael Gillespie. It decrypts files locked by STOP ransomware and its Djvu variants when the key is an offline one. It is not a Windows file, it is not installed by any program, and it does not need to stay on your PC after your files are recovered.
What does STOPDecrypter mean? Does it stop decryption?
No. STOP is the name of a ransomware family, and a decrypter is a tool that reverses encryption, so STOPDecrypter is a decrypter for STOP. It does not stop or block decryption, and it does not protect your PC from ransomware. People who search "decryptor stopper" are usually after this tool or the later decryptor for the same family.
Is stopdecrypter.exe a virus?
The tool itself is not malware: it is a recovery tool published by a known researcher, and the author's release lists it as free. The name can be copied by a fake, though. A file that asks for payment, locks files, starts with Windows or came from an email, a crack or a pop-up is not the decryptor. Check where you got it and scan the file.
Can it decrypt my files with the .zatrov extension?
Possibly. .zatrov is a STOP Djvu variant, and the tool's extension list includes it. It works only when your files were locked with an offline key. If the key is an online one, the files cannot be decrypted today, and the same is true for any other extension, because the key type matters more than the extension.
Why does it say my files cannot be decrypted?
Almost always because the key is an online key. After August 2019 the criminals stopped using offline keys, which are the same for every victim, and moved to keys held on their server. No tool can recover files locked with a key it does not have. Keep a copy of the locked files, because a key can be released later.
Is there a newer tool than STOPDecrypter?
Yes, but not a better one for online keys. On 18 October 2019 a decryptor for STOP Djvu, version 1.0.0.5, was released by a security company and Gillespie. It needs an internet connection, handles 148 variants and offline keys it holds, and cannot help with files locked after August 2019 with an online key.
Should I pay the ransom instead?
Paying is not recommended. The STOP ransom note asked $980, or $490 if the criminals were contacted within 72 hours, in Bitcoin. The criminals may take the money and send no key, so you risk both the files and the payment. Try the free tools first, keep encrypted copies, and restore from a backup when you have one.
What do I do first after a STOP infection?
Remove the ransomware before you try to decrypt, because the infection and the locked files are separate problems. Run a Microsoft Defender full scan and an offline scan, and a second scan with another tool if the variant is not recognised. Keep copies of the locked files and the ransom note, then try the decryptor.
Sources
- STOPDecrypter download page and supported extensions
- STOP Ransomware Decryptor Released for 148 Variants
- STOP Djvu decryptor, limits, ransom note and version 1.0.0.5
- STOP Ransomware support topic: offline and online keys
- Microsoft Q&A: STOP ransomware
Version data read on Oct 8, 2026.
Questions and experiences
Ask about this page: members and our editors answer. Reading is open; writing needs a free account.
…