Qqjj ransomware: what it is and how to get your files back
Qqjj ransomware is a version of the STOP/Djvu family that encrypts your files, adds .qqjj to their names and asks $980 in a note called _readme.txt. Whether you can decrypt them depends on the key type: files locked with an offline key the free Emsisoft decryptor knows can be opened, the rest need backups.
Facts checked October 11, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A free scan checks for the encryptor still on the PC; it does not decrypt .qqjj files.
Do it yourself · free Remove Qqjj ransomware yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Qqjj ransomware: summary
| Type | File-encrypting ransomware of the STOP/Djvu family |
|---|---|
| Risk | High: files are lost unless the key was an offline key Emsisoft has; the crack that brought it may also carry a password stealer |
| Symptoms | Files renamed .qqjj, _readme.txt in folders, files that no longer open |
| How to get rid of it | Scan in Safe Mode with Microsoft Defender, remove the crack, then try the Emsisoft decryptor and backups; see the plan |
| Our check | Source check on 6 October 2026 (Emsisoft, BleepingComputer, Microsoft, CISA); we did not run the malware |
| First seen | Our first report 22 August 2022 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 13 more facts
| Name | Qqjj ransomware (STOP/Djvu) |
|---|---|
| Encrypted file extension | .qqjj |
| Ransom note | _readme.txt, quoted below |
| Decryptor | Emsisoft STOP Djvu decryptor, only for offline-key files; development reported stopped |
| Price in the note | $980, or $490 within 72 hours |
| Distribution | Cracks, key generators and pirated installers (Emsisoft, BleepingComputer); spam attachments are unproven |
| Damage | Personal files encrypted and renamed .qqjj; other malware may come with the crack |
| Contact | Two e-mail addresses in _readme.txt; no web page and no wallet address printed here |
| Encrypted files | .qqjj |
| Free decryptor | The free Emsisoft STOP Djvu decryptor works only for files locked with an offline key it holds, and we could not confirm a key for .qqjj (checked 6 October 2026) |
| Microsoft Defender name | Ransom:Win32/StopCrypt |
| Detection names | Microsoft: Ransom:Win32/StopCrypt |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Emsisoft's STOP Djvu decryptor page and blog post, BleepingComputer's STOP support topic and its topic about a .qqjj victim, Microsoft Support and CISA, plus our own 2022 screenshots. We did not run the malware.
What Qqjj ransomware is
Qqjj is a Windows file encryptor from the STOP/Djvu family: it locks your documents and photos, adds .qqjj to every name and drops a note called _readme.txt that sells you the key.
- Family
- STOP/Djvu; Emsisoft counted 160 variants by October 2019, and BleepingComputer says the developers have kept to four-letter extensions since
.gero - File names
bunch.txt.qqjj,396.JPG.qqjj: the old name plus.qqjj- Note
_readme.txt, in every folder it touched- Price in the note
- $980, or $490 if the victim writes within 72 hours
- Contacts in the note
support@bestyourmail.chanddatarestorehelp@airmail.cc; no web page- Our first report
- 22 August 2022; a victim posted a
.qqjjphoto on BleepingComputer on 20 November 2025 - Files that can come back
- Only those locked with an offline key that Emsisoft holds; see the decryption chapter
Our 2022 text said the family ships new versions every week. We found no source that gives a 2026 release rate, so we keep only what the sources show: the extension changes from version to version and the method stays the same.
How the Qqjj story went
2018
The family starts
Our 2022 guide dates these threats to 2018; other victims had already met earlier versions before
.qqjjcame out.18 October 2019
Emsisoft publishes a decryptor
The post counted 160 variants and over 116,000 confirmed victims, said the new variants spreading since August 2019 make files exactly 334 bytes larger, and estimated that the tool would help about 70% of victims (148 of 160 variants).
22 August 2022
Our first Qqjj report
Six test files in a Windows folder show how the extension is added: bunch, bail, lieu, tort, jolla and mana, each ending in
.txt.qqjj.
Six .qqjjtest files in our August 2022 screenshot.20 November 2025
A victim asks for help
A BleepingComputer user posted a photo called 396.JPG.qqjj and the address support@bestyourmail.ch, the first contact in our note. A moderator called
.qqjja STOP (Djvu) variant and closed the topic.6 October 2026
Our recheck
Emsisoft's decryptor page still shows version 1.0.0.5 from October 2019, and a moderator wrote in 2025 that Emsisoft appears to have stopped developing the tool. We found nothing newer about
.qqjjitself.
What we checked and what we did not
We did not run this malware and there is no website to test, so this is a check of sources and of our own 2022 screenshots.
Qqjj ransomware · source check · 6 October 2026
- Family and extensionOur screenshots show
.qqjjfiles and the Djvu note; BleepingComputer names.qqjja STOP (Djvu) variant. - Decryptor existsEmsisoft's page says offline-key files it has a key for can be decrypted in all STOP Djvu versions.
- A key for .qqjjNot confirmed. Only running the decryptor on your own files shows it.
- Decryptor still maintainedUnchanged since 2019; a moderator says support has stopped. We did not ask Emsisoft.
- Detection nameMicrosoft lists family detections such as Ransom:Win32/StopCrypt.NDD!MTB; none is named for
.qqjj. - Registry, hosts file, shadow copiesNo source describes such changes for
.qqjj, so none are listed as facts.
Files probably lost unless the key is offline If your ID does not end in t1 the key is almost certainly an online one that only the attackers hold. The crack that brought the malware in may have installed other things too.
Qqjj ransomware detection names
If Windows Security shows Ransom:Win32/StopCrypt, it has found Qqjj ransomware or a file that belongs to it.
Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.
A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.
- File extension:
.qqjj - Note file:
_readme.txt
What is the string pyskcnpcjj seen with Qqjj ransomware?
We found no reliable source that names pyskcnpcjj as a threat.
It does not appear in the Emsisoft or BleepingComputer pages we cite for this family. We cannot say what it is with certainty, so what follows is our reading, not a confirmed fact.
Our reading is that pyskcnpcjj is a random looking identifier, not the name of a threat. It ends in the letters jj, like the .qqjj extension, which may be why people search for it after meeting this ransomware. Strings like this can come from a file name or from a ransom note.
If you saw it on your PC, check where it sits before you act. Open the file's properties, look at where it is stored, then scan it with Microsoft Defender. Do not run it, and do not delete the ransom note _readme.txt, because the personal ID inside it is what a decryptor needs.
Do not treat the string as proof that you are safe or infected. A quiet search result clears nothing. Judge your PC by the signs described above, such as files renamed to .qqjj. If those are present, follow the plan on this page.
How Qqjj ransomware behaves
How the family locks files, step by step
Everything that matters for recovery is decided in the second step, before any file is touched.
- 1
A cracked program carries it in
Emsisoft says STOP spreads almost exclusively through key generators and cracks. Whoever runs the crack also runs the encryptor, and it installs itself without asking.
- 2
It tries to fetch a personal key
If the PC can reach the attackers' server, the malware receives a random online key made for this victim alone (BleepingComputer).
- 3
Otherwise it uses a key built into the program
With no connection it falls back to an offline key. One offline ID exists per extension, so every victim of that version shares it.
- 4
It encrypts your files
Emsisoft describes Salsa20. Personal files get
.qqjjappended; the note is written next to them.
The 2022 guide added that malware like this can alter the registry, damage start-up sections and corrupt DLL files until Windows needs a reinstall, and that the system folders are not encrypted but can still be damaged. Those are general claims and we found no source for the .qqjj variant, so treat them as unconfirmed; after cleaning, simply check that Windows starts and runs normally.
Online key or offline key: what your ID tells you
The last characters of the personal ID in _readme.txt show which key you have: an ID that ends in t1 is generally an offline ID.
| Offline key | Online key | |
|---|---|---|
| Used when | The malware could not reach its server | The malware reached its server |
| Shared by | All victims of the same extension | Nobody: one key per victim |
| ID in the note | Generally ends in t1 | Does not end in t1 |
| Free decryptor | Works if Emsisoft already holds the key | Cannot work |
| Decryptor message | "No key for New Variant offline ID ... decryption MAY be possible in the future" | "this ID appears to be an online ID. decryption is impossible" |
Our 2022 guide said recent versions no longer use offline keys. The support topic still describes offline IDs for the new variants, so that was too strong; online keys are simply the usual case, and most victims fall in the right-hand column.
How it reaches PCs
- High
Cracks and key generators
Emsisoft: STOP spreads almost exclusively through them. Our 2022 guide described the same thing as game cheats and cracks for licensed software with hidden payloads.
- High
Pirated software and activators
BleepingComputer adds adware bundles, pirated programs, Office and Windows activators and shady sites. Infected files are passed around on pirating platforms and by other threats.
- Low
Spam attachments
Our 2022 text also said it can arrive in packages attached to spam e-mail. No source we read ties this route to the family, so it is possible but unproven.
Was anything stolen?
- Medium
Other malware from the same crack
Emsisoft says some STOP versions bundle password-stealing Trojans, and our 2022 guide warned of Trojans that keep running quietly in the background. We have no evidence about
.qqjj, so change passwords from a clean device anyway. - Low
No leak site
The note sells only a decryptor; we found no data leak site for this family.
The Qqjj ransomware note
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool: hxxps://we.tl/t-USug3rryKI
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail: support@bestyourmail.ch
Reserve e-mail address to contact us: datarestorehelp@airmail.cc
Your personal ID:
Can Qqjj ransomware files be decrypted?
Can .qqjj files be decrypted?
Sometimes: the free Emsisoft STOP Djvu decryptor opens files locked with an offline key it holds, and nothing opens an online key except the attackers' own.
Our 2022 guide said no official decryptor exists for Qqjj. The tool is built for the whole family rather than for .qqjj, and we could not find out whether a key for this extension is in Emsisoft's database, so read the verdict the tool gives for your own ID.
| What the tool says | What it means | What to do |
|---|---|---|
| Files decrypted | An offline key you share with other victims was known | Open a few files, then copy everything to a clean drive |
| "No key for New Variant offline ID" | Offline ID, key not yet known | Keep the encrypted copies and retry every week or two |
| "this ID appears to be an online ID" | Online key | No decryption is possible; use backups |
Waiting is not a plan with a date. A BleepingComputer moderator explains that Emsisoft can only get the key of an offline ID after a victim has paid, received it and passed it on, and that nobody announces when a key is added. Our 2022 text also told readers to upload an encrypted and a healthy file to Emsisoft; that route exists only for old Djvu versions and does not apply to versions after August 2019.
- 1
Clear the machine first
Finish the scan in the plan below, so the restored files cannot be locked again.
- 2
Work on copies
Copy some
.qqjjfiles and one_readme.txtto a USB drive and read how your ID ends. - 3
Download from Emsisoft only
Use the emsisoft.com page in our sources and press Download; open the small
decrypt_STOPDjvu.exebox that appears at the bottom of the browser. Lookalike "decryptor" sites are common. - 4
Accept the prompts
Answer Yes if User Account Control asks, Yes to the License Terms, and OK to the Disclaimer.
- 5
Pick folders and run it
The window lists your drives; Add folder adds more. Press Decrypt and read the Results tab.
Do
- Keep every encrypted file, even if the tool fails today
- Check that decrypted files open before deleting anything
Don't
- Do not pay anyone for a "decryptor", the note's authors included
- Do not run decryptors from forums, mail attachments or lookalike sites
Should you pay the ransom?
No. The note asks $980, or $490 within 72 hours. Our 2022 guide said the payment is in Bitcoin; the note in our screenshot names no currency, so we leave that unconfirmed, and no source we read says paying reliably works.
- High
Nothing may come back
The authors will not give a key for free and nobody can hold them to a promise; the tools they call a recovery may never arrive.
- Medium
The discount is pressure
The price halves only if you write within three days. The offer looks legitimate, but its timer is there to hurry you.
- Medium
The free test file proves nothing
One decrypted file says nothing about the rest. Avoid any contact with the authors, even if you want your data back.
Report the attack instead. CISA's guide names cisa.gov/report, your local FBI field office and the FBI's IC3 at ic3.gov for US victims; elsewhere use your national police or cybercrime service.
How to remove Qqjj ransomware
Tools you'll need
All of these are free except where noted. Download them on a clean device if the infected PC is offline.
- A USB stick: to keep the ransom note, two or three encrypted files and screenshots off the infected PC.
- Microsoft Defender Offline: built into Windows 11 and Windows 10; scans before Windows starts, so running malware cannot hide.
- Microsoft Safety Scanner: a second, portable scanner with current signatures; each download works for 10 days.
- ID Ransomware: identifies the family from the note and one encrypted file and says whether a decryptor exists.
- No More Ransom: the free decryptors from police and security companies; check it again every few months.
- Fortect (optional): scans Windows for malware and repairs the system files and settings it damaged. The free scan is in the box above.
How to remove Qqjj ransomware and get your files back
Work in this order.
Disconnecting comes first, removal comes before any restore, and nothing here asks you to contact the attackers.
Step 1: Disconnect the PC and unplug backup drives
Unplug the network cable or turn off Wi-Fi, and disconnect USB drives, external disks and network shares, so Qqjj ransomware cannot reach more files. Pause OneDrive, Google Drive or Dropbox sync, because synced folders upload the encrypted copies over the good ones.
Leave the PC on but offline while you read the next steps, since a restart can let the ransomware run again. This applies to Windows 11 and Windows 10 alike.
Windows 11: turn off Wi-Fi to take the PC offline. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 2: Save the ransom note and confirm the family
Your files now end in
.qqjjand the instructions are in_readme.txt. Save both to a USB stick, a copy of the note and two small encrypted files, before anything else.On another device, check them with ID Ransomware or Crypto Sheriff: the family name decides which decryptor, if any, can help. Keep the note's ID and contact line for your report.
Windows 11: the ransom note and encrypted files to copy for identification. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 3: Check for a free decryptor
Our last check found that for Qqjj ransomware, the free Emsisoft STOP Djvu decryptor works only for files locked with an offline key it holds, and we could not confirm a key for .qqjj (checked 6 October 2026).
Look again yourself in the No More Ransom list and the free decryptor pages of Emsisoft, Avast and Kaspersky, which add new families every year.
A decryptor needs the ransomware gone first, or it encrypts the files again. Keep at least one copy of the encrypted files on an external drive, even if no tool works yet.
Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 4: Remove the ransomware before you restore or decrypt
Removing Qqjj ransomware does not bring the files back, but it has to come first. Start with Defender's Full scan, then the offline scan from the same Scan options page, which checks the disk before Windows loads.
If the scan cannot start, use Safe Mode with Networking. Delete the ransom notes only after you have saved a copy, because removal tools sometimes leave them behind on Windows 11 and Windows 10.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Look for shadow copies of the files
Windows keeps shadow copies for restore points and backups, and some ransomware fails to delete them.
vssadmin list shadowsin an administrator Command Prompt tells you at once whether any exist.If they do, right-click the folder that held your files, open Properties > Previous Versions, select a version from before the attack, and click Open to check it before you Restore or copy the files out. Windows 11 and Windows 10 both have the tab.
Windows 11: vssadmin list shadows shows whether shadow copies exist. Full procedure with screenshots: Ransomware: first steps, finding a decryptor and recovering files
Step 6: Restore the files from a backup or recover deleted originals
A backup made before the attack is the surest way back. Connect it only once the PC is clean, then restore from File History, Windows Backup, OneDrive's Restore your OneDrive or your own external copies.
Without a backup, try file recovery: the originals that Qqjj ransomware deleted may still be on the disk until something overwrites them. Install nothing new on the drive you want to recover from on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Recover deleted files (Recycle Bin, backups, OneDrive) On uGetFix
Report it and recover your files
Report it
Report the attack even if you do not expect the files back: insurers and banks ask for the report number, and police use the contacts in the note to link cases.
- United States
- FBI IC3 · FTC ReportFraud
- United Kingdom
- Report Fraud (formerly Action Fraud) · NCSC
- Australia
- ReportCyber (ASD)
- EU countries
- Europol: national reporting sites
Give the victim ID, the note and the date the files were encrypted. A business that holds personal data may also have to notify its data protection authority, in the EU within 72 hours.
Other ways to get files back
Cleaning the PC does not return files; these do, in this order, and before you save anything new to the disk.
- 1
Your own backups
An external drive, NAS or cloud copy (OneDrive, iCloud, Dropbox) is the surest source. Connect it only after the PC is clean.
- 2
Previous versions
Right-click the folder and choose Restore previous versions (on Windows 11, Show more options first). If a dated copy from before the attack is listed, copy files out of it; if nothing is listed, no copies were kept. System Restore does not bring back personal files.
- 3
Windows File Recovery
Microsoft's
winfrcan find deleted files that were not overwritten, for examplewinfr C: E: /regular /n \Users\<name>\Documents\(E: must be another drive). It cannot decrypt a locked file. - 4
Keep the encrypted copies
If your ID ends in
t1, retry the decryptor now and then.
How to prevent Qqjj ransomware and the next attack
Do
- Buy the software or choose a free alternative: cracks are the documented way in
- Keep Microsoft Defender and Windows updates on
- Show file extensions (View > Show > File name extensions)
- Back up by the 3-2-1 rule: three copies, on two kinds of storage, one of them away from the PC and unplugged
Don't
- Do not download keygens, cracks, cheats or pirated installers
- Do not switch antivirus off because a crack asks you to
- Do not open attachments from unknown senders
Questions about Qqjj ransomware
What is Qqjj ransomware?
Qqjj ransomware is one version of the STOP/Djvu file-encrypting family for Windows. It locks documents, photos and other files with the extension .qqjj and leaves a note called _readme.txt that asks for $980, or $490 within 72 hours. A BleepingComputer moderator called .qqjj a STOP (Djvu) variant in November 2025.
Emsisoft, which published the free decryptor for the family, describes Salsa20 encryption and says most infections come from cracks and keygens. We did not run the malware ourselves, so everything here comes from the sources listed below and from our own 2022 screenshots.
How do I open .qqjj files?
You cannot open .qqjj files normally, because the content is encrypted. They open again only if the free Emsisoft STOP Djvu decryptor has the key for your files. Check your personal ID at the bottom of _readme.txt: an ID ending in t1 is generally an offline ID, which many victims share and which Emsisoft may have or receive later.
An ID not ending in t1 means an online key that only the attackers hold. Keep copies of the files either way, because a missing key may appear later, though nobody can promise it.
Is there a free Qqjj decryptor?
There is a free STOP Djvu decryptor from Emsisoft, but it is made for the whole family and works only for files locked with an offline key it has. We could not confirm that a key exists for .qqjj.
Download it only from the emsisoft.com page listed in our sources, because lookalike decryptor sites are a common trap. Its page still shows version 1.0.0.5 of October 2019, and a BleepingComputer moderator says support has stopped. Do not buy a decryptor from anyone.
Should I pay the Qqjj ransom?
No, do not pay the ransom. The note asks $980, or $490 if you write within 72 hours, and offers to decrypt one file for free. Nobody can hold the attackers to their promise, and the discount timer is there to hurry you.
Our 2022 guide advised against contacting the criminals at all, even when you want your data restored the right way. Keep the note, copy the files, run the scan in our plan and check the offline-key decryptor and your backups instead.
Can I decrypt .qqjj files without paying?
Only in one case: your files were locked with an offline key and Emsisoft has that key. The decryptor will tell you which case you are in. If it says no key for an offline ID, keep the files and try again every week or two.
If it says the ID is an online ID, decryption is impossible for now, and the realistic options are your backups, Previous Versions and Windows File Recovery. A paid recovery service cannot get around an online key either.
Do paid decryption services work for .qqjj files?
Not for files locked with an online key. Only the attackers hold that key, so a recovery company cannot decrypt the files by itself; BleepingComputer's moderators say such files are not recoverable unless the ransom is paid and the key received.
A service that promises to decrypt everything for a fee is either paying the attackers on your behalf or just taking your money. The free route is the Emsisoft decryptor for offline keys, plus your own backups.
If a company asks for money first, ask for a written statement of which key type it can handle, and walk away if it will not give one.
How did Qqjj ransomware get on my PC?
Most likely through a crack, keygen or pirated installer for paid software. Emsisoft says STOP is spread almost exclusively through key generators and cracks, and BleepingComputer adds adware bundles, pirated software, activators for Office and Windows and shady sites.
Our 2022 guide also named spam e-mail attachments, but no source we read ties that route to this family. Think back to what you downloaded just before the files stopped opening, do not run it again, and keep the installer folder for the scan in our plan.
Will my passwords be stolen?
They might be. Emsisoft says some versions of STOP bundle password-stealing Trojans, and the cracks that carry STOP often carry other malware. We have no evidence about the .qqjj variant in particular.
Change your important passwords, starting with e-mail and banking, from a clean device, and turn on two-step sign-in so that a stolen password is not enough. Then scan the PC as described in the plan before you sign in to anything from it, and sign out of other devices where possible.
How is Qqjj different from .djvu and other STOP extensions?
It is not different in how it works, only in the extension and the ID it uses. Qqjj, .gero, .rumba and .radman all belong to STOP/Djvu, so the same kind of note and the same decryptor apply.
What differs is the key: old Djvu variants have an extra option of submitting file pairs over 150 KB to Emsisoft, while new variants after August 2019 do not. The ID of your own note decides what is possible, not the name of the extension.
Will Fortect remove Qqjj ransomware?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Qqjj ransomware, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Emsisoft: STOP Djvu decryptor (read October 6, 2026)
- Emsisoft: Emsisoft releases new decryptor for STOP Djvu ransomware (read October 6, 2026)
- BleepingComputer: Corrupted image format "qqjj" extension (STOP Djvu) (read October 6, 2026)
- BleepingComputer: STOP Ransomware (.STOP .Djvu, .Puma, .Promo) support topic (read October 6, 2026)
- Microsoft Support: Windows File Recovery (read October 6, 2026)
- Microsoft Support: Backup and restore with File History (read October 6, 2026)
- Microsoft Support: Start your PC in safe mode in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)
- Microsoft Security Intelligence: Ransom:Win32/StopCrypt.NDD!MTB (read October 6, 2026)
- CISA: #StopRansomware Guide (read October 6, 2026)