Imagine waking up and turning on your computer only to find weird-looking white icons with even weirder file extensions that you can't open. You've no idea what happened, only to notice a random _readme.txt file on your Desktop after a few seconds.

Opening the file confirms your worst fears: it's the notorious Hhjk ransomware.

Worry not, as today's guide will focus on Hhjk ransomware, and we'll show you what to do in case of infection in our detailed Hhjk file recovery guide.

In this article
    1. Isolate the Device
    2. Identify the Infection and Remove It
    3. Use Ransomware Decryption Tools
    4. Recover Hhjk Files With a Recovery Tool
    5. Create Data Backups

What Is a Hhjk File Ransomware?

The Hhjk ransomware is malware from the Djvu family that infects Windows machines, encrypts files, changes their extension, and demands a ransom of $980 for file decryption. The decryption price can also be lowered to $490 if the victim contacts the attacker immediately after the infection.

However, it's highly recommended that you never pay the attackers in case of a ransomware infection, as there's no guarantee that you'll ever receive a decryption key. You're much more likely to waste a couple hundred dollars in addition to losing files than to get your data back this way.

With that said, let's move on to the ransomware itself and see how it functions.

RansomwareHhjk malware
Malware TypeEncryption ransomware;
File Encrypter;
Crypto Virus;
Ransomware Message_readme.txt file on your Desktop (the document asks you to contact or and pay $490 – $980 to decrypt files)
Detection NamesGen:Heur.Mint.Zard.52 (Ad-Aware);
Win32:AceCrypter-V [Cryp] (Avast);
Win32:AceCrypter-V [Cryp] (AVG);
TR/Stop.deamv (Avira);
Gen:Heur.Mint.Zard.52 (BitDefender);
Win32/Filecoder.STOP.A (ESET-NOD32);
HEUR:Trojan-Ransom.Win32.Stop.gen (Kaspersky);
Trojan.MalPack.GS (Malwarebytes);
Packed-GDV!9603B8FF454A (McAfee);
Ransom:Win32/StopCrypt.PBM!MTB (Microsoft);
Infection Symptoms– Documents, photos, music, videos, and other file types have an additional extension – .hhjk (i.e., image1.jpg.hhjk);
– Files can't be opened;
– There's a "_readme.txt" file on your Desktop demanding payment for decryption;
– Your Antivirus software displays one of the abovementioned detection names;
Infection Methods– Clicking on malicious ads;
– Clicking on suspicious Image names in email messages;
– Opening suspicious email attachments;
– Opening or running suspicious .exe, .run, .zip, .rar, .doc, .xls, .pdf, and .js files;
– Downloading files from third-party websites;
– Using Peer-to-Peer networks (torrents);
Removal Methods– Scan your PC with a trustworthy antimalware or antivirus software (programs mentioned in detection names);
– Remove the Hhjk ransomware from your system;
– Restore files with one of the methods below;

As you can see, the Hhjk ransomware has multiple distribution methods and can infect your computer through emails, attachments, executable files, third-party apps, torrents, etc. Preventing such an infection will require staying vigilant regarding your incoming email messages, websites you visit, and files you download. Otherwise, you'll have to rely on Hhjk file recovery methods.

How to Recover Hhjk Files?

Now that we know more about the Hhjk ransomware, we can jump straight into Hhjk file recovery, where we'll show you what to do if this tedious ransomware has already infected your computer. Follow the guide below, and you'll get your vital data back.

Isolate the Device

In any malware infection situation, the first thing to do is to isolate the infected device. It means disconnecting all external storage devices from the computer and disconnecting the computer from your home network to prevent the spread of ransomware and the infection of additional files.

Identify the Infection and Remove It

After successfully isolating your computer from the rest of your storage and network devices, you can move on to the infection identification. The Hhjk ransomware can be recognized in two ways:

  • The extension on the encrypted files, which will always be .hhjk;
  • The detection names your computer's antivirus tool displays, like the ones in the table above.

From there, you can use the antivirus to safely remove Hhjk ransomware from your computer and focus on decrypting the infected files.

Use Ransomware Decryption Tools

While there's no official Hhjk ransomware decryption software, the fact that Hhjk belongs to the Djvu ransomware family means you can use Emsisoft's Djvu decryptor to get your files back, and here's how:

  1. Download Emsisoft's STOP Djvu Decryptor, install the app on your computer, and follow the prompts.
    launch the djvu decryptor
  2. Click the Decrypt button and watch the app do its job from the status view window.
    decrypt files with emsisoft djvu decryptor

If you need help, Emsisoft also provides a detailed how-to guide for using the decryptor app, which you can find on the company's official website. And if the app can't see and decrypt all your files, you can also employ a dedicated data recovery tool.

Recover Hhjk Files With a Recovery Tool

If you lose data after a Hhjk ransomware infection and want to retrieve it, you can use professional data recovery software. While Djvu decryptor might or might not work for Hhjk ransomware, an app like Wondershare Recoverit will undoubtedly retrieve your lost files, as it was created to work during virus and malware infections, among other data loss situations it supports.

Free Download
Free Download

It can quickly and safely recover over 1,000 file types from 2,000+ storage devices, and using it for Hhjk file recovery is remarkably straightforward. Here's how you can do that:

  1. Open the app, tap Hard Drives and Locations, and choose a disk to recover data from.
    select a disk drive to scan

    Alternatively, right-click a folder in File Explorer and tap Scan for deleted files with Recoverit.

    right-click to scan folders
  2. The app automatically launches a deep scan of the selected folder or disk drive.
    scan for lost files
  3. Modify file filters to search for specific data.
    use file filters
  4. Use keywords to search for specific files.
    add keywords
  5. The app lets you preview discovered files so you can be sure those are the files you're looking for. If they are, hit the Recover button.
    preview the discovered files
  6. Select the discovered items after the scan, or pause and stop the scan at any moment and hit Recover to save the files.
    recover and save files

That's all you'll need to do, and you can get your files back within a few minutes, depending on the size of the scanned folder or drive.

Create Data Backups

Restoring lost files from your backups is another method for handling Hhjk file recovery. You can use Windows built-in backup tools or third-party apps with a more user-friendly interface. Wondershare UBackit is one of them.

How to Avoid Ransomware Attacks in the Future?

Emsisoft's STOP Djvu Decryptor and Wondershare Recoverit are a great duo of powerful apps for Hhjk file recovery. However, after the Hhjk attack, lessons should be learned. You can incorporate a few strategies to avoid another such situation in the future, such as:

  • 🚀Keeping your system and antivirus tool up-to-date;
  • 🤖Avoiding suspicious emails, attachments, Image names, sites, and downloads;
  • 👉Creating regular backups on which you can rely on in case of infection;
  • 📖Learning more about Hhjk and other ransomware to prevent future attacks.

By utilizing these strategies, you're significantly decreasing the chances of a similar situation happening again and improving the overall security of your system and its data.


Hhjk is a prime example of such a malicious program, and the .hhjk extension marks this ransomware, along with the _readme.txt file on your Desktop and the $980 ($490) it asks for ransom. It spreads through emails, attachments, Image names, executable and compressed files, torrents, third-party websites, etc.

Removing the Hhjk malware is possible, and you'll need to isolate your device, identify the infection, remove it, decrypt your data with Emsisoft's STOP Djvu decryptor, and retrieve lost files with Wondershare Recoverit.

At the same time, future ransomware infections can be prevented by keeping your OS and antivirus updated, avoiding suspicious-looking files, emails, and downloads, regularly backing up data, and educating yourself on how these malicious applications operate.

Free Download
Free Download
Theo Lucia
Theo Lucia Jul 17, 24
Share article: