Severity scale:  
  (97/100)

Sifreli ransomware virus. How to remove? (Uninstall guide)

removal by Gabriel E. Hall - - | Type: Ransomware
12

Sifreli ransomware continues attacking Turkish computer users

Screenshot of the ransom note by Sifreli

Sifreli is a Turkish[1] ransomware virus that appends .sifreli extension to each of the targeted files. For the first time, malware was seen in 2014. However, after three years the virus has been updated.

After the infiltration and data encryption, Sifreli virus drops a ransom note where author informs about the unpleasant situation and give instructions what victims need to do. According to the message, the developer is a system engineer who looks up for system security vulnerabilities and exploits them in order to launch the attack.

The ransom note informs about encrypted files and stolen personal information. In order to get back the files and protect personal information from being published on the Internet, people have to pay the ransom. However, in order to learn the price for their data, victims have to send an email to muhendis@mail.ua.

However, after ransomware attack, you should not worry about your files. The first thing you have to do is to remove Sifreli from the computer in order to avoid other possible damage. Malware might track some personal information and affect legitimate system processes. Thus, your identity and computer might be at great risk.

Therefore, after the attack, you should scan the device with professional security software immediately. The program, such as Reimage, will delete all malware-related components without causing any damage to the system. After the Sifreli removal, you will be able to recover at least some of the files from backups.

Sifreli ransomware started its career in 2014

Three years ago, malware researchers found this crypto-malware attacking Turkish and British computer users. There were used two different phishing[2] email campaigns to spread the Sifreli:

  • Turkish users received a fake letter from local mobile phone operator Turkcell;
  • British users received a bogus email from Royal Mail that informed about not delivered parcel and asked to download a particular information.

When users were tricked by this scam, malware payload was dropped and executed on the system. Then the Sifreli ransomware started data encryption procedure using AES encryption algorithm. It aimed at image, audio, text, archives and other popular files and demanded to pay the ransom in 3 days.

British computer users were unable to open their files because of .encrypted files extension. Meanwhile, victims from Turkey found .sifreli extension appended to their data. Following the encryption, they found ransom notes called either PLEASE_READ.inf or LUTFEN_OKUYUN.inf where they learned that they need to send an email to it-specialist@mail.ua in order to obtain decryption software.

Crypto-malware's distribution relies on phishing emails

Just like the previous version of the malware, the new variant might be spreading via fake emails. Social engineering helps to convince users that they received an email from parcel delivery service, telecommunications company or even governmental institution. Malware executable is installed on the system when:

  • the user opens a malicious attachment;
  • the user enters a fake website and takes some required actions.

Therefore, you have to learn to identify phishing emails[3] to protect your device from ransomware attack. The most important task is to check sender’s email. If you have doubts that it’s suspicious, you should double-check contact details in the company’s official website.

Terminate Sifreli virus from the computer

Only professional security software can remove Sifreli safely from your device. If you do not know which program to choose, we suggesting Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware. The instructions below will show you how to disable the virus and uninstall it with the help of security software.

However, if you are thinking about manual elimination option, you should get rid of this idea immediately. Trying to locate and delete ransomware-related files from the PC might end up with serious damage to the system.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use. By Downloading any provided Anti-spyware software to remove Sifreli ransomware virus you agree to our privacy policy and agreement of use.
do it now!
Download
Reimage (remover) Happiness
Guarantee
Download
Reimage (remover) Happiness
Guarantee
Compatible with Microsoft Windows Compatible with OS X
What to do if failed?
If you failed to remove infection using Reimage, submit a question to our support team and provide as much details as possible.
Reimage is recommended to uninstall Sifreli ransomware virus. Free scanner allows you to check whether your PC is infected or not. If you need to remove malware, you have to purchase the licensed version of Reimage malware removal tool.
More information about this program can be found in Reimage review.
Press mentions on Reimage

Manual Sifreli virus Removal Guide:

Remove Sifreli using Safe Mode with Networking

Sometimes ransomware blocks access to security software and stops from automatic elimination. However, you can disable the virus first. These instructions show how to reboot the computer to the Safe Mode with Networking and then run your chosen malware removal tool.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Sifreli

    Log in to your infected account and start the browser. Download Reimage or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Sifreli removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Sifreli using System Restore

System restore option also helps to disable the virus in order to run automatic removal.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Sifreli. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage and make sure that Sifreli removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Sifreli from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by 2-spyware.com security experts.

Purchasing decryptor from cyber criminals is not recommended. This deal might end up with huge money loss. Therefore, you should try alternative data recovery methods. However, if you have backups, you should use them as soon as the ransomware is terminated from the system. 

If your files are encrypted by Sifreli, you can use several methods to restore them:

Data Recovery Pro – tool that helps to restore corrupted files

Originally, this program has been created for recovering files after system wreckage or accidental deletion. However, it has helped numerous victims of ransomware to restore their files too.

Take advantage of Windows Previous Versions feature

You can use Windows Previous Versions feature for recovering individual file types if System Restore has been enabled before the Sifreli attack. Then, you should follow these steps and recover individual files:

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Try ShadowExplorer in data recovery

It's unknown if Sifreli ransomware can delete Shadow Volume Copies or not. If not, you will be able to recover your files without any problems with ShadowExplorer.

  • Download Shadow Explorer (http://shadowexplorer.com/);
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Sifreli decryptor

The official Sifreli decryptor hasn't been created yet. Undoubtedly, security experts are working on this tool. Thus, you should be patient. Meanwhile, do not think about contacting cyber criminals and pay the ransom. It's not a safe recovery option!

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Sifreli and other ransomwares, use a reputable anti-spyware, such as Reimage, Plumbytes Anti-MalwareWebroot SecureAnywhere AntiVirus or Malwarebytes Anti Malware

About the author

Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions

References