Severity scale:  

Remove Sifreli ransomware / virus (Removal Guide) - Quick Decryption Solution

removal by Gabriel E. Hall - - | Type: Ransomware

Sifreli ransomware continues attacking Turkish computer users

Screenshot of the ransom note by Sifreli

Sifreli is a Turkish[1] ransomware virus that appends .sifreli extension to each of the targeted files. For the first time, malware was seen in 2014. However, after three years the virus has been updated.

After the infiltration and data encryption, Sifreli virus drops a ransom note where author informs about the unpleasant situation and give instructions what victims need to do. According to the message, the developer is a system engineer who looks up for system security vulnerabilities and exploits them in order to launch the attack.

The ransom note informs about encrypted files and stolen personal information. In order to get back the files and protect personal information from being published on the Internet, people have to pay the ransom. However, in order to learn the price for their data, victims have to send an email to

However, after ransomware attack, you should not worry about your files. The first thing you have to do is to remove Sifreli from the computer in order to avoid other possible damage. Malware might track some personal information and affect legitimate system processes. Thus, your identity and computer might be at great risk.

Therefore, after the attack, you should scan the device with professional security software immediately. The program, such as Reimage Reimage Cleaner Intego, will delete all malware-related components without causing any damage to the system. After the Sifreli removal, you will be able to recover at least some of the files from backups.

The image of Sifreli ransomwareSifreli aims at Turkish speaking computer users and threatens to expose their private information on the Internet if they do not pay the ransom.

Sifreli ransomware started its career in 2014

Three years ago, malware researchers found this crypto-malware attacking Turkish and British computer users. There were used two different phishing[2] email campaigns to spread the Sifreli:

  • Turkish users received a fake letter from local mobile phone operator Turkcell;
  • British users received a bogus email from Royal Mail that informed about not delivered parcel and asked to download a particular information.

When users were tricked by this scam, malware payload was dropped and executed on the system. Then the Sifreli ransomware started data encryption procedure using AES encryption algorithm. It aimed at image, audio, text, archives and other popular files and demanded to pay the ransom in 3 days.

British computer users were unable to open their files because of .encrypted files extension. Meanwhile, victims from Turkey found .sifreli extension appended to their data. Following the encryption, they found ransom notes called either PLEASE_READ.inf or LUTFEN_OKUYUN.inf where they learned that they need to send an email to in order to obtain decryption software.

Crypto-malware's distribution relies on phishing emails

Just like the previous version of the malware, the new variant might be spreading via fake emails. Social engineering helps to convince users that they received an email from parcel delivery service, telecommunications company or even governmental institution. Malware executable is installed on the system when:

  • the user opens a malicious attachment;
  • the user enters a fake website and takes some required actions.

Therefore, you have to learn to identify phishing emails[3] to protect your device from ransomware attack. The most important task is to check sender’s email. If you have doubts that it’s suspicious, you should double-check contact details in the company’s official website.

Terminate Sifreli virus from the computer

Only professional security software can remove Sifreli safely from your device. If you do not know which program to choose, we suggesting Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes. The instructions below will show you how to disable the virus and uninstall it with the help of security software.

However, if you are thinking about manual elimination option, you should get rid of this idea immediately. Trying to locate and delete ransomware-related files from the PC might end up with serious damage to the system.

do it now!
Reimage Happiness
Intego Happiness
Compatible with Microsoft Windows Supported versions Compatible with OS X Supported versions
What to do if failed?
If you failed to remove virus damage using Reimage Intego, submit a question to our support team and provide as much details as possible.
Reimage Intego has a free limited scanner. Reimage Intego offers more through scan when you purchase its full version. When free scanner detects issues, you can fix them using free manual repairs or you can decide to purchase the full version in order to fix them automatically.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Reimage, try running SpyHunter 5.
Alternative Software
Different software has a different purpose. If you didn’t succeed in fixing corrupted files with Intego, try running Combo Cleaner.

To remove Sifreli virus, follow these steps:

Remove Sifreli using Safe Mode with Networking

Sometimes ransomware blocks access to security software and stops from automatic elimination. However, you can disable the virus first. These instructions show how to reboot the computer to the Safe Mode with Networking and then run your chosen malware removal tool.

  • Step 1: Reboot your computer to Safe Mode with Networking

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Safe Mode with Networking from the list Select 'Safe Mode with Networking'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Networking in Startup Settings window. Select 'Enable Safe Mode with Networking'
  • Step 2: Remove Sifreli

    Log in to your infected account and start the browser. Download Reimage Reimage Cleaner Intego or other legitimate anti-spyware program. Update it before a full system scan and remove malicious files that belong to your ransomware and complete Sifreli removal.

If your ransomware is blocking Safe Mode with Networking, try further method.

Remove Sifreli using System Restore

System restore option also helps to disable the virus in order to run automatic removal.

  • Step 1: Reboot your computer to Safe Mode with Command Prompt

    Windows 7 / Vista / XP
    1. Click Start Shutdown Restart OK.
    2. When your computer becomes active, start pressing F8 multiple times until you see the Advanced Boot Options window.
    3. Select Command Prompt from the list Select 'Safe Mode with Command Prompt'

    Windows 10 / Windows 8
    1. Press the Power button at the Windows login screen. Now press and hold Shift, which is on your keyboard, and click Restart..
    2. Now select Troubleshoot Advanced options Startup Settings and finally press Restart.
    3. Once your computer becomes active, select Enable Safe Mode with Command Prompt in Startup Settings window. Select 'Enable Safe Mode with Command Prompt'
  • Step 2: Restore your system files and settings
    1. Once the Command Prompt window shows up, enter cd restore and click Enter. Enter 'cd restore' without quotes and press 'Enter'
    2. Now type rstrui.exe and press Enter again.. Enter 'rstrui.exe' without quotes and press 'Enter'
    3. When a new window shows up, click Next and select your restore point that is prior the infiltration of Sifreli. After doing that, click Next. When 'System Restore' window shows up, select 'Next' Select your restore point and click 'Next'
    4. Now click Yes to start system restore. Click 'Yes' and start system restore
    Once you restore your system to a previous date, download and scan your computer with Reimage Reimage Cleaner Intego and make sure that Sifreli removal is performed successfully.

Bonus: Recover your data

Guide which is presented above is supposed to help you remove Sifreli from your computer. To recover your encrypted files, we recommend using a detailed guide prepared by security experts.

Purchasing decryptor from cyber criminals is not recommended. This deal might end up with huge money loss. Therefore, you should try alternative data recovery methods. However, if you have backups, you should use them as soon as the ransomware is terminated from the system. 

If your files are encrypted by Sifreli, you can use several methods to restore them:

Data Recovery Pro – tool that helps to restore corrupted files

Originally, this program has been created for recovering files after system wreckage or accidental deletion. However, it has helped numerous victims of ransomware to restore their files too.

  • Download Data Recovery Pro;
  • Follow the steps of Data Recovery Setup and install the program on your computer;
  • Launch it and scan your computer for files encrypted by Sifreli ransomware;
  • Restore them.

Take advantage of Windows Previous Versions feature

You can use Windows Previous Versions feature for recovering individual file types if System Restore has been enabled before the Sifreli attack. Then, you should follow these steps and recover individual files:

  • Find an encrypted file you need to restore and right-click on it;
  • Select “Properties” and go to “Previous versions” tab;
  • Here, check each of available copies of the file in “Folder versions”. You should select the version you want to recover and click “Restore”.

Try ShadowExplorer in data recovery

It's unknown if Sifreli ransomware can delete Shadow Volume Copies or not. If not, you will be able to recover your files without any problems with ShadowExplorer.

  • Download Shadow Explorer (;
  • Follow a Shadow Explorer Setup Wizard and install this application on your computer;
  • Launch the program and go through the drop down menu on the top left corner to select the disk of your encrypted data. Check what folders are there;
  • Right-click on the folder you want to restore and select “Export”. You can also select where you want it to be stored.

Sifreli decryptor

The official Sifreli decryptor hasn't been created yet. Undoubtedly, security experts are working on this tool. Thus, you should be patient. Meanwhile, do not think about contacting cyber criminals and pay the ransom. It's not a safe recovery option!

Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Sifreli and other ransomwares, use a reputable anti-spyware, such as Reimage Reimage Cleaner Intego, SpyHunter 5Combo Cleaner or Malwarebytes

Access your website securely from any location

When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. It is a hassle when your website is protected from suspicious connections and unauthorized IP addresses.

The best solution for creating a tighter network could be a dedicated/fixed IP address. If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for server or network manager that need to monitor connections and activities. This is how you bypass some of the authentications factors and can remotely use your banking accounts without triggering suspicious with each login. 

VPN software providers like Private Internet Access can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world. It is better to clock the access to your website from different IP addresses. So you can keep the project safe and secure when you have the dedicated IP address VPN and protected access to the content management system.

Backup files for the later use, in case of the malware attack

Computer users can suffer from data losses due to cyber infections or their own faulty doings. Ransomware can encrypt and hold files hostage, while unforeseen power cuts might cause a loss of important documents. If you have proper up-to-date backups, you can easily recover after such an incident and get back to work. It is also equally important to update backups on a regular basis so that the newest information remains intact – you can set this process to be performed automatically.

When you have the previous version of every important document or project you can avoid frustration and breakdowns. It comes in handy when malware strikes out of nowhere. Use Data Recovery Pro for the data restoration process.

About the author
Gabriel E. Hall
Gabriel E. Hall - Passionate web researcher

If this free removal guide helped you and you are satisfied with our service, please consider making a donation to keep this service alive. Even a smallest amount will be appreciated.

Contact Gabriel E. Hall
About the company Esolutions


Your opinion regarding Sifreli ransomware virus