Emsisoft Decryptor for TurkStatik is a freeware ransomware tool that will help to free files held hostage by the TurkStatik ransomware strain.

Emsisoft Decryptor for TurkStatik is a freeware ransomware tool that will help to free files held hostage by the TurkStatik ransomware strain.

The TurkStatik ransomware mostly targets Turkish victims and encrypts their files using Rijndael 256. It appends the ".ciphered" extension to the encrypted files. But as we know this does not mean it will stay limited to them so we decided to list it in that event but also for any of our Turkish users.

The ransom note "README_DONT_DELETE.txt" contains the following Turkish text:



This is the translation:



You will need to remove the malware from your system first; otherwise, it will repeatedly lock your system or encrypt files. By default, Emsisoft Decryptor for TurkStatik will pre-populate the locations to decrypt with the currently connected drives and network drives. Additional locations can be added via the Add button.

Emsisoft Decryptor for TurkStatik requires access to a file pair consisting of one encrypted file and the original, unencrypted version of the encrypted file to reconstruct the encryption keys needed to decrypt the rest of your data. Do not change the file names of the original and encrypted files. This is because the decryptor may perform file name comparisons to determine the correct file extension used for encrypted files on your system.

Run the decryptor, and select your file pair. Then click the Start button. The decryptor will start to reconstruct the required encryption parameters. Depending on the ransomware and your computer, this process can take a significant amount of time.

Emsisoft Decryptor for TurkStatik will inform you that the decryption process is complete. If you require a report for your records, you can save it by clicking the Save Log button. You also have the option to copy it straight to your clipboard for use in emails, forum posts, etc., if needed.

  Download