A virus which was initially detected in the beginning of 2017, known as Merry Christmas has come up with it’s latest version, using the .MERRY file extension. The ransomware aims to encrypt the files on the infected computers and then ask users to read the “MERRY_I_LOVE_YOU_BRUCE.HTA” which It drops after encryption. In the file, there are instructions on how to pay the ransom fee and restore the encrypted files this way. しかし, do not be worried, because this ransomware type of infection is now decryptable. If you want to remove Merry X-mas ransomware and decrypt your files for free, we recommend to read our article about it.
What Does Merry Christmas .MERRY File Virus Do?
After it has already caused an infection, the ransomware virus adds it’s own ransom note and changes the wallpaper of the infected computer to the following “evil Santa” image.
The note which the virus leaves is called MERRY_I_LOVE_YOU_BRUCE.HTA and it has the following content:
ALL COMPUTER DATA ENCRYPTED
TIME AFTER ALL FILES WILL BE DELETED
YOUR ID
NOW YOU NEED TO PAY TO RECOVER YOUR DATA
AFTER MONEY TRANSFER YOU WILL RECIEVE THE DECRYPTOR
CONTACTS
TELEGRAM @comodosecunty
EMAIL [email protected]
Any attempts to return your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.
Finally it will be impossible to decrypt your files! There are several plain steps to restore your files but if you do not follow them we will not be able to help you!
But this is not where the terror of this ransomware infection end. The malware is also capable of performing several other activities such as deleting the shadow copies by inserting variants of the following command:
vssadmin delete shadows /for={volume} /shadow={id} /quiet
それに加えて, after infection, the malware also cuts out any internet connection, because it deletes drivers of your local network. This type of danger is new and completely different from what has been met before. 幸いなことに, the virus is decryptable.
How Did I Get Infected with This Virus
To get infected with this ransomware virus, one does not need much. All it takes is to open a malicious e-mail and to not have any anti-malware protection installed. Usually the .MERRY ransomware virus may come standard with the infection method – as a malicious e-mail attachment which may pretend to be a document or another type of file. Most inexperienced users are misled that this is an actual e-mail from legitimate services, like PayPal, e-Bay and other companies and open the attachment.
そこから, the infection sets off. ザ・ .MERRY ransomware creates mutexes, “touches” files and modifies(deletes) or adds new registry values that make it’s executable to encrypt files on system startup, 例えば.
The virus may also connect to a remove C2 server and download the payload of .MERRY ransomware after which place it in crucial Windows directories, といった:
- %アプリデータ％
- %ローミング％
- %地元％
- %LocalRow％
How To Remove .Merry Extension Virus and Decrypt The Files
このランサムウェアウイルスを除去するために, we strongly urge you to follow our removal instructions below. For maximum effectiveness and automatic and fill removal, experts recommend using an anti-malware software. さらに, after having removed the .Merry file extension ransomware, you may want to focus on decrypting your files, web link for which you can find in the red box below.
セーフモードでの起動
Windowsの場合:
1) ホールド WindowsキーとR
2) 実行ウィンドウが表示されます, そのタイプで “MSCONFIG” ヒット 入る
3) ウィンドウが表示された後は、ブート]タブに移動し、セーフブートを選択します
Cut out .Merry Ransomware in Task Manager
1) 押す CTRL + ESC + Shiftキー 同時に.
2) 見つけます “プロセス” タブ.
3) Locate the malicious process of .Merry Ransomware, そして、それを右クリックして、それのタスクを終了し、クリック “終了プロセス”
Eliminate .Merry Ransomware‘s Malicious Registries
ほとんどのWindows変異体について:
1) ホールド WindowsのボタンとR.
2) の中に “ラン” ボックスタイプ “Regeditを” ヒット “入る”.
3) ホールド CTRL + F keys and type .Merry Ransomware or the file name of the malicious executable of the virus which is usually located in %AppData%, %一時％, %地元％, %％または％SystemDrive％にローミング.
4) 悪質なレジストリオブジェクトを設置した後, そのうちのいくつかは、ファイル名を指定して実行のRunOnceサブキーに通常あるermanentlyそれらを削除し、コンピュータを再起動します. ここでは、異なるバージョンのためのキーを見つけて削除する方法です.
Windowsの場合 7: スタートメニューを開き、検索タイプとタイプregeditで - >それを開きます. - > [Ctrl]キーを押し + F buttons –> Type .Merry Ransomware Virus in the search field.
勝つ 8/10 ユーザー: [スタート]ボタン - > [ファイル名を指定して実行]を選択 - > regeditと入力 - >ヒットを入力してください - > Ctrlキーを押しながら + Fボタン. Type .Merry Ransomware in the search field.
Automatic Removal of .Merry Ransomware
Decrypt Files Encrypted by The .Merry Ransomware Ransomware.
For the decryption, please follow this web link:
HTTPS://decrypter.emsisoft.com/mrcr