Guide To MerryChristmas ransomware Uninstallation From Windows (7/8/10)

 

Depth Analysis on MerryChristmas ransomware

MerryChristmas ransomware is a pernicious malware infection which the malware experts have notified mainly targeting the computer systems running Windows OS. It do includes potential of leading negative consequences onto almost all the newest versions of Windows OS. It commonly perforates itself very silently inside the targeted system without being acknowledged by the users, identical to those of numerous other infections of the same group. It once disseminated successfully, causes numerous hazardous issues in the PC.

MerryChristmas ransomware usually begins exercising unethical practices via firstly acquiring complete control over entire system and then modifying it's default Windows registry settings. Offenders intentionally exercise this particular action for the purpose of making their crafted malicious program capable enough of obtaining automatic activation in the system with each Windows reboot. Infection moreover aside from this, degrades security programs existing in the system for preventing itself from being traced and then eradicated from the PC. It upon the completion of all these practices, initializes execution of deep scanning procedure. Sole objective of crooks behind practicing this is to find out system's files compatible with it's corruption. Infection following the accomplishment of this scanning process, poses encryption operation onto the files matching with it's target files. It usually while executing encryption operation onto files, appends either of the set forth extensions depending on it's variant :

• .Merry
• .MRCR1
• .RARE1

MerryChristmas ransomware upon completion of the encryption procedure, opens up a pop-up window including a ransom-demanding message. Researchers have notified this ransom demanding message getting represented in 'MERRY_I_LOVE_YOU_BRUCE.HTA or YOUR_FILES_ARE_DEAD.HTA files'. Comparatively with the note released in the case of several other ransomware infections, this ones is quite short, merely stating that the PC's files have been encrypted and thus the victims are required to contact developers through "@comodosecuriy" telegram or "[email protected]" email and pay certain amount of ransom money. Though the cost is not specified, but assumptions are high it would lie between $500 – 1500 Bitcoins. Note besides from this, also includes threatening message stating that in a case if the asked amount of payment is not made without the given time frame, then in that situation the enciphered will be permanently deleted.

Now regardless of the fact that released note as well as content included in it appears 100% authentic at the very first glance, it is kindly suggested neither to trust any of them nor to make any asked payment and instead only focus on the uninstallation of MerryChristmas ransomware from the system since according to malware researchers it is almost the only measure possible to the emancipation of system from all aforementioned types of awful traits.

Instances Leading To Silent Proliferation of MerryChristmas ransomware Inside PC

• Downloading freeware programs from several anonymous domain and then installing them in the system with careless attitude (i.e., without paying appropriate magnitude of attention to the entire installation procedure).
• Accessing spam emails and opening their malicious attachments.
• Sharing files in networking environment.
• Playing online games and watching adult sites leads to the invasion of MerryChristmas ransomware inside system on large extent. 

Free Scan your Windows PC to detect MerryChristmas

 

Remove MerryChristmas From Your PC

Step 1: Remove MerryChristmas in Safe Mode with Command Prompt

• First of all disconnect your PC with network connection.
• Click restart button and keep pressing F8 key regularly while system restart.

• You will see “Windows Advanced Options Menu” on your computer screen.

• Select “Safe Mode with Command Prompt” and press Enter key.

• You must login your computer with Administrator account for full privilege.

• Once the Command Prompt appears then type rstrui.exe and press Enter

• Now follow the prompts on your screen to complete system restore.

Step 2: Remove MerryChristmas using MSConfig in Safe Mode:

• Power off your computer and restart again.
• While booting press the “F8 key” continuously to open “Windows Advanced Options Menu”.

• Use the arrow keys to select “Safe Mode” option and press Enter key.

• Once system get started go to Start menu. Type “msconfig” in the search box and launch the application.

• Go to the Startup tab and look for files from %AppData% or %Temp% folders using rundll32.exe. See an example below:

C:\Windows\System32\rundll32.exe C:\Users\username\appdata\local\temp\regepqzf.dll,H1N1

• Disable all the malicious entries and save the changes.
• Now restart your computer normally.

Step 3 : Kill Malicious Process Related To MerryChristmas

• Press Alt+Ctrl+Del buttons together.

• It will open the Task manager on your screen.
• Go to Process Tab and find MerryChristmas related process.
• Click the End Process Now button to stop the running process.

Step 4 : Remove MerryChristmas Virus From Registry Entry

• Press “Windows + R” key together to open Run Box.

• Type “regedit” and click OK button.

• Find and remove MerryChristmas related entries.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Now hopefully you have completely removed the MerryChristmas virus from your computer. If you are still get ransom message from the threat or unable to access your files, then it means that virus still remain into your computer. In such situation you don’t have any other option except removing this virus using any powerful malware removal tool.

Whereas if you have any backup of your infected or encrypted files, then you can also reinstall your Windows OS. This will erase all your files and data as along with the MerryChristmas infection. You will get a completely empty computer system with no files. Now you can use your backup to get your files. If you don’t have any backup then using malware removal tool is a better option for you.

If you have any query or question regarding your computer, then you can easily ask your problem to our experts. Go to the Ask Any Question page and get the answer for your query directly from out experts.