.MERRY File Extension
Merry X-Mas Ransomware Encrypted File
| Developer | N/A |
| Popularity |
3.3 | 3 Votes |
What is a MERRY file?
A file with the .merry extension has been encrypted and renamed by Merry X-mas ransomware. It could be an encrypted document, database, image, video, or other type of file. Because the file is encrypted, you cannot open it. The .merry extension is added to the file's normal extension, producing an extension like .doc.merry.
More Information
In 2016, users first began reporting the existence of Merry X-Mas, or Merry Christmas, ransomware. Merry X-Mas infects a user's computer, encrypts and renames the user's files, and then produces a ransom note named YOUR_FILES_ARE_DEAD.HTA or MERRY_I_LOVE_YOU_BRUCE.HTA. The ransomware then automatically opens the ransom note, which contains a threatening countdown.
How did my computer become infected by Merry X-mas ransomware?
Merry X-mas ransomware is distributed via spam emails that claim to be a consumer complaint notification from the Federal Trade Commission (FTC). When you click the link the email contains, it downloads a file named COMPLAINT.pdf to your computer. This file is actually an .EXE file, not a .PDF file. Opening the file executes the program it contains, which installs Merry X-mas ransomware on your computer.
Should I pay a ransom to decrypt my files?
FileInfo recommends you never pay a ransom to decrypt your files. Also, free decryption tools exist that may allow you to restore your MERRY files to their normal state.
NOTE: Variants of Merry X-mas ransomware append users' files with the .mrcr1, .rare1, .rmcm1, or .pegs1 extension, instead of .merry.
How to open a MERRY file
You can decrypt MERRY files using Emsisoft Decryptor for MRCR (Windows). This tool requires that you have at least one pair of encrypted and decrypted files. (For example, the file document.docx, retrieved from a backup device, and its sibling, document.docx.merry, stored on your computer.) For full instructions on how to use Emsisoft Decryptor for MRCR, click the link found below.
Warning
FileInfo.com recommends you never pay a ransom to decrypt files encrypted by ransomware. Paying a ransom encourages ransomware distributors to continue their efforts, and there is no guarantee that paying a ransom will give you access to your files. Instead, you should restore your data from a recent backup created before the ransomware infected your computer.