Hey you,
BE IN THE KNOW!

35,000 ransomware infections per month and you still believe you are protected?

Sign up to receive:

  • alerts
  • news
  • free how-to-remove guides

of the newest online threats - directly to your inbox:


Merry X-Mas Virus. Remove and Restore .RARE1, .PEGS1, .MRCR1 Files

This article will help you remove the Merry X-Mas virus completely. Follow the ransomware removal instructions given at the end of the article.

A new version of the X-mas Virus has appeared, with a new ransom note and a few other changes.

Merry X-Mas virus is ransomware that encrypts a victim’s files. All files will become encrypted with one of three extensions – .RARE1, .PEGS1, .MRCR1 appended to them, when the encryption process is done. The Merry X-Mas ransomware will display a ransom note giving you around three days to meet the demands written in there.

Update! There is now a decryptor tool for this ransomware! The tool was created by Fabian Wosar from EMSIsoft and can be found at the page Emsisoft Decrypter for MRCR. Works for all known extensions – “.PEGS1”, “.MRCR1”, “.RARE1”, “.RMCM1” or “.MERRY”.

Threat Summary

NameMerry X-Mas
TypeRansomware
Short DescriptionThe ransomware encrypts files on your computer and puts a ransom note after the encryption process finishes.
SymptomsThe ransomware will encrypt your files and append one of three extensions – .RARE1, .PEGS1, or .MRCR1 on each one of the files when the encryption is over.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Merry X-Mas

Download

Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Merry X-Mas.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Merry X-Mas Virus – Distribution Ways

Merry X-Mas virus could be distributed by using various ways. The payload file which executes the malicious script for the ransomware that is responsible for infecting a computer device has been seen on the Internet as “COMPLAINT.pdf.exe”. The icon it uses can be seen here on the right. You could also preview the detections it has from the screenshot down below, taken from the VirusTotal service:

As the ransomware is mainly distributed with e-mails, here is an example email that contains the payload file as an attachment:

The e-mail reads the following:

CONSUMER COMPLAINT NOTIFICATION

Dear, [redacted]

This notification has been automatically sent to you because we have received a consumer complaint,
claiming that your company is violating the CCPA (Consumer Credit Protection Act).
According to our policy, we have initiated a formal investigation before taking legal action.

You can download the document containing the complaint and the plaintiff contact information from:
https://ftc.gov/documents/download.aspx?complaint_id=42084270

Note that Adobe Reader must be installed on your computer.
Please take a moment to review the bolded section in the complaint, regarding the CCPA violation.

Regards,
Federal Trade Commission

The Merry X-Mas ransomware can also be using social media services and file-sharing networks as another distribution way for that payload file. Freeware programs could be promoted on the Web as useful but also could hide the malicious script of the cryptovirus. Refrain from immediately opening files after you have downloaded them – scan the files first. Run security software and scan them, while also check for anything out of place about their size and signatures. You should read the ransomware preventing tips given in the forum section.

Merry X-Mas Virus – More Information

The Merry X-Mas a cryptovirus and a ransomware. Probably meant for the past Christmas holidays, now more information comes out for it, as researchers boil down what the malware does after infecting a PC. Malware researchers have discovered different versions of this ransomware, resulting in the files being encrypted with a different extension for each version.

Merry X-Mas ransomware can make Windows Registry entries for achieving a bigger level of persistence. Those registry entries are made in such a way to launch the cryptovirus automatically with every single boot of the Windows operating system.

An example of such a registry entry, which runs the ransom note file on each start of Windows:

→HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “Adobe2” = %UserProfile%\Desktop\YOUR_FILES_ARE_DEAD.HTA

The ransom note will be displayed after the encryption process is finished. The note with the demands and instructions for payment of the cybercriminals, for decrypting your files is located inside of a file called YOUR_FILES_ARE_DEAD.HTA:

The ransom note message reads the following:

ALL SERVER DATA ENCRYPTED! [or ALL COMPUTER DATA ENCRYPTED] 03 days 23:57:30 0109
TIME AFTER ALL FILES WILL BE DELETED
YOUR ID
NOW YOU NEED TO PAY TO RECOVER YOUR DATA
AFTER MONEY TRANSFER YOU WILL RECIEVE THE DECRYPTOR
CONTACTS
TELEGRAM @comodosecunty
EMAIL [email protected]
Any attempts to return your files with the third-party tools can be fatal for your encrypted files! The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.
Finally it will be impossible to decrypt your files! There are several plain steps to restore your files but if you do not follow them we will not be able to help you!

The ways to contact the crooks are the following:

  • TELEGRAM: @comodosecurity
  • EMAIL: [email protected]

The criminals who spread the Merry X-Mas ransomware should NOT in any way be contacted or paid. If you pay them, nothing and nobody can guarantee that you will get your files back. Your files may not get back to normal. Besides, funding the cybercriminals in that way will only be supporting them and encourage them to do more criminal acts.

Below, you can view a list with file extensions that the Merry X-Mas virus seeks to encrypt. The list contains more than one thousand extensions.

→.001, .1cd, .3d, .3d4, .3df8, .3dm, .3ds, .3fr, .3g2, .3ga, .3gp, .3gp2, .3mm, .3pr, .7z, .7zip, .8ba, .8bc, .8be, .8bf, .8bi8, .8bl, .8bs, .8bx, .8by, .8li, .a2c, .aa, .aa3, .aac, .aaf, .ab4, .abk, .abw, .ac2, .ac3, .accdb, .accde, .accdr, .accdt, .ace, .ach, .acr, .act, .adb, .ade, .adi, .adp, .adpb, .adr, .ads, .adt, .aep, .aepx, .aes, .aet, .afp, .agd1, .agdl, .ai, .aif, .aiff, .aim, .aip, .ais, .ait, .ak, .al, .allet, .alphacrypt, .amf, .amr, .amu, .amx, .amxx, .ans, .aoi, .ap, .ape, .api, .apj, .apk, .apnx, .app, .arc, .arch00, .ari, .arj, .aro, .arr, .arw, .as, .as3, .asa, .asc, .ascx, .ase, .asf, .ashx, .asm, .asmx, .asp, .aspx, .asr, .asset, .asx, .automaticdestinations-ms, .avi, .avs, .awg, .azf, .azs, .azw, .azw1, .azw3, .azw4, .b2a, .back, .backup, .backupdb, .bad, .bak, .bank, .bar, .bat, .bay, .bc6, .bc7, .bck, .bcp, .bdb, .bdp, .bdr, .bfa, .bgt, .bi8, .bib, .bic, .big, .bik, .bin, .bkf, .bkp, .bkup, .blend, .blob, .blp, .bmc, .bmf, .bml, .bmp, .boc, .bp2, .bp3, .bpk, .bpl, .bpw, .brd, .bsa, .bsk, .bsp, .btoa, .bvd, .bz2, .c, .cag, .cam, .camproj, .cap, .car, .cas, .cat, .cbf, .cbr, .cbz, .cc, .ccd, .ccf, .cch, .cd, .cdf, .cdi, .cdr, .cdr3, .cdr4, .cdr5, .cdr6, .cdrw, .cdx, .ce1, .ce2, .cef, .cer, .cert, .cfg, .cfm, .cfp, .cfr, .cgf, .cgi, .cgm, .cgp, .chk, .chml, .cib, .class, .clr, .cls, .clx, .cmd, .cmf, .cms, .cmt, .cnf, .cng, .cod, .col, .con, .conf, .config, .contact, .cp, .cpi, .cpio, .cpp, .cr2, .craw, .crd, .crt, .crw, .crwl, .crypt, .crypted, .cryptra, .cryptXXX, .cs, .csh, .csi, .csl, .cso, .csr, .css, .csv, .ctt, .cty, .cue, .cwf, .d3dbsp, .dac, .dal, .dap, .das, .dash, .dat, .database, .dayzprofile, .dazip, .db, .db_journal, .db0, .db3, .dba, .dbb, .dbf, .dbfv, .db-journal, .dbx, .dc2, .dc4, .dch, .dco, .dcp, .dcr, .dcs, .dcu, .ddc, .ddcx, .ddd, .ddoc, .ddrw, .dds, .default, .dem, .der, .des, .desc, .design, .desklink, .dev, .dex, .dfm, .dgc, .dic, .dif, .dii, .dim, .dime, .dip, .dir, .directory, .disc, .disk, .dit, .divx, .diz, .djv, .djvu, .dlc, .dmg, .dmp, .dng, .dob, .doc, .docb, .docm, .docx, .dot, .dotm, .dotx, .dox, .dpk, .dpl, .dpr, .drf, .drw, .dsk, .dsp, .dtd, .dvd, .dvi, .dvx, .dwg, .dxb, .dxe, .dxf, .dxg, .e4a, .edb, .efl, .efr, .efu, .efx, .eip, .elf, .emc, .emf, .eml, .enc, .enx, .epk, .eps, .epub, .eql, .erbsql, .erf, .err, .esf, .esm, .euc, .evo, .ex, .exf, .exif, .f90, .faq, .fcd, .fdb, .fdr, .fds, .ff, .ffd, .fff, .fh, .fhd, .fla, .flac, .flf, .flp, .flv, .flvv, .for, .forge, .fos, .fpenc, .fpk, .fpp, .fpx, .frm, .fsh, .fss, .fxg, .gadget, .gam, .gbk, .gbr, .gdb, .ged, .gfe, .gfx, .gho, .gif, .gif,.bmp, .gpg, .gpx, .gray, .grey, .grf, .groups, .gry, .gthr, .gxk, .gz, .gzig, .gzip, .h, .h3m, .h4r, .hbk, .hbx, .hdd, .hex, .hkdb, .hkx, .hplg, .hpp, .hqx, .htm, .html, .htpasswd, .hvpl, .hwp, .ibank, .ibd, .ibooks, .ibz, .ico, .icxs, .idl, .idml, .idx, .ie5, .ie6, .ie7, .ie8, .ie9, .iff, .iif, .iiq, .img, .incpas, .indb, .indd, .indl, .indt, .ink, .inx, .ipa, .iso, .isu, .isz, .itdb, .itl, .itm, .iwd, .iwi, .jac, .jar, .jav, .java, .jbc, .jc, .jfif, .jge, .jgz, .jif, .jiff, .jks, .jnt, .jpc, .jpe, .jpeg, .jpf, .jpg, .jpw, .js, .json, .jsp, .just, .k25, .kc2, .kdb, .kdbx, .kdc, .kde, .key, .kf, .klq, .kml, .kmz, .kpdx, .kwd, .kwm, .laccdb, .lastlogin, .lay, .lay6, .layout, .lbf, .lbi, .lcd, .lcf, .lcn, .ldb, .ldf, .lgp, .lib, .lit, .litemod, .lngttarch2, .localstorage, .locky, .log, .lp2, .lpa, .lrf, .ltm, .ltr, .ltx, .lua, .lvivt, .lvl, .m, .m2, .m2ts, .m3u, .m3u8, .m4a, .m4p, .m4u, .m4v, .mag, .man, .map, .mapimail, .max, .mbox, .mbx, .mcd, .mcgame, .mcmeta, .mcrp, .md, .md0, .md1, .md2, .md3, .md5, .mdb, .mdbackup, .mdc, .mddata, .mdf, .mdl, .mdn, .mds, .mef, .menu, .meo, .mfd, .mfw, .mic, .mid, .mim, .mime, .mip, .mjd, .mkv, .mlb, .mlx, .mm6, .mm7, .mm8, .mme, .mml, .mmw, .mny, .mobi, .mod, .moneywell, .mos, .mov, .movie, .moz, .mp1, .mp2, .mp3, .mp4, .mp4v, .mpa, .mpe, .mpeg, .mpg, .mpq, .mpqge, .mpv2, .mrw, .mrwref, .ms11, .ms11(Securitycopy), .mse, .msg, .msi, .msp, .mts, .mui, .mxp, .myd, .myi, .nav, .ncd, .ncf, .nd, .ndd, .ndf, .nds, .nef, .nfo, .nk2, .nop, .note, .now, .nrg, .nri, .nrw, .ns2, .ns3, .ns4, .nsd, .nsf, .nsg, .nsh, .ntl, .number, .nvram, .nwb, .nx1, .nx2, .nxl, .nyf, .oab, .obj, .odb, .odc, .odf, .odg, .odi, .odm, .odp, .ods, .odt, .oft, .oga, .ogg, .oil, .opd, .opf, .orf, .ost, .otg, .oth, .otp, .ots, .ott, .owl, .oxt, .p12, .p7b, .p7c, .pab, .pack, .pages, .pak, .paq, .pas, .pat, .pbf, .pbk, .pbp, .pbs, .pcd, .pct, .pcv, .pdb, .pdc, .pdd, .pdf, .pef, .pem, .pfx, .php, .pif, .pkb, .pkey, .pkh, .pkpass, .pl, .plb, .plc, .pli, .plugin, .plus_muhd, .pm, .pmd, .png, .po, .pot, .potm, .potx, .ppam, .ppd, .ppf, .ppj, .pps, .ppsm, .ppsx, .ppt, .pptm, .pptx, .prc, .prel, .prf, .priv, .privat, .props, .prproj, .prt, .ps, .psa, .psafe3, .psd, .psk, .pspimage, .pst, .psw6, .ptx, .pub, .puz, .pwf, .pwi, .pwm, .pxp, .py, .qba, .qbb, .qbm, .qbr, .qbw, .qbx, .qby, .qcow, .qcow2, .qdf, .qed, .qel, .qic, .qif, .qpx, .qt, .qtq, .qtr, .r00, .r01, .r02, .r03, .r3d, .ra, .ra2, .raf, .ram, .rar, .rat, .raw, .rb, .rdb, .rdi, .re4, .res, .result, .rev, .rgn, .rgss3a, .rim, .rll, .rm, .rng, .rofl, .rpf, .rrt, .rsdf, .rsrc, .rss, .rsw, .rte, .rtf, .rts, .rtx, .rum, .run, .rv, .rvt, .rw2, .rwl, .rwz, .rzk, .rzx, .s3db, .sad, .saf, .safe, .sas7bdat, .sav, .save, .say, .sb, .sc2save, .sch, .scm, .scn, .scx, .sd0, .sd1, .sda, .sdb, .sdc, .sdf, .sdn, .sdo, .sds, .sdt, .search-ms, .sef, .sen, .ses, .sfs, .sfx, .sgz, .sh, .shar, .shr, .shw, .shy, .sid, .sidd, .sidn, .sie, .sis, .sitx, .sldm, .sldx, .slk, .slm, .sln, .slt, .sme, .snk, .snp, .snx, .so, .spd, .spr, .sql, .sqlite, .sqlite3, .sqlitedb, .sqllite, .sqx, .sr2, .srf, .srt, .srw, .ssa, .st4, .st5, .st6, .st7, .st8, .stc, .std, .sti, .stm, .stt, .stw, .stx, .sud, .suf, .sum, .svg, .svi, .svr, .swd, .swf, .switch, .sxc, .sxd, .sxg, .sxi, .sxm, .sxw, .syncdb, .t01, .t03, .t05, .t12, .t13, .tar, .tar.bz2, .tarbz2, .tax, .tax2013, .tax2014, .tbk, .tbz2, .tch, .tcx, .teslacrypt, .tex, .text, .tg, .tga, .tgz, .thm, .thmx, .tif, .tiff, .tlb, .tlg, .tlz, .tmp, .toast, .tor, .torrent, .tpu, .tpx, .trp, .ts, .tu, .tur, .txd, .txf, .txt, .uax, .udf, .uea, .umx, .unity3d, .unr, .unx, .uop, .uot, .upk, .upoi, .url, .usa, .usx, .ut2, .ut3, .utc, .utx, .uu, .uud, .uue, .uvx, .uxx, .val, .vault, .vb, .vbox, .vbs, .vc, .vcd, .vcf, .vcxpro, .vdf, .vdi, .vdo, .ver, .vfs0, .vhd, .vhdx, .vlc, .vlt, .vmdk, .vmf, .vmsd, .vmt, .vmx, .vmxf, .vob, .vp, .vpk, .vpp_pc, .vsi, .vtf, .w3g, .w3x, .wab, .wad, .wallet, .war, .wav, .wave, .waw, .wb2, .wbk, .wdgt, .wks, .wm, .wma, .wmd, .wmdb, .wmmp, .wmo, .wmv, .wmx, .wotreplay, .wow, .wpd, .wpe, .wpk, .wpl, .wps, .wsf, .wsh, .wtd, .wtf, .wvx, .x11, .x3f, .xcodeproj, .xf, .xhtml, .xis, .xl, .xla, .xlam, .xlc, .xlk, .xll, .xlm, .xlr, .xls, .xlsb, .xlsm, .xlsx, .xlt, .xltm, .xltx, .xlv, .xlw, .xlwx, .xml, .xpi, .xps, .xpt, .xqx, .xsl, .xtbl, .xvid, .xwd, .xxe, .xxx, .yab, .ycbcra, .yenc, .yml, .ync, .yps, .yuv, .z02, .z04, .zap, .zip, .zipx, .zoo, .zps, .ztmp

Extension List Source: Bleeping Computer

Each of the files that will get encrypted in the process will receive one and the same extension out of these three: .RARE1, .PEGS1, .MRCR1. The extension which will be appended depends on the version of the ransomware as there are several of them spread across the Internet.

The Merry X-Mas ransomware is possible to erase the Shadow volume copies from the Windows operating system with the aid of the following command:

→vssadmin.exe delete shadows /all /Quiet

Read further to see what types of ways you could try to restore some of your files and data.

Remove Merry X-Mas Virus and Restore .RARE1, .PEGS1, .MRCR1 Files

If your computer got infected with the Merry X-Mas ransomware virus, you should have a bit of experience in removing malware. You should get rid of this ransomware as quickly as possible before it can have the chance to spread further and infect other computers. You should remove the ransomware and follow the step-by-step instructions guide provided below.

Manually delete Merry X-Mas from your computer

Note! Substantial notification about the Merry X-Mas threat: Manual removal of Merry X-Mas requires interference with system files and registries. Thus, it can cause damage to your PC. Even if your computer skills are not at a professional level, don’t worry. You can do the removal yourself just in 5 minutes, using a malware removal tool.

1. Boot Your PC In Safe Mode to isolate and remove Merry X-Mas files and objects
2.Find malicious files created by Merry X-Mas on your PC

Automatically remove Merry X-Mas by downloading an advanced anti-malware program

1. Remove Merry X-Mas with SpyHunter Anti-Malware Tool and back up your data
2. Restore files encrypted by Merry X-Mas
Optional: Using Alternative Anti-Malware Tools

Berta Bilbao

Berta is the Editor-in-Chief of SensorsTechForum. She is a dedicated malware researcher, dreaming for a more secure cyber space.

More Posts - Website

Share on Facebook Share
Loading...
Share on Twitter Tweet
Loading...
Share on Google Plus Share
Loading...
Share on Linkedin Share
Loading...
Share on Digg Share
Share on Reddit Share
Loading...
Share on Stumbleupon Share
Loading...
Please wait...

Subscribe to our newsletter

Want to be notified when our article is published? Enter your email address and name below to be the first to know.