.MERS Files Virus (Dharma Ransomware) - Remove It

.MERS Files Virus (Dharma Ransomware) – Remove It

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)


What is .MERS files virus? How did it infect your system? Is there a chance to restore your .MERS files?

The .MERS files virus is a newly discovered data locker ransomware that belongs to Dharma threat family. It invades computer systems, disrupts their security and encodes personal files. At the end of the attack, it drops a ransom message and loads it on the screen to extort a ransom fee for files recovery. For the sake of your security, we recommend you to avoid any negotiations with criminals. Кeep up with our guide and find the solution to your problem.

Threat Summary

Name.MERS Files Virus
TypeRansomware, Cryptovirus
Short DescriptionSevere malware that is designed to encrypt valualbe files stored on compromised computers so that it can then extort ransom fee from victims.
SymptomsFiles are encrypted and renamed with a long sequence of extensions that ends with .MERS file extension. Ransom message extorts a payment for files recovery.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by .MERS Files Virus


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss .MERS Files Virus.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

.MERS Files Virus (Dharma Ransomware) – How Did I Get It and What Does It Do?

Infection with .MERS files virus is triggered by a payload file. This file is usually spread via spam email campaigns. These campaigns could be recognized by several common traits such as file attachment, URL address, and spoofed email sender.

When started on the system, the payload file of .MERS files virus launches a series of malicious operations that enable it to corrupt valuable system settings and reach the data encryption stage.

For the completion of the whole attack, the ransomware establishes a bunch of additional malicious files on the system. It may store these files in some of the following system folders:

  • %Roaming%
  • %Windows%
  • %AppData%
  • %Local%
  • %Temp%

For the encryption stage, .MERS crypto virus activates a built-in cipher module that is designed to scan all drives for target files and encrypt their code with the help of sophisticated encryption algorithm. Unfortunately, this process corrupts your valuable files and limits your access to their data. Here is a list of all files that may be encrypted:

  • Audio files
  • Video files
  • Document files
  • Image files
  • Backup files
  • Banking credentials, etc

And once the ransomware transforms the original code of a target file, it appends a long sequence of three extensions that follows the pattern:

  • trip.JPG.id-607AECEC.[email].MERS

As reported by users whose devices have been infected by recent variants of Dharma ransomware, unlike some of the predecessors, these versions are designed to skip dropping a ransom message file on the system. The only option for contacting hackers is actually the email address that is appended to all corrupted files. During our research, we found out that the required ransom fee moves around $1000 which converted in Bitcoin is nearly 0.17 BTC.

We know that you need to restore .MERS files but be advised to refrain from transferring your money to cybercriminals. For the sake of your security, we recommend you to clean your computer from present malicious files and consider the help of alternative data recovery methods.

Remove .MERS Files Virus (Dharma Ransomware) and Restore Data

The so-called .MERS files virus is a threat with highly complex code that heavily damages both essential system settings and valuable data. So the only way to use your infected system securely again is to remove all malicious files and objects created by the ransomware. For the purpose, you could follow our step-by-step removal guide.

In the event that you want to attempt to restore .MERS files with the help of alternative data recovery methods, do check step four – Try to Restore files encrypted by .MERS Files Virus. We remind you to back up all encrypted files to an external drive before the recovery process.

Gergana Ivanova

Gergana Ivanova

Gergana has completed a bachelor degree in Marketing from the University of National and World Economy. She has been with the STF team for three years, researching malware and reporting on the latest infections.

More Posts

Follow Me:
Google Plus

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share