Remove MERRY_I_LOVE_YOU_BRUCE.HTA Virus

How to Remove MERRY_I_LOVE_YOU_BRUCE.HTA Ransomware?

There’s a new infection, plaguing users. It goes by “MERRY_I_LOVE_YOU_BRUCE.HTA virus.” And, it’s a menace. One of the worst cyber infections, roaming the web, is the ransomware. And, MERRY_I_LOVE_YOU_BRUCE.HTA is one. If you’ve ever faced such a tool, you know it has earned that reputation. If you’re lucky enough not to have encountered one, we’ll clue you into what its presence entails. These programs turn to trickery to enter your system. With deceit and finesse, they manage to sneak in undetected. But they don’t stay under the radar for long. You learn of their existence a while after their infiltration, when their programming kicks in. One day, you turn on your PC, and there’s a huge red flag that greets you. In place of your usual Desktop picture, you find a different one. A new image with the words that you’re victim to a ransomware, and your data is encrypted. To decrypt it, you have to pay a ransom. Hence, the name of these types of tools. They are designed by extortionists, who seek to make money off of your naivety. Don’t fall for their deception! Don’t buy into their lies! Do NOT trust them! These are cyber criminals, who invaded your PC. They locked every file you had. Then, demanded you give them money or they won’t unlock it. They back you into a corner, and do their best to force you into compliance. But, here’s the thing about ransomware. There is no winning scenario for you. Whichever route you take, you lose. It’s a matter of picking the lesser evil. Here’s what experts advise. Do NOT contact the cyber kidnappers. Do NOT pay them a dime. If you trust extortionists, you WILL regret it. The best thing you can do in a ransomware scenario is cut your losses. Say goodbye to your encrypted data. The alternatives are much worse than losing your files.

How did I get infected with?

If you end up with a ransomware tool, you’re more to blame than you think. It sounds a bit confusing, but it’s rather simple. These infections don’t just show up on your PC one day. Like, most cyber threats, they require your consent. They have to seek and receive your permission to enter. But don’t think it’s straightforward exchange. It’s anything but. After all, if the infection came out in the open, and asked approval, you’d deny it. And, it cannot have you refusing it access. So, it turns to trickery and finesse. It employs the old but gold methods of invasion. And, it dupes you. Yes, the ransomware dupes you into allowing it into your system, and not even realizing it. Why? Well, odds are, you were careless when you should have been extra cautious. Say, for example, you receive an email from an unknown sender. Despite your better judgment, you open it. You see it has an attached file. And, then you do the unthinkable. You download it. That’s how you get stuck with infections like ransomware. You took all the wrong steps by giving into naivety. Apart from spam email attachments, the cyber threat has a plethora of invasive methods. Like, freeware, corrupted links, bogus updates, et cetera. Don’t give into gullibility. Be extra thorough when installing tools or updates. And, remember. Vigilance goes a long way while carelessness is a one-way street to infections.

Why is MERRY_I_LOVE_YOU_BRUCE.HTA dangerous?

After the ransomware behind MERRY_I_LOVE_YOU_BRUCE.HTA invades your system, it goes to work. The tool locks every file you keep on your PC. It encrypts it, using a special algorithm. To solidify its grip over your data, it appends a special extension. At the end of each file, you’ll see the MERRY_I_LOVE_YOU_BRUCE extension. The strange proclamation of love makes it so you can no longer access your data. You can’t open any of them, and moving or renaming them doesn’t help. The only way to regain control over them is compliance. At least, that’s what the ransomware says in its ransom note. It states that if you pay, you’ll get a decryption key, apply it, and voila! Your files are free. But that scenario is more than unlikely. There are so many ways you can get duped. What if you pay, but don’t receive a key? Or, get a fake one? And, even if you get the right one, it’s still bad. After all, it doesn’t remove the infection. Only the encryption. The ransomware remains, ready to strike again. But it’s not about the key. Key or no key, it doesn’t matter because it’s not your biggest concern. If you pay the ransom, you bury yourself deeper in trouble. By transferring the money, you give private information to these people. You let them into your private life. Extortionists have access to your personal and financial data. In what world is that a good thing? Don’t let that scenario unfold. Don’t comply. Forsake your files You can replace them. Can you say the same for your privacy?

MERRY_I_LOVE_YOU_BRUCE.HTA Removal Instructions

STEP 1: Kill the Malicious Process

STEP 2: Reveal Hidden Files

STEP 3: Locate Startup Location

STEP 4: Recover MERRY_I_LOVE_YOU_BRUCE.HTA Encrypted Files

STEP 1: Stop the malicious process using Windows Task Manager

• Open your task Manager by pressing CTRL+SHIFT+ESC keys simultaneously
• Locate the process of the ransomware. Have in mind that this is usually a random generated file.
• Before you kill the process, type the name on a text document for later reference.

• Locate any suspicious processes associated with MERRY_I_LOVE_YOU_BRUCE.HTA encryption Virus.
• Right click on the process
• Open File Location
• End Process
• Delete the directories with the suspicious files.
• Have in mind that the process can be hiding and very difficult to detect

STEP 2: Reveal Hidden Files

• Open any folder
• Click on “Organize” button
  
• Choose “Folder and Search Options”
• Select the “View” tab
• Select “Show hidden files and folders” option
• Uncheck “Hide protected operating system files”
• Click “Apply” and “OK” button

STEP 3: Locate MERRY_I_LOVE_YOU_BRUCE.HTA encryption Virus startup location

• Once the operating system loads press simultaneously the Windows Logo Button and the R key.

• A dialog box should open. Type “Regedit”
• WARNING! be very careful when editing the Microsoft Windows Registry as this may render the system broken.

Depending on your OS (x86 or x64) navigate to:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] or
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

• and delete the display Name: [RANDOM]

• Then open your explorer and navigate to:

Navigate to your %appdata% folder and delete the executable.

You can alternatively use your msconfig windows program to double check the execution point of the virus. Please, have in mind that the names in your machine might be different as they might be generated randomly, that’s why you should run any professional scanner to identify malicious files.

STEP 4: How to recover encrypted files?

• Method 1: The first and best method is to restore your data from a recent backup, in case that you have one.

• Method 2: File Recovery Software – Usually when the ransomware encrypts a file it first makes a copy of it, encrypts the copy, and then deletes the original. Due to this you may try to use file recovery software to recover some of your original files.
• Method 3: Shadow Volume Copies – As a last resort, you can try to restore your files via Shadow Volume Copies. Open the Shadow Explorer part of the package and choose the Drive you want to recover. Right click on any file you want to restore and click Export on it.