Rannoh Trojan - How To Remove?


Rannoh is a malicious Trojan that has two main features: it is designed to lock its victims out of Windows and encrypts the majority of the files found on the target PC. If you have been infected with this ransom trojan, you should remember Gendarmerie Nationale (French) virus that locates its files almost in the same directories as Rannoh:

  • %userprofile%\local settings\temp\<10 random letters>
  • %windir%\system32

You should also note that malicious .exe files are randomized as well – they use 20 random letters and numbers in their name, like iewfhonow94rg3gtr3g7.exe or other.

So, when trying to remove Rannoh, we recommend following the steps written below. In order to get into Windows again choose one of these 3 options:

1. Boot off your diagnostic CD/DVD, like Bootable CD Hiren;
2. Insert the hard drive to another PC with a bootable Windows OS;
3. Go into these suspected folders mentioned above and delete these two bad .exes out of their locations.

Either of these ways should help you to get into Windows. However, you will still find that all your files are encrypted. To fix this issue, use a tool released by Kaspersky RannohDecryptor. Launch it and it will help you to restore your files.

Automatic Rannoh trojan removal tools

Note: Reimage trial provides detection of parasites and assists in their removal for free. You can remove detected files, processes and registry entries yourself or purchase a full version.  We might be affiliated with some of these programs. Full information is available in disclosure

Manual removal


Important Note: Although it is possible to manually remove Rannoh trojan, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on 2-viruses.com.


About the author

 - Main Editor
I have started 2-viruses.com in 2007 after wanting to be more or less independent from single security program maker. Since then, we kept working on this site to make internet better and safer place to use.
May 7, 2012 13:53, June 3, 2013 14:05

Leave a Reply

Your email address will not be published. Required fields are marked *