Rannoh Trojan - How To Remove?
Rannoh is a malicious Trojan that has two main features: it is designed to lock its victims out of Windows and encrypts the majority of the files found on the target PC. If you have been infected with this ransom trojan, you should remember Gendarmerie Nationale (French) virus that locates its files almost in the same directories as Rannoh:
- %userprofile%\local settings\temp\<10 random letters>
You should also note that malicious .exe files are randomized as well – they use 20 random letters and numbers in their name, like iewfhonow94rg3gtr3g7.exe or other.
So, when trying to remove Rannoh, we recommend following the steps written below. In order to get into Windows again choose one of these 3 options:
1. Boot off your diagnostic CD/DVD, like Bootable CD Hiren;
2. Insert the hard drive to another PC with a bootable Windows OS;
3. Go into these suspected folders mentioned above and delete these two bad .exes out of their locations.
Either of these ways should help you to get into Windows. However, you will still find that all your files are encrypted. To fix this issue, use a tool released by Kaspersky RannohDecryptor. Launch it and it will help you to restore your files.
Automatic Rannoh trojan removal tools
Important Note: Although it is possible to manually remove Rannoh trojan, such activity can permanently damage your system if any mistakes are made in the process, as advanced spyware parasites are able to automatically repair themselves if not completely removed. Thus, manual spyware removal is recommended for experienced users only, such as IT specialists or highly qualified system administrators. For other users, we recommend using Reimage or other tools found on 2-viruses.com.