Trojan Rannoh is a very dangerous malware which locks the user from using the windows, and then, encrypts the files on the user’s computer. Such Trojans usually spread through other malicious programs. All these malicious tools are very dangerous to your computer system; they could slow down your computer speed and harm it in numerous ways. Trojan Rannoh can remove your important data files, which will be a great loss, if those files are important to you in any way. The malware can also disable your installed antivirus program by changing the registry key values. The presence of Trojan Rannoh is very harmful to your computer resources, as it also opens the computer for many other hazardous and malicious programs.

Trojan Rannoh works in the background and it is very difficult to remove it. The malicious tool steals your important personal and financial information like username and password, credit card number and email address. This information can be used illegally without you being aware of it. You should remove Trojan Rannoh the instant you suspect its presence in your computer system. However, removing the malware is a very difficult task and you must know the windows system in-depth to do it manually. There are many software available that could do the removal automatically but we recommend you to do it manually.

To remove the Trojan Rannoh, you need to know the complete detail of the processes and registry it uses. If you do not know the procedure correctly, you might end up removing the important files that are necessary to run the computer. Follow the below mentioned steps and you will get to know the required process to remove the Trojan Rannoh effectively.

Remove Trojan Rannoh Processes

  1. Press the key with windows label on it with the key ‘R’ from the keyboard to quickly open the program ‘Run’.
  2. Type taskmgr and press Ok.
  3. You can also open the windows task manager directly; for that you need to press the short keys CTRL+ALT+DEL.
  4. Click on the Processes tab in the windows task manager.
  5. From the list of active processes, find out the required process ‘Protector-[Random].exe’, then right click on the required process and select End process to remove the process.

Remove Trojan Rannoh Registry entry values

  1. Open the run program using the above steps and type ‘regedit’ and click Ok.
  2. To find a registry key you must select the left pane of the registry editor click on Edit and then select the option Find.
  3. In the search bar enter the Trojan Rannoh registry key values and press enter.
  4. Now right click on the found registry value and select Modify and then click on the option Delete.

The registry keys you need to remove immediately are:


HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “13376694984709702142491016734454?

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “.exe”

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run “”

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “CertificateRevocation” = ’0′

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings “WarnonBadCertRecving” = ’0′

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop “NoChangingWallPaper” = ’1′

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations “LowRiskFileTypes” = ‘/{hq:/s`s:/ogn:/uyu:/dyd:/c`u:/bnl:/ble:/sdf:/lrh:/iul:/iulm:/fhg:/clq:/kqf:/`wh:/lqf:/lqdf:/lnw:/lq2:/l2t:/v`w:/rbs:’

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments “SaveZoneInformation” = ’1′

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System “DisableTaskMgr” = ’1′

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system “DisableTaskMgr” = ’1′

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Download “CheckExeSignatures” = ‘no’

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main “Use FormSuggest” = ‘yes’

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “Hidden” = ’0′

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced “ShowSuperHidden” = 0′

Remove Trojan Rannoh other files

  1. Open Run and write ‘cmd’ and click Ok.
  2. Type the file name with the complete path and press enter.
  3. When you have found the file; type ‘regsvr32 /u FileName.exe’ and press Enter.
  4. The files are:

%Program Files%\Trojan Rannoh\Trojan Rannoh.exe

%UserProfile%\Desktop\Trojan Rannoh.lnk

%UserProfile%\Start Menu\Trojan Rannoh\Trojan Rannoh.lnk

%UserProfile%\Start Menu\Trojan Rannoh\Help.lnk

%UserProfile%\Start Menu\Trojan Rannoh\Registration.lnk

%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\Trojan Rannoh.lnk


How to remove Trojan Rannoh?
Tagged on:         

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>