RanRans Ransomware Removal Guide

Do you know what RanRans Ransomware is?

A new Hidden-Tear based ransomware infection has been recently detected by our experienced specialists. It has been given the name RanRans Ransomware because it marks all files with .ranrans thus encrypting them after the successful entrance. It does that using the AES encryption algorithm, which is known to be one of the strongest ciphers, so that users could not unlock their files easily. The reason ransomware infections ruin users’ personal files is obvious – they need users’ money. Users are told that they could unlock files only if they purchase the special key from the author of the ransomware infection, so it is not surprising that some of them do as told, i.e. pay money and give cyber criminals what they want. Do not be one of those users who support cyber criminals behind RanRans Ransomware because the possibility is high that you will not get the decryption key and your files will stay locked. We would suggest removing RanRans Ransomware fully instead so that you could use your PC normally again. No, this infection does not ruin the system; however, it places a window over Desktop. The ransomware removal is the only way to remove this screen-locking window once and for all. We will talk about that in detail in the following paragraphs.

RanRans Ransomware enters computers to lock users’ files and extract money, as you already know, so it will start working the second it illegally enters your computer. Before the encryption, it connects to its C&C server https://ranrans.000webhostapp.com/write.php?info= and only then encrypts files located in %USERPROFILE% and %ALLUSERPROFILE% (+ its subfolders). When all files receive the extension .ranrans, a screen-locking window is opened on Desktop. First, users are told that their PCs have been encrypted. Second, they find out what they can do about that – pay 50 USD in Bitcoin to the provided Bitcoin address. Users are told that they could download the decryption tool from any of the three provided URLs after transferring money; however, we would not be so sure about that. Research has shown that none of the provided links work at the time of writing, so it might be no longer possible to get the decryption tool. We can assure you that you will not get your money back if you transfer money to cyber criminals and then realize that it is impossible to download the decryptor. Since the AES encryption algorithm used to lock users’ personal files is one of the strongest ciphers, it will not be easy to decrypt files without the key. Actually, we cannot even promise that you could get them back. What those users who are not going to pay money to cyber criminals can do is to restore files from a backup – it is their only chance to get files back.RanRans Ransomware Removal GuideRanRans Ransomware screenshot
Scroll down for full removal instructions

You will not find an official website RanRans Ransomware can be downloaded from because such a website does not exist. The majority of users who encounter this malicious application open attachments from spam emails they receive and thus allow this infection to enter their computers. Of course, they find out about this only when they discover a bunch of encrypted files on their PCs. Unlike previously-analyzed ransomware infections, RanRans Ransomware does not create a copy of itself, but, instead, it starts working immediately from the directory it has been launched. This is good news – it means that it should not be extremely hard to erase this malicious application.

If we have convinced you to delete RanRans Ransomware from your PC, you should first start the removal procedure by killing the malicious process in Task Manager. It is necessary to do that so that the annoying window opened by this threat would disappear from Desktop. Then, all other components of the ransomware infection have to be erased fully – our manual removal guide will help you with that.

Delete RanRans Ransomware

  1. Press Ctrl+Shift+Esc and click Processes.
  2. Find a malicious process on the list and right-click it.
  3. Click End Process/End Task.
  4. Close Task Manager.
  5. Delete the malicious file launched and all suspicious files from %USERPROFILE%\Desktop and %USERPROFILE%\Downloads.
  6. Empty the Trash bin.

In non-techie terms:

RanRans Ransomware is one of many crypto-threats cyber criminals actively distribute these days. These infections enter computers unnoticed and then encrypt users’ files seeking to obtain money from them. Do not give cyber criminals a cent even if you encounter a crypto-threat and discover your files locked because you have no guarantees that this will help you to get them back. Delete the malicious application fully instead and enable a security application on your computer so that a new ransomware infection could not enter the system ever again.