Lanran Ransomware

Lanran Ransomware is nothing else than new malware encrypting personal files. Judging from the email address indicated in files it drops, it has been developed by malicious software developers living in Russia. Researchers at pcthreat.com do not consider it extremely sophisticated malware, but there is no doubt that it will cause you serious problems if it ever enters your system – a bunch of your files will be encrypted. That is, you could no longer access any of them. Luckily, the ransomware infection does not lock any files that belong to the Windows OS. Instead, it encrypts .dll, .jar, .jpg, .tar, .bmp, .pbm, .png, .csv, .sql, .RAR, .png, .BAT, .exe, 7z, and many other files located in the following directories: %USERPROFILE%\Documents, %USERPROFILE%\Pictures, %USERPROFILE%\Desktop, %USERPROFILE%\Music, %USERPROFILE%\Favorites, %APPDATA%, and %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup. In other words, the successful entrance of Lanran Ransomware on your computer will definitely not go unnoticed. If you have encountered this infection, make sure you delete it from the system right away. Sadly, not a single file will be unlocked on your computer even if you remove ransomware.

No doubt Lanran Ransomware is the one that has locked your files if you can locate @___README___@.txt on your Desktop, INSTRUCTIONS.html in several other directories, and your Wallpaper has been changed without your permission. The ransomware infection has been designed to obtain money from users, so do not get surprised when you are told that sending 0.5 Bitcoin (~ 3000 USD at today’s price) to 1sUCn6JYa7B96t4nZz1tX5muU2W5YxCmS is the only possible way to decrypt files. You have no guarantees that you could unlock your files even if you do as instructed, i.e. transfer a ransom to cyber criminals and then send an email to them, so it would be best that you find another way to restore your files, for example, you can restore them all from a backup you have. Of course, it will not be possible to do this if you have not backed up a single file in your life. Actually, we think that it is better to lose some unimportant files rather than pay money to malicious software developers. Our specialists could not find a free decryptor at the time of analysis, but it does not mean that it cannot become available in the near future, so do not rush to delete those files that have been locked by ransomware (unless they are not valuable at all).

Ransomware infections enter computers secretly, but, in most cases, users help malicious software to enter their computers themselves. For example, it is very likely that you have ended up with Lanran Ransomware because you have opened a malicious email attachment. Malware spreading via spam emails is already a classic, but it does not mean that other methods of distribution cannot be adopted to spread ransomware infections and other malicious applications. According to researchers, malicious applications might also pretend to be reliable software to convince users to download it, so if you have downloaded and installed new software from the web before discovering your files completely encrypted, it is very likely that you have downloaded Lanran Ransomware and installed yourself. We are sure you do not know anything about this. We know better than others how hard it can be to prevent serious malicious software from entering the system, so we recommend installing security software in order not to encounter new infections in the future. It cannot be a random antimalware scanner you have found listed at the top of the search results page of your default search provider too. You should read users’ reviews on the web and try to find more information about the tool you are going to install before clicking the Download button.

Lanran Ransomware does not create new registry keys on affected computers. Additionally, it does not block system utilities, so if you follow our removal guide, you should remove Lanran Ransomware without difficulty. Unfortunately, your files will stay encrypted. As mentioned, you could restore them from your backup – this does not cost anything. Once you have erased Lanran Ransomware fully, you should perform a system scan with an antimalware scanner too. You might have other malicious applications active on your computer. If it turns out to be true, let the antimalware tool delete it for you or erase detected threats yourself manually.

How to remove Lanran Ransomware

1. Open Windows Explorer (tap Win+E).
2. Open %APPDATA%.
3. Delete img.jpg.
4. Go to %LOCALAPPDATA% (or %UserProfile%\Local Settings\Application Data) and delete TempLanRan.exe.
5. Remove Temprunsom.exe from the same directory.
6. Remove @___README___@.txt from your Desktop.
7. Delete INSTRUCTIONS.html from affected directories.
8. Empty Recycle Bin.