| Name | Rane.exe |
| Type | Trojan horse |
| Short Description | Once dropped onto the system, the Trojan will modify registry elements and attempt to accomplish a network connection. |
| Symptoms | Unpermitted system alterations. |
| Distribution Method | Via spam emails, corrupted links, drive-by downloads, etc. |
| Detection tool | Download SpyHunter, to See If Your System Has Been Affected By Rane.exe |
In some cases, malware is reported to take over certain .exe files to spread onto computers. In other instances, .exe files sneak into the system and turn out to be Trojan horses or other types of malicious software. If you have noticed rane.exe running in the background, you should be aware that your PC may have been exposed to malware. Rane.exe has been identified by several anti-virus programs under various names.
McAfee has detected it as Generic Dropper.agu, Symantec – as WS.Reputation.1, and Kaspersky – Trojan-Dropper.Win32.Agent.jmft. The detection rate for rane.exe is quite high, even though some programs haven’t succeeded in detecting it (e.g. Avira). According to the detection results, rane.exe belongs to a Trojan horse and should be removed entirely.
Rane.exe Distribution Path and Threat Description
Trojan horses can sneak into the system via spam emails, corrupted links, and websites (drive-by downloads), or downloading infected files. Some Trojans act as backdoors, connecting to a remote host to execute a number of malicious operations. Once the Trojan is inside the system, it may change files and registry keys.
According to McAfee’s report, Generic Dropper.agu:
- Tries to write to a memory location of a previously loaded process.
- Takes account of various system files and directories.
- Adds or modifies Internet Explorer cookies.
- Tries to write to a memory location of a process of unknown origin.
Here is a list of the files that have been added to the affected system:
- %TEMP%\Trojan.exe
- %TEMP%\Trojan.exe.tmp
- %USERPROFILE%\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe
The Trojan also creates new system elements:
→HKEY_CURRENT_USER\SOFTWARE\5CD8F17F4086744065EB0992A09E05A2\
and changes others:
→HKEY_CURRENT_USER\ENVIRONMENT\SEE_MASK_NOZONECHECKS = 49
→HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\5CD8F17F4086744065EB0992A09E05A2 = “%TEMP%\Trojan.exe”
→HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\5CD8F17F4086744065EB0992A09E05A2 = “%TEMP%\Trojan.exe”
Generic Dropper.agu is also reported to attempt connecting to the following network connection:
→92.241.32.**:1177
If the connection is successful, other malware pieces may be dropped onto the system.
Rane.exe Removal Options
You can refer to the step-by-step tutorial given below the article to remove the Trojan. First you need to run your PC in Safe Mode. After following the instructions, scanning the system via professional anti-malware software is still highly advisory. To stay guarded against malware, remember to update frequently your anti-virus program.
Spy Hunter scanner will only detect the threat. If you want the threat to be automatically removed, you need to purchase the full version of the anti-malware tool.Find Out More About SpyHunter Anti-Malware Tool / How to Uninstall SpyHunter
