Detect and remove KeRanger Trojan

The KeRanger Trojan aims to encrypt files on other people's computers. Affected users receive threatening messages demanding money in order to get the data released again. If you find a KeRanger Trojan on your computer, you should remove it immediately.

Getting a grip on the KeRanger Trojan

KeRanger is a Trojan that exclusively attacks computers running the macOS operating system. It is hidden via BitTorrent files with the .dmg file extension. The user then receives a message threatening to encrypt files on the computer. To prevent this, the user is supposed to transfer money to a Bitcoin wallet within three days. KeRanger is the first Trojan to attack Mac users. Over 7,000 users have been affected so far. KeRanger should be removed as soon as possible to prevent your files from being encrypted. Use a suitable program for this purpose. You can already remove individual files yourself when detecting the Trojan, but antivirus programs are more thorough.

Detect KeRanger

1. Open the Finder and select "Go to" and then "Go to folder" in the menu.
2. Search the following file paths: "/Applications/Transmission.app/Contents/Resources/General.rtf" and "/Volumes /Transmission/Transmission.app/Contents/Resources/General.rtf".
3. Find one or both files, move them to the trash and empty it.

Suitable programs to remove KeRanger

1. Norton Internet Secruity: There is a free version that allows you to remove KeRanger.
2. ESET Internet Secruity: Eset can be tested for 30 days and then costs 60 euros for one year of use.
3. Avira Antivirus: After the free trial period of one month, Avira costs between 30 and 60 euros per month, depending on the length of the subscription and the number of devices.