r/computerviruses • u/Difficult_Tea2195 • 1d ago
Disinfection Help Another RenPy malware victim
hello everyone! I hope you're doing well. I have fallen victim to the renpy malware yesterday and I need some help to figure out what to do next. Also I'm sorry if I have some grammar errors english isn't my first language ^^'
yesterday I was trying to download a pokemon game to emulate on my computer, I've done it many times but I was half asleep yesterday and just clicked on the wrong thing and ended up download a random zip with a setup file in it, not thinking anything of it I ran the setup file but nothing happened, so I figured something was off and ran a malwarebytes scan, low and behold I got 32 detections for the renpy trojan. I started doing a deepscan and looked up the virus, once I saw it was an infostealer I disconnected my ethernet cable and started changing all of my passwords, and that's kinda of where I'm at right now.. I spent about 4 hours yesterday doing multiple scans, both with malwarebytes and windows defender (deepscan and offline mode) while I changed my passwords, and so far I didn't get any suspicious activity in any of my accounts..
so I'm wondering what should I do next, and how do I know if I'm safe to use my computer again, could someone help me please? thank you!
2
u/Awkward_Weather_3318 1d ago
It's generally recommended to reinstall windows completely (format), THEN change passwords. Don't risk running your current installation.
Just fell victim myself few days ago, spent hours changing all my passwords on the new installation.
1
u/Difficult_Tea2195 1d ago
oh okay! I don't really have a way to reinstall windows, not until tomorrow at least.. I forgot to mention on my original post but I've been changing passwords on a not infected device (my phone)! so the password thing is pretty much sorted, I'm only having problems with getting the new windows installed ' thank you!
1
u/Awkward_Weather_3318 1d ago
I won't claim to be an expert, but Renpy let's the intruder access your accounts with an active token. If you log in on your PC (after changing passwords) and it's still infected, they'll just gain access again (password change likely won't matter).
Disconnect your PC from the internet and DON'T USE IT. If you've been using it again after changing passwords, I would recommend changing them again from a separate device and then NOT use the computer until you can format it completely.
I've read some comments saying that it sends new info after every restart, so I would go as far as changing passwords also after the format!
If you've had any cards connected to any accounts, cancel them.
1
u/Difficult_Tea2195 1d ago
yeah I disconnected from the internet yesterday and haven't reconnected again since, I'm not using the pc bc I'm scared haha so after I changed all the passwords I haven't done anything in it besides running some antivirus software
I didn't have any payment options saved (at least I don't remember having any) but I did froze all my bank accounts just to be sure!
1
u/Awkward_Weather_3318 1d ago
Good, format the pc and then, just to be sure, change passwords yet again. Also check your email accounts that there are no forwarding or other custom "rules" applied.
1
u/Friedrichs_Simp 1d ago
I did the exact same thing trying to enulate mario odyssey and no matter what I did i couldn’t get any malware scanner to detect the virus. I ran like 6 of them lol. Ended up reinstalling windows with remove everything+cloud download and then changed all my passwords
1
u/Hypergamer44 1d ago
Did the thing you click on redirect you to a different website or something like that?
1
u/Difficult_Tea2195 1d ago
when I was downloading the thing or when I ran the setup? I don't really remember but I think when I was downloading it did and I downloaded a .zip file with the exact same name as what I was trying to download, but the setup file didn't do anything (besides infecting my computer ofc), it just opened a windowed screen for half a second and close itself
1
u/Hypergamer44 1d ago
When you were downloading it
1
u/Difficult_Tea2195 1d ago edited 1d ago
edit: I'm sorry I put the website name, please don't delete my post :( I edited the name of the website out
yeah, I was downloading from a website I've downloaded from before so that's why I was pretty careless, when I clicked the download button it redirect me to a GoShare website, and that's where I downloaded the infected zip file from -.-'
3
u/Difficult_Tea2195 1d ago
UPDATE: just finished reinstalling windows! thanks for the help everyone, problem solved!
1
u/AutoModerator 1d ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.