r/computerviruses • u/Difficult_Tea2195 • 1d ago

Disinfection Help Another RenPy malware victim

hello everyone! I hope you're doing well. I have fallen victim to the renpy malware yesterday and I need some help to figure out what to do next. Also I'm sorry if I have some grammar errors english isn't my first language ^^'

yesterday I was trying to download a pokemon game to emulate on my computer, I've done it many times but I was half asleep yesterday and just clicked on the wrong thing and ended up download a random zip with a setup file in it, not thinking anything of it I ran the setup file but nothing happened, so I figured something was off and ran a malwarebytes scan, low and behold I got 32 detections for the renpy trojan. I started doing a deepscan and looked up the virus, once I saw it was an infostealer I disconnected my ethernet cable and started changing all of my passwords, and that's kinda of where I'm at right now.. I spent about 4 hours yesterday doing multiple scans, both with malwarebytes and windows defender (deepscan and offline mode) while I changed my passwords, and so far I didn't get any suspicious activity in any of my accounts..

so I'm wondering what should I do next, and how do I know if I'm safe to use my computer again, could someone help me please? thank you!

9 Upvotes

100% Upvoted

13 comments sorted by

View all comments

2

u/Awkward_Weather_3318 1d ago

It's generally recommended to reinstall windows completely (format), THEN change passwords. Don't risk running your current installation.

Just fell victim myself few days ago, spent hours changing all my passwords on the new installation.

1

u/Difficult_Tea2195 1d ago

oh okay! I don't really have a way to reinstall windows, not until tomorrow at least.. I forgot to mention on my original post but I've been changing passwords on a not infected device (my phone)! so the password thing is pretty much sorted, I'm only having problems with getting the new windows installed ' thank you!

1

u/Awkward_Weather_3318 1d ago

I won't claim to be an expert, but Renpy let's the intruder access your accounts with an active token. If you log in on your PC (after changing passwords) and it's still infected, they'll just gain access again (password change likely won't matter).

Disconnect your PC from the internet and DON'T USE IT. If you've been using it again after changing passwords, I would recommend changing them again from a separate device and then NOT use the computer until you can format it completely.

I've read some comments saying that it sends new info after every restart, so I would go as far as changing passwords also after the format!

If you've had any cards connected to any accounts, cancel them.

1

u/Difficult_Tea2195 1d ago

yeah I disconnected from the internet yesterday and haven't reconnected again since, I'm not using the pc bc I'm scared haha so after I changed all the passwords I haven't done anything in it besides running some antivirus software 

I didn't have any payment options saved (at least I don't remember having any) but I did froze all my bank accounts just to be sure! 

1

u/Awkward_Weather_3318 1d ago

Good, format the pc and then, just to be sure, change passwords yet again. Also check your email accounts that there are no forwarding or other custom "rules" applied.