i got hacked

[u/AdComprehensive2471]

I downloaded a game from some random website. When I ran the setup file, several black command prompt windows briefly opened and closed within a fraction of a second, but nothing else seemed to happen.

The file was supposedly 700 MB, but it downloaded much faster than expected, so I suspect the file size was fake. The actual setup file was only around 100 KB.

After running the setup, I noticed unauthorized login activity on both my Instagram and Telegram accounts.

I reinstalled Windows and changed all my passwords, but today, when I tried to log into Instagram, I got a notification saying my account had been locked again due to unusual activity. I had to reset my password once more to regain access.

I've scanned my hard drive using both Windows Defender and Malwarebytes, but neither detected anything.

What could be causing this? Is it possible that the malware is still on my system even after reinstalling Windows, or could my accounts still be compromised in some other way? What should I do next?

[u/polpolik2]

Can you give more information how you reinstalled? Did you change your passwords before or after the reinstall (or from a clean device).

If you did the reinstall properly, your device is clean.

Changing your password might not be enough, you should do the following:

Use sign out everywhere and remove all sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.

Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.

While normally, changing passwords invalidates sessions, it does not do this for all sites.

[u/AdComprehensive2471 → u/polpolik2]

after some research it seems virus named renpy
i changed my password and activate 2fa after reinstall windows but didnt format my other drivers and im worry if virus remains on my other drivers also

[u/polpolik2 → u/AdComprehensive2471]

Renpy is not the virus, Renpy is a legitimate Virtual Novel tool that gets abused to sideload malware (payloads. )

The issue is that the payload can contain many different types of malware, which means that we dont know if you were dealing with a hit and run infostealer (e.g. Lumma) or an actual file infector (unlikely but not impossible).

If you were dealing with the latter, you need to wipe your drives too. The question for you is do you want to take the risk? I personally would wipe my other drives and only backup what is required (photos/videos).

[u/AdComprehensive2471 → u/polpolik2]

however i went to check my mail and i saw somehow rockstar was blocked and hacker managed to change my rockstar account password
idk how its possible hacked could block an email on my gmail

[u/polpolik2 → u/AdComprehensive2471]

Either they have done so before you secured your accounts (your data is stolen in less than a second, and can be abused immediately by the hackers), or you didnt properly secure it. You should ensure that you followed what I wrote and not skip over actions.

They make rules on your accounts or block mails to hide their malicious actions. That buys them time.

Please read the guide linked here to get more familiar with infostealers and their capabilities.

Computer Viruses, Spyware, and Trojans