r/computerviruses • u/Sctroom • 1d ago
Disinfection Help Downloaded the setup dot exe that renpy malware or whatever it is
I was downloading something and i accidently downloaded this and ran it i got to know its a malware so maybe 15-20 seconds in i disconnected my internet and changed my google passwords removed/logged out my pc from the devices lists did the same with reddit spotify apple music discord steam twitter every app i could think of i didn't have my banking details on this but i dont know what to do next im really confused i need to remove this off my pc asap i have a deadline tommorow can someone please help ps - I have 2 nvme I have my windows installed on the nvme 1 and i have some important stuff on the nvme 2 they are separated as two different drives do i also need to wipe out my second nvme with my windows one
7
u/polpolik2 Moderator 1d ago
You likely downloaded malware and got hit by an infostealer.
Read this: Rifteyy_'s guide to infostealers to get a better understanding.
Reinstalling Windows to remove the malware.
The fastest and guaranteed way to get rid of the malware is to reinstall Windows, preferably from a USB created on a clean device. If that option is not available to you, you can also do a cloud reinstall while deleting all data.
If you’re only dealing with an infostealer, wiping your C drive is sufficient. However it’s better to do a full wipe and only back up your trusted Data files, as there could be more malware on your device that you’re not aware of.
FRST Assistance
If you do not want to reinstall windows you can wait here for one of the trusted helpers to assist you with FRST. Please read Receiving FRST assistance. Please follow these instructions carefully and provide the keywords. Doing so can get you help considerably faster!
What you can do immediately either during the reinstall, or if you're waiting for help:
- Disconnect your infected PC from the internet.
- Change ALL passwords from a clean device. Start with your emails and bank. Use sign out everywhere and remove all sessions. While you are doing this, check your security settings to ensure the attacker hasn't added their own 2FA methods or backup codes.
- Check your linked accounts/services/2fa options for your most important accounts. Also check forwarding rules on your mail. Additionally, for your browser, check your sync settings and extensions and remove anything you dont recognize or trust.
The faster you move with these steps the more you can prevent your accounts being stolen! Make sure your clean device does not sync passwords through browser for example to your infected device.
1
u/Leading-Elephant8243 15h ago
Does a factory reset of the PC help? By using the option that appears in the system and selecting to delete all data?
7
u/Takumi_Gaijin_San 1d ago
Why don’t we read what’s downloaded to our PC? Why don’t we check the name and size of the files in the folder? Just check and don’t run the file until you’re sure the files are original.
2
u/mystiquelaw 1d ago
i also accidentally downloaded this, then the next day i have been sending mrbeast scam on my discord without me knowing. I already reinstall my windows with cloud. Also changed all of my soc meds passwords and mfa. Do you guys think i am safe now?
2
u/Arrowguy232 1d ago
I did that and I was on the clear, but you should change ALL passwords you consider important. Set 2FA and if you had any cards stored call to the bank and explain it to them.
2
u/MegStuff 1d ago
Change your passwords from a different device and reinstall windows through a USB.
2
u/Sctroom 1d ago
You think i should plug my usb in considering my pc is infected?
1
u/MegStuff 1d ago
Wiping your computer is needed.
2
u/Sctroom 1d ago
Yes but what I am asking is if I connect my pendrive to the PC and copy some of the importance stuff I have will like their be chances that my pen drive can also get infected
2
u/Arrowguy232 1d ago
From my understanding Renpy malware does not do it, but for good measure you should use a clean PC for windows.
1
u/PleaseAdminsUnbanMe 1d ago
Yep pretty high
1
1d ago
[removed] — view removed comment
2
u/computerviruses-ModTeam 1d ago
Your post was removed because it is a personal attack on someone else or a group of users. Please be civilized. Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules
1
u/AutoModerator 1d ago
Request help with FRST and SecurityCheck from the trusted helper team
Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.
If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:
- From a different and clean device, change all your passwords:
- Disinfect your device from malware
- Preferred method: Perform a clean installation with a USB
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
1
u/Necessary_Koala9855 1d ago
You're lucky you caught it that fast, better safe than sorry by reinstalling Windows from a clean USB tonight, and definitely rotate those passwords from your phone right now.
1
u/Davisene 1d ago
can this malware affect you even if you dont execute it? genuine question, i havent been in this subreddit for a while
2
u/Glvssy_ 1d ago
Yes, malware can infect a system even without being executed by a user. Malicious software can take advantage of “zero-click” vulnerabilities in software, such as browsers, and infect a device simply by the user visiting a malicious web page or receiving a message from an attacker. Second, features within operating systems that automatically view or index the contents of files or perform searching and antivirus background scans can also be used to secretly execute exploit code as soon as a file is received or opened by the user.
(speaking out of my ass btw)
1
1
u/BluejayDisastrous889 22h ago
Wipe your computer, because the moment you ran that exe, it already executed the commands to steal your session informations.
Wipe your pc from clean, dont just use save point good thing you disabled wifi, though you still need to *change all your passwords, especially forthe most important like bank, personal accounts, work related accounts etc.\*
1
1
u/dogos_world 13h ago
if I use mainly google account to log in everywhere without a password, and my google has 2 step authentication plus the password was wrongly saved, how much of risk I am in, because nothing has happened in past 4 days and I've already gave my pc for full wipe
1
u/dogos_world 13h ago
Plus there was also a discord incident, It didn't log in anywhere new, so I had a suspicion it ran a script from my to send automated msgs
1
u/Leading-Elephant8243 15h ago
I was trying to install Stellaris, unfortunately this thing got installed instead. I wanted to delete it but accidentally ran it... I factory reset my PC
1
u/throwawayCheeseRat09 1d ago
RenPy should be sued at this point.
After removing it with malwarebytes, search in C:ProgramData for a folder that looks like com_int-42 or something similar to that. Inside of it it will have a bunch of manifest files (distribution packages for linux) and a file named DecoDigi32. Get rid of all of them, Especially DecoDigi32. You likely won't be able to remove it with malwarebytes or by deleting it but force shredding it through malwarebytes or JV16powertools will work as they reboot into dos and do it there.
It will come back if you don't do this or reinstall your operating system.
1
1
u/Sctroom 1d ago
What i did as of now in a state of panic when this happened i completely shut down my internet and reseted all my passwords from my phone revoked access logged out other devices on as many websites as i possibly could off my phone then i performed a full reset then made my pendrive bootable and installed clean windows off of it you think im still vulnerable or those files might still be there
1
u/Leading-Elephant8243 15h ago
I need help with this. I factory reset the entire system with the Windows I already have installed, and I chose the option to erase all data. I'm not sure if I still have the virus.
When the PC was factory reset, Windows security was corrupted, so I clicked repair and then check for updates
Another thing I should mention is that I inserted a USB drive into the infected PC to retrieve some family photos and an AutoCAD DWG file, then I had the antivirus software scan the USB drive when The PC was formatted from scratch and they didn't detect anything
-1
1d ago edited 1d ago
[deleted]
2
1
u/Arrowguy232 1d ago
It is malware. Games will have the name on documents and stuff. This is malware for two reasons: almost no games have setups, 99 out of 100 times it’s decompress and play and the layout itself of the file (Ex. The log probably talking of missing shaders and renpy being “Setup.Exe” instead of “X game.Exe” shows it’s a generic version of the malware.
0
0
u/Antique_Door_Knob 1d ago
This is a know malware delivery mechanism my guy, the hell you talking about?
1
1d ago
[deleted]
1
u/Antique_Door_Knob 1d ago
Renpy is the delivery mechanism, renpy loader is just the name we give to malware using renpy as it's delivery mechanism.
Renpy games don't even require installation...
0
u/lmiked84 1d ago
First, delete the file, if you haven't already.
Then run windows defender, do a system wide search to see if detects anything, it is as good as most antivirus.
If it does detected and quarantine/delete it, you should be ok to go, and at least back up what you need a little more at ease, then, if you want to be sure, formating/wiping all drives and reinstalling would probably be the safest bet.
1
u/Wraith_Real 23h ago
He needs to reinstall windows dude
1
u/lmiked84 23h ago
Yeah, but if he wants to backup anything, he should 1st do a virus check, because many viruses and malware, self replicate and copy themselves into any inserted drives.
-1
u/Slow-Gazelle8346 1d ago
Ready itself isn't malaware, common engine for nsfw those playable comics but if it did infect u the code was edited for it
1
1
u/throwawayCheeseRat09 1d ago
RenPy has an exploit that they REFUSE to patch that lets them inject python code which you can do a lot with. RenPy should be treated as a virus at this point.
1
-5
1d ago
[removed] — view removed comment
5
u/Mean-Elk-9439 1d ago
I understand you're trying to help but you shouldn't regurgitate AI when you don't understand this subject and especially shouldn't when you're using an ai this bad at it.
Renpy based info stealers are currently the most common "fake game" style info stealer. Usually either via malicious download buttons injected into sites like datanodes etc or via the discord dm scheme where someone dms asking you to "try out their game for free". It's not only not odd that there's a python script there but this is literally the single most common and straightforward infostealer out there right now.
Also admin is not needed for these to function. Typically they drain every credential available, including crypto, then install a miner as a bonus "make some extra money until removed".
0
u/LanguageGeneral4333 1d ago
Are arguing the remediation steps are incorrect or just pointing out the AI downplayed the how suspicious this is? Because he should definitely follow those remediation steps given the info in that screenshot. Yes, you know more about infostealers than I do, but the advice on what to do now is sound. If you think there's an issue with those steps, im curious what you think it is.
1
u/Sctroom 1d ago
Can i do the "reset everything" rn i dont have a spare pc to make a bootable usb
1
u/LanguageGeneral4333 1d ago
Yea you can do that, but it isn't a guarantee that everything malicious will be removed. A reset will usually get rid of most malware, but a fresh install from a USB is the safer option. Neither is a 100% guarantee, especially since you have a second drive, but I'd go with the USB if you can.
3
u/ResponsibilityDry178 1d ago
No one asked for AI's input of regurgitated information. Please clean after yourself after vomiting on the carpet.
0
u/LanguageGeneral4333 1d ago
What would your advice to him be? Or are you just here to show you don't like AI?
1
3
u/computerviruses-ModTeam 1d ago
We appreciate you giving advice, however in this specific scenario your comment was deemed too generic, possibly harmful to the user or is not entirely relevant to their case from what they described and the details. It is also possible that you haven't elaborated on your advice enough, you haven't instructed the user on what to exactly do step by step or provided false sense of security to the user.
This includes (and is not limited to) recommending diagnostic tools for experts, recommending forensic steps that are unclear, recommending removal steps that are tricky to perform for the average home user and steps where it is easy for unexperienced user to cause damage to their device / operating system, determining false or true positives based on not enough input or data or recommending steps that are not entirely necessary.
We appreciate you trying to help regardless. If you want further explanation, you can reach out via modmail.
Please make sure to read and follow https://www.reddit.com/r/computerviruses/about/rules
1
25
u/NeedSomeHelp_2590 1d ago
Generally you should wipe your second ssd as well, as we can't say how dangerous the virus could be. But if you have some important data, save it in cloud and wipe it.
Before uploading to cloud just download Malwarebytes offline installer from other device and load it in pendrive and run on the infected machine.