PC infected by PavinLoader, RenplyLoader & Trojan.Win32.Hosts2.gen via fake Vegas Pro installer – Steam account stolen

[u/VictimeFragile]

​

Hi everyone. I fell realy dump and afraid right now.

My PC was recently compromised after downloading a malicious executable masquerading as a Sony Vegas Pro installer (vegas220.exe located in C:\ProgramData\com_usr_node_v9).

Here is what happened:

Steam Account Hijacked: My Steam account email address was changed without my authorization (no email notification received in my inbox prior to the change).

Malware Detected:

Malwarebytes flagged several .BAT scripts as Trojan.RenplyLoader.BAT, a process detected via AI (Malware.AI.1298616306), and blocked outbound connections to a Command & Control (C2) server located in Germany.

An error message popped up showing that OvSupervisor.exe was actively running in C:\ProgramData\com_usr_node_v9\.

Kaspersky Virus Removal Tool (KVRT) detected a Trojan.Win32.Hosts2.gen infection inside C:\Windows\System32\drivers\etc\hosts.

Actions taken so far:

-Disconet from internet.

-All detected items in Malwarebytes and KVRT were quarantined/cured (including the hijacked hosts file).

-Still have the malicious folder in ProgramData don't know if I can remove it.

-Changed my primary email password and enabled 2FA from an uncompromised mobile device (using cellular data).

-Submitted a recovery ticket to Steam Support with proof of ownership.

My questions:

What can I do more ?

How to be sure that all risk is delete ?

Thanks

[u/FFreestyleRR]

Hi,

Please download FRST64.exe and save the file to your Desktop.

https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

Right-Click FRST64.exe and select Run as Administrator.

Click Yes to the disclaimer. Ensure the Addition.txt box is checked. Click the Scan button and let the program run. Upon completion, click OK, then OK on the Addition.txt pop up screen.

Two logs (FRST.txt & Addition.txt) will now be open on your Desktop.

Copy & paste the contents of each log to https://malwareanalysis.cc/upload/FFreestyleRR/ and press "save log".

The site will return a keyword for each log. Reply here with the keywords.

Keep in mind that we may have different time zones. Also, I have a full-time job, and I am only a volunteer here, and my replies could be delayed. But I will do my best to reply as quickly as possible.

All the best!

[u/VictimeFragile → u/FFreestyleRR]

FRST: Keyword : pinned-prairie

Addition : Keyword :jagged-champion

My laptop is in frech tell me if you need logs in english et how to do it Thanks for your help

[u/FFreestyleRR → u/VictimeFragile]

Hi, in this case please rename FRST64.exe to FRSTEnglish64.exe and run a new scan and upload the logs.

Thanks!

[u/VictimeFragile → u/FFreestyleRR]

Here they are

FRST Keyword : hashed-mirror

Addition Keyword : pure-cursor

[u/FFreestyleRR → u/VictimeFragile]

Hi,

Thanks.

Did you remove something on your own? It seems 3 of the baddies are already gone from the logs between the French and the English logs. :)

I am currently at work and will reply later with the fixlist, but for now please do this:

MAU

• Download the latest release of Malicious App Uninstaller
• Run MAU.exe as admin
• In the Selected Application tab you will see ProductCode:, paste {92AA05AA-1D07-44D2-BA36-BDEDA52CCA45}
• Click Analyze
• Once the analysis is complete click Select All then Delete
• MAU.txt will be generated, send the log back here.
• In some cases MAU will schedule a removal for an entry on reboot if it cannot be removed on the current session, please reboot the device if requested. Otherwise, no reboot is necessary.
• Repeat the steps but this time paste the following: {1FC0E7C7-A89E-4D24-9E2C-3101BD971348}
• Upload the logs to my channel.

---

Revo Uninstaller

• Download and install Revo Uninstaller (free version)
• Double-click Revo Uninstaller to run it
• From the list of programs, locate App Explorer and double-click it
• It will ask for confirmation, click Continue and Revo will start creating a restore point
• Wait until initial analysis is finished
• When prompted if you want to uninstall, click Uninstall
• The program's built-in uninstaller will run. Work your way through it, ensuring you read each page thoroughly
• Note: If you are offered the choice to install additional software, ensure you decline
• Once the built-in uninstaller is finished, ensure the Moderate option is selected and click Scan
• Revo will search for leftovers. Click Select All and click Delete
• When prompted click Yes
• Click again Select all, followed by Delete
• When prompted click Yes
• Upon completion, click Finish
• Repeat the steps and uninstall the following if they are still present on the system:

App Explorer (I noticed at least 3 instances of these in the installed programs. I'm not sure if uninstalling one of them with Revo will remove the rest).

Driver Easy 7.1.0 7.1.0.2641
PCHelpSoft Driver 11.1.29574.1514

It's dangerous to use drivers updating software. Also they are often bundled with ads. Better get rid of them.

Let me know if you were successful in uninstalling the programs.

---

Rescan and upload fresh logs from FRST.

Until later!

[u/VictimeFragile → u/FFreestyleRR]

I put com_usr_node_v9 foldee and MegaAnaly128.exe In theBin should I remove them completly, restore them or wait ? I will run the 2 app. What do you mean by "my channel" ? malwareanalysis ? Thank a lot for your help :)

[u/FFreestyleRR → u/VictimeFragile]

Hi,

Do not restore them, but please refrain from doing changes on your own during the cleaning process.

Yeah upload the MAU.txt logs here => https://malwareanalysis.cc/upload/FFreestyleRR/

[u/VictimeFragile → u/FFreestyleRR]

Ok clear, no change on my own. Mau.txt : tidy-script Mau log for both steps: sparse-widget FRST : verdant-oasis Addition : ochre-spring

I only saw one instance of App Explorer in revo. Removed Driver Easy too.

[u/FFreestyleRR → u/VictimeFragile]

Hi,

Thank you for the logs.

Are you sure the infection came with fake Vegas Pro? From the logs, it looks like it came from the DODI repack of the Euro Track Simulator.

---

Please launch Chrome and type chrome://settings/syncSetup in the address bar and hit Enter.

Go to Sync → Manage what you sync and disable the syncing for the extensions.

Now In the address bar type chrome://extensions and press Enter.

In the upper right corner of the window slide the Developer mode button to the right.

Remove the following extension:

Urban VPN Proxy

Close Chrome.

---------------------------------------------------------------------------------------------

I created a custom fixlist.txt for you at the link - https://malwareanalysis.cc/share/j5MNW3v63T1zkbEaF3MXmIh3HUftWIwz/

Use the website's download button and save it in the same folder where your FRST64.exe file is located. It is necessary for the filename to be fixlist.txt.

Save all work, close everything that is open, and then run FRST64.exe again as administrator and press the Fix button. Let the script work, clear the entries, and restart on its own, and after it restarts, there should be a file, Fixlog.txt, in the same folder.

Upload the log at https://malwareanalysis.cc/upload/FFreestyleRR

Copy/Paste the new keyword in your reply.

This script was written specifically for you, for use on that particular machine. Do not run this on another PC with the same problem!

The script is going to download and scan the system with AdwCleaner and Hitman Pro (so the internet connection needs to be on). This is intended, so do not be surprised. This can take a while.

---------------------------------------------------------------------------------------------

To save some time for both of us, I will give you the next steps too.

ESET

Please download ESET Online Scanner from here and install it (run it).

Select the Custom Scan option and check the boxes beside Operating Memory, Autostart Locations and drive C: and click Save and continue.

Enable the detection of potentially unwanted applications and potentially unsafe applications.

Click on Start scan. When the scan is complete click Save scan log. Click Continue.

Upload the log to https://malwareanalysis.cc/upload/FFreestyleRR/ and the site will return a keyword for the log.

Reply here with the keyword.

---------------------------------------------------------------------------------------------

EEK

• Download Emsisoft Emergency Kit and save it to your Desktop.
• Run the setup file, then click Install. Accept any User Account Control prompts.
• The files will be extracted to C:\EEK by default. Open that folder and double-click Start Emergency Kit Scanner.
• Accept the license agreement. The program will download updates automatically -- wait until the Scan tab turns green.
• Keep the default settings (including Potentially Unwanted Program detection) and click Malware Scan.
• Once the scan is complete, close the pop-up about Emsisoft protection, then click Quarantine selected objects (only shown if threats were found).
• Restart your computer if prompted.
• After quarantine, click View Report in the lower-right corner. The log will open in Notepad.
• Copy & paste the contents of the log to https://malwareanalysis.cc/upload/FFreestyleRR/ and press "save log". Post the log keyword to your reply.
• You can ignore the newsletter sign-up when closing the program.

All the best!

[u/VictimeFragile → u/FFreestyleRR]

I think I messed up...I ran the fix once, but the Wi-Fi didn't connect when I enabled it, I din't double checked. I ran it a second time with the Wi-Fi connected, but nothing seems to be happening. Should I let it keep running or stop it? The first time, it generated the Fixlog.

[u/KamiPyro]

Info stealers will try to take every password on your pc. Change all your passwords from a clean device. Google, youtube, bank, everything you may use on your pc needs to have its password changed

[u/VictimeFragile → u/KamiPyro]

J'ai tout changé et ajouté une double authentification

[u/KamiPyro → u/VictimeFragile]

Okay. Best way to ensure the pc is safe is full wipe and reinstall OS

[u/VictimeFragile → u/KamiPyro]

I will lost my data ? I don't have my windows key anymore

[u/KamiPyro → u/VictimeFragile]

I had to lose my data. It sucks. If you want to tempt fate, go ahead and back up important files to a flash drive or something.

Run Command Prompt as Administrator and type in:

wmic path softwarelicensingservice get OA3xOriginalProductKey

Then hit enter. That should show your windows key.

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/redlu5564]

Similar happened to me, delted every file and also got this annoying popup with the same error. My account didn't got stolen and I changed all my stuff before. Anything you did next?

[u/VictimeFragile → u/redlu5564]

Nothing more for the moment :/

[u/redlu5564 → u/VictimeFragile]

Hi there just wasted my entire night with the problem. I just made a clean reinstall of windows with a new USB. I chnaged my entire passowrds with a 2nd device. Its kinda exhausting since I'm having to reinstall a lot of stuff and said goodbye to alot of personal stuff like pictures etc but it was easier that way. So fsr no issues. Before that when I launched my pc it always had a radnom pop-up which actually turned out to be (or some part) of a keylogger.

[u/VictimeFragile → u/redlu5564]

Damn :/ why didn't you save your pictures somewhere ?

[u/redlu5564 → u/VictimeFragile]

I honestly was like fuck it. Better than save than sorry.

[u/Consistent_Change243]

If you aint completely wiping the OS which you should be doing, make sure to uninstall whatever browser you are using and clear all the caches. Alot use them as persistence.

[u/wolfelo]

Try delete the malicious folder using Lockhunter it worked for me

[u/FFreestyleRR → u/wolfelo]

Sadly this will not be enough. The malware utilizes multiple folders and makes numerous changes.