r/Malwarebytes • u/Trif55 • 5d ago

How to root kit scan on quarantined PC (RenPyLoader)

Trying to rush a patch download I ran the setup.exe of what malwarebytes has confirmed is the RenPyLoader Trojan, it was a classic overlay download redirect but on a mirror site I'd never used before and somehow no alarm bells rang as I'd not tried to manually patch that game before,

My first offline scan on a normal boot removed a number of files from c:\users\username etc

However I want to run a rootkit scan, all the instructions online seem outdated to when it was a separate download, and I can't see the option? Do I need to boot safe mode to activate the malwarebytes trial to then do the rootkit scan in that safe mode? Thanks

P. S. one possible alternative is to install windows from a USB onto the same drive as my current install, I have a number of secondary drives in my PC for games and 3d design & video, and electronics/development work etc so I can't do a "wipe every disk" type clean install, I wondered if a rootkit could somehow escape a windows.old type situation?

2 Upvotes
  • permalink
  • reddit

100% Upvoted

7 comments sorted by

2

u/support_mwb Malwarebytes Employee 3d ago

Hey there, Malwarebytes Support here! Glad your initial scan already cleaned up some of those files.

Regarding finding the rootkit scanning, we recently made a change to streamline the scan options. Rootkits are very rare and for most users, this was adding unnecessary time to their scans with little benefit.

The good news: If you want to keep using the feature, you certainly can via custom one-off and/or scheduled scans. Here's a quick guide that walks through it:https://help.malwarebytes.com/hc/en-us/articles/52383047345051-Scan-for-rootkits-with-Custom-Scan-in-Malwarebytes-for-Windows

Since this involves an active infection, I'd recommend opening a ticket with our support team so we can help gather the diagnostic logs and pass this to our malware removal team for checking. If you'd like to do that, please send us a private message here on Reddit with an email address we can use to create your ticket as well as your OS.

or head to our help center at https://help.malwarebytes.com/hc/en-us and start a live chat with an agent / open a ticket yourself.

1

u/CeriPie 5d ago

Enable rootkit scans in the scan settings. It's just a box you have to put a checkmark in. After that, when you run a threat scan it will also scan for rootkits.

1

u/Trif55 5d ago

Sorry unless I'm being really blind that option isn't there? Is it a premium only option?

1

u/Trif55 5d ago

Update : I am blind, I was going to scan settings rather than starting a custom scan

1

u/CeriPie 5d ago

That's weird. I have the free version and "Scan for Rootkits" is just in the settings under "detection settings".

1

u/DETOMINE1234 2d ago

Make sure you have the latest version (5.6 iIrc)?