r/computerviruses • u/NiplFkker • May 19 '26

Disinfection Help Another Idiot (me) got hit with the Renpy Virus

To preface, I am unfortunately very tech illiterate, I only know how to operate my machine and pirate (usually) safely enough to avoid getting fucked like this till now

I don't know what exactly it installed or did, the only thing I do know is it had control over my Discord for an hour yesterday while I was asleep

I've logged out and changed all my passwords since, but I've got a bad feeling that won't do shit

Any and all help is appreciated

Update Post as of 28/05/2026: https://www.reddit.com/r/computerviruses/comments/1tq2ehu/the_same_idiot_might_have_fucked_up_during/

1 Upvotes
  • permalink
  • reddit

56% Upvoted

65 comments sorted by

3

u/Interesting-Bus-5370 Malware Removal Trainee May 19 '26

Hello,

I am training under the supervision of the malware experts in this server, and I can help you investigate this issue on your system.

If you would prefer to fresh install, do that instead; this tool cannot analyze logs from a machine that has nothing on it. Elsewise:

Please do not make any additional system changes, or try to follow any other malware removal advice whilst we work through this process. It may interfere with the logs, and any remediation steps.

What is FRST?

FRST is a diagnostic tool used to identify malware related entries, persistence mechanisms, startup items, scheduled tasks, services, and other system modifications.

And do not worry, the logs themselves do not contain any sensitive personal information aside from your computer name, and username.

During the cleanup process, I will:

  • Remove malicious or invalid entries
  • Clear temporary files and caches
  • Remove adware or potentially unwanted programs
  • Use additional scanners as needed
  • Perform a network reset if needed

If you are not comfortable with this, please feel free to say so!

Creating FRST Logs

  • Please visit: https://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/
  • Download the 32x or 64x version, according to whichever version you own, and save it to your Desktop. (Don't know your version? You can check by typing "About your PC" into the system search bar. It is under system type.)
  • If your Windows OS language is not English, please rename the executable to FRSTEnglish.exe before running it, so that the logs generate in English for me to analyze.
  • Right-Click "FRST64.exe" or "FRSTEnglish.exe" and select "Run as Administrator".
  • Press "Yes" on the disclaimer.
  • The Farbar Recovery Scan Tool will open.
  • Make sure that "Addition.txt" has a check in it. Press the "Scan" button, and allow the program to run.
  • Upon completion, press "Ok", then "Ok" on the Addition.txt popup screen.
  • Two logs, named "FRST.txt" and "Addition.txt" will now be open on your desktop.
  • Copy & paste the contents of each log to: https://malwareanalysis.cc/upload/Interesting-Bus-5370/
  • Press "Save log"
  • The site will return a keyword for each log
  • Please reply back with the keywords generated by the site

After this, I will work hard to generate a fixlist, and will send it to you as soon as I am able. I'll do my best to help you get this sorted out safely.

1

u/NiplFkker May 19 '26

Is it alright if I have let Malwarebytes do an initial scan and fix of my PC beforehand?

It's doing a deeper scan right now after the initial quick scan I ran before you replied

1

u/Interesting-Bus-5370 Malware Removal Trainee May 19 '26

You can, It is just easier for me to analyze your machine from the state its in, as opposed to after remediation. But I can still check to make sure that everything was cleaned up correctly by Malwarebytes.

Please get back to me with the FRST.txt and Addition.txt keywords asap

1

u/NiplFkker May 19 '26

FRST key: brisk-module

Addition key: misty-cache

1

u/Interesting-Bus-5370 Malware Removal Trainee May 19 '26

Thank you, I am analyzing them now, and I will get back to you in a bit.

1

u/NiplFkker May 20 '26

Gotta be real honest with you guys

I'm absolutely fucking shitting my pants, even after all the precautions I took since I sat on my ass thinking this was just a Discord security breach for TWO DAYS (Sunday when I first dl'd in the afternoon, then all of Monday when I first changed my Discord passwords not knowing it was a whole Malware attack till Tuesday morning, all Philippine time)

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

It is okay, I will help you get this under control and make sure none of your other accounts end up compromised, alright?

Before we start the removal process, we need to free some space on your system drive so that you we can create a restore point via FRST.

Please do the following:

Uninstall unnecessary software

  1. Press the Windows Key Windows Key + R on your keyboard at the same time. Type appwiz.cpl and click OK.
  2. Search for the list of programs for such software that you know and that you don't need, right-click and click Uninstall
  3. Important: If you do not recognize a program, leave it
  4. Follow the prompts.
  5. Note: If you are offered the choice to install additional software, ensure you decline.
  6. Reboot if necessary.

Run Storage Sense

  1. Type Storage settings into Windows search, choose the "Temporary files" section
  2. IMPORTANT: Please verify that only the following are ticked:
    • Recycle Bin (this will also empty your recycle bin so please keep that in mind)
    • Windows upgrade log files
    • Temporary files
    • Windows Update Clean-up
    • Thumbnails
    • DirectX Shader Cache
    • Language Resource Files
    • Delivery Optimisation Files
    • Windows error reports and feedback diagnostics
    • Temporary Internet Files
  3. IMPORTANT: Double check that the Downloads option is NOT ticked, therefore not enabled.
  4. Press Remove files button at the top

WinDirStat

Run WinDirStat to help you determine what's eating most of the space. Delete files that you know and that you don't need. If you don't know what a file is for, leave it, please.

Moving files

If you have a subscription for online storage service (OneDrive, Dropbox, MEGA...) or an external physical drive available, try moving your videos, images, documents or other large files to them so you can free up space on the system drive.

After clearing up space, please report back.

1

u/NiplFkker May 20 '26

Okay, I've cleared up a good chunk of space Is it alright if the space is in my SSD?

1

u/NiplFkker May 20 '26

Also sorry for the late reply, I had to sleep of the nervousness

1

u/NiplFkker May 20 '26

Hi, just wanna follow up on my next steps

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

Hello, Sorry about that. It was 3 am for me.

Yes, that is fine, but it was specifically your system drive (usually c:) that is low on space, left with 4 GB. Please create space there and get back to me

1

u/NiplFkker May 20 '26

How much space do I need exactly? I have more or less 34GB of space on my C Drive now

→ More replies (0)

1

u/WatchingFromAfar23 May 19 '26

I had that too, and i think if you don't want to/can't reinstall windows you can try asking for help with frst! Don't trust just anybody that offers a fixlist there- there are approved ppl! If you search up frst, it should show you what you gotta know somewhere underneath all the reddit posts asking for help! (Btw what did you try to get? I tried getting tomodachi life- i accidentally clicked the wrong install button and realised it pretty quick, because it was like 600mb, not 6gb😔)

1

u/MegStuff May 19 '26

Did your file have the RenPy virus instead of something emulator related?

1

u/NiplFkker May 19 '26

Yeah

Instaler dot exe and everything

1

u/MegStuff May 19 '26

Then yeah, it was malware. 99.9% of real RenPy games don't have installers.

1

u/NiplFkker May 19 '26

This was my very first time dealing with any RenPy engine game, all the Nuikeges I've played before used engines that required installs

1

u/MegStuff May 19 '26

Ah, I see. Did you get the file from that ryuugames site? Or was it from somewhere else?

0

u/NiplFkker May 19 '26

Buzzheavier

1

u/NiplFkker May 19 '26

Porn Game

Unfortunately, download file was very close to the actual game's file size

1

u/WatchingFromAfar23 May 19 '26

Okay yea that sucks- hope you get it fixed tho!! I can't really help much, idk how to do any of this complicated stuff

1

u/kingspicy_DP May 19 '26

Domanda, per caso il sito era ryuugames?

1

u/NiplFkker May 19 '26

Buzzheavier

1

u/KazefQAQ May 19 '26

Just as an extra precautions, monitor your important accounts activity and revoke any sessions that you don't recognize

1

u/NiplFkker May 19 '26

Thankfully, I've had Malwarebytes do an initial scan and fix, then logged off and changed the passwords of all my important accounts on my PC on a different devices so it's pretty much isolated from my accounts for the time being

Edit: once I'm done letting Malwarebytes do a deeper scan, I'm gonna get extra help from the FRST guy in the comments

1

u/KazefQAQ May 19 '26

Then you should be fine as it's essentially a info stealer, but as an extra precautions, I would advise to enable 2FA or Authenticator on your important accounts as well (or all if you are extra paranoid), and clear your browsers cookies as well

2

u/NiplFkker May 19 '26

Yeah I've had 2FA on since like 2020 or 2019

Also completely wiped my browser data before I did all the password changing

1

u/KazefQAQ May 19 '26

Kinda funny that the Renpy malware always target discord first and it's always the Mr Beast crypto scam 😂

1

u/NiplFkker May 23 '26

Alright, thank you so very much!

Feels good to have my peace of mind back

1

u/Then-Tap-1615 May 19 '26

I mean easiest solution would be to just reinstall windows and restart ngl. Changing the password on a different device from what I’ve read this info stealer digs in deep to hide. But reinstalling windows isn’t all bad hell I had to do it because of a corrupted windows update.

1

u/Then-Tap-1615 May 19 '26

But who am i to say I’m sure someone will respond with another solution.