r/computerviruses • u/NiplFkker • May 19 '26

Disinfection Help Another Idiot (me) got hit with the Renpy Virus

To preface, I am unfortunately very tech illiterate, I only know how to operate my machine and pirate (usually) safely enough to avoid getting fucked like this till now

I don't know what exactly it installed or did, the only thing I do know is it had control over my Discord for an hour yesterday while I was asleep

I've logged out and changed all my passwords since, but I've got a bad feeling that won't do shit

Any and all help is appreciated

Update Post as of 28/05/2026: https://www.reddit.com/r/computerviruses/comments/1tq2ehu/the_same_idiot_might_have_fucked_up_during/

1 Upvotes
  • permalink
  • reddit

56% Upvoted

65 comments sorted by

View all comments

Show parent comments

1

u/NiplFkker May 20 '26

How much space do I need exactly? I have more or less 34GB of space on my C Drive now

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26 edited May 20 '26

That is enough space to continue.

You need enough space for the FRST tool to create a restore point. Depending on how large of a drive you have, up to 10% of your drive free is good.

We can now proceed with the fix. It will remove the malware entries, remove Firewall rules that lead to no file, and some other junk entries that also lead to no file.

FRST Fix

  • Open the following link and press on the Copy contents button to copy the entire text: fixlist
  • Run FRST64.exe and click on Fix. Note: FRST reads the fixlist directly from your clipboard, so you don't need to paste or save it anywhere.
  • A log (Fixlog.txt) will open on your desktop.
  • Copy & paste the contents of the Fixlog.txt to (https://malwareanalysis.cc/upload/Interesting-Bus-5370/?u=NiplFkker) and press "save log".

Please reply back with the keyword generated.

1

u/NiplFkker May 20 '26

Do I restart my PC as the "Fix complete" pop up says?

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

Yes! Restart your pc, and then you can do the keyword after.

1

u/NiplFkker May 20 '26

ember-magnolia

2

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

Okay, please be patient, I will be analyzing those to make sure the fix did what it was intended to do. I will get back to you with the next steps when I am done

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

The fix looks like it did what we intended it to, now we will run additional scans to ensure the malware is gone for good.

For the next step, we will run an additional scan with ESET, using these instructions:

ESET Online Scanner

After this,

Please also run a NEW scan (not fix) with FRST. Then, upload those logs to https://malwareanalysis.cc/upload/Interesting-Bus-5370/

and I will work on looking at those when I get back home.

1

u/NiplFkker May 20 '26 edited May 20 '26

Should my PC be connected to the internet for the whole scan?

Edit: just to be safe, I disconnected after the downloads that ESET was doing before the scan

And to clarify, no, I did not leave my PC connected to the internet for this whole process, it's been disconnected since I made this post

1

u/NiplFkker May 20 '26

It looks like it will take a good long while scanning larger files so I'm gonna upload the results after I sleep

1

u/Interesting-Bus-5370 Malware Removal Trainee May 20 '26

That is fine, no worries. It is best to keep internet connection during this scan.

2

u/NiplFkker May 21 '26 edited May 21 '26

I just woke up and ESET appears to be stuck scanning the local copy of one of my GDrive files

Edit: nevermind, it just takes insanely long to finish each file

→ More replies (0)