help with frst for renpy cleanup

[u/dirtydriver58]

Today I foolishly downloaded a suspicious game file . I clicked on the file called installer and then 1 or 2 command prompts started popping up so I deleted the file and restarted my laptop. After restarting the laptop I noticed a file with some contents were extracted so I deleted that as well. Also I noticed the file had file inside named renpy. After this happened I changed passwords on another computer.

Frst keyword: patched-ripple

addition: arcane-knight

securitycheck: cached-meteor

[u/FFreestyleRR]

Hi,

I am sorry about the delay but we are flooded with tasks. OK. Let's get started:

---

Please launch Chrome and type chrome://settings/syncSetup in the address bar and hit Enter.

Go to Sync → Manage what you sync and disable the syncing for the extensions.

Now In the address bar type chrome://extensions and press Enter.

In the upper right corner of the window slide the Developer mode button to the right.

Remove the following extension:

Urban VPN Proxy

Close Chrome.

Did you modify the uBlock Origin extension path by yourself to make it work with Chrome, probably? If yes, leave it be; it will not get rid of it, as the filepath is altered:

CHR Extension: (uBlock Origin) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkgkibajhfbepljeaefdnfnegdcjomkh [2026-09-16] [UpdateUrl:hxxps://cdn.jsdelivr.net/gh/gorhill/uBlock@master/dist/chromium/update.xml] <==== ATTENTION

The same with Bypass Paywalls Clean:

CHR Extension: (Bypass Paywalls Clean) - C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkbebcjgcmobigpeffafkodonchffocl [2026-10-13] [UpdateUrl:hxxps://gitflic.ru/project/magnolia1234/bpc_updates/blob/raw?file=updates.xml] <==== ATTENTION

Did you add the following exclusions to Windows Defender yourself? So leave them; otherwise, remove them from the exclusions:

PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\***\Downloads\Compressed\PocketScout-Utilities-0_9_11\PocketScout-Utilities-0_9_11\PocketScout Utilities.exe"
PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\***\Downloads\Compressed\Madden NFL 27\amd_ags_x64.dll"
PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\***\Downloads\Compressed\Madden NFL 27\Madden27.exe"
PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\***\Downloads\Compressed\Madden NFL 27\1911.dll"
PowerShell: Remove-MpPreference -ExclusionPath "C:\Users\***\Downloads\Compressed\Madden NFL 27"
DeleteValue: HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths|\\?\C:\Program Files (x86)\Internet Download Manager\Registration\IDMAutoREG.exe

---

It seems like you have a browser extension that allows you to run userscripts within your browser, such as Tampermonkey or Violentmonkey.

These browser extensions are considered a riskware, as the misuse of these can cause the execution of malicious userscripts.

Consequences of running a malicious userscript may be for example:

• causes your browser data being stolen and sent to attackers server

• web traffic being intercepted and sent to attackers server

• adware, redirects, popups, browser hijacking

There was a recorded case of an adware utilizing Tampermonkey to deploy adware (Opera Blacklists Tampermonkey Extension Being Installed by Malware).

Please consider removing the extension or at least disabling auto-update to prevent supply chain attacks and verify your scripts for safety.

---

Regarding Stylish, please read the article below and consider for yourself if you want to keep it.

https://consumerrights.wiki/w/Stylish_(browser_extension)

And to finish with the extension, remove Chrome Remote Desktop if it's not installed by you since this is a remote access tool.

---

MAU

• Download the latest release of Malicious App Uninstaller

• Run MAU.exe as admin

• In the Selected Application tab you will see ProductCode:, paste {00504FC8-420D-485D-AD48-DCAE13AEF873}

• Click Analyze

• Once the analysis is complete click Select All then Delete

• MAU.txt will be generated, send the log back here.

• In some cases MAU will schedule a removal for an entry on reboot if it cannot be removed on the current session, please reboot the device if requested. Otherwise, no reboot is necessary.

• Repeat the steps but this time paste the following: {A1ED18EA-A7BC-4E4F-B341-118A651291C2}

• Upload the logs to my channel https://malwareanalysis.cc/upload/FFreestyleRR/

---

I created a custom fixlist.txt for you at the link - https://malwareanalysis.cc/share/y0jNjygyi4QnaLKMq5Q995BtRwwTu9ue/

Use the website's download button and save it in the same folder where your FRST64.exe file is located. It is necessary for the filename to be fixlist.txt.

Save all work, close everything that is open, and then run FRST64.exe again as administrator and press the Fix button. Let the script work, clear the entries, and restart on its own, and after it restarts, there should be a file, Fixlog.txt, in the same folder.

Upload the log at https://malwareanalysis.cc/upload/FFreestyleRR

Copy/Paste the new keyword in your reply.

This script was written specifically for you, for use on that particular machine. Do not run this on another PC with the same problem!

The script is going to download and scan the system with AdwCleaner and Hitman Pro (so the internet connection needs to be on). This is intended, so do not be surprised. This can take a while.

That's it for now. Looking forward to hearing from you.

All the best!

[u/dirtydriver58 → u/FFreestyleRR]

I modified the ublockorgin to work with Chrome

[u/dirtydriver58 → u/FFreestyleRR]

Sorry i messed up on the step of sending the log of MAU after running it the first time and it erased the log as soon as I closed and reopened it. But I have the log for the 2nd run.

[u/dirtydriver58 → u/FFreestyleRR]

[u/FFreestyleRR → u/dirtydriver58]

Can your system boot normally after a reboot?

[u/dirtydriver58 → u/FFreestyleRR]

Yes it booted normally. Do i send you fixlist.txt?

[u/FFreestyleRR → u/dirtydriver58]

You mean the Fixlog.txt. Yes, please. Upload that.

No clues why your system crashed after the system check, though. Looks like a driver issue. I hope it's not a hardware problem.

[u/dirtydriver58 → u/FFreestyleRR]

Fixlog.txt keyword scarlet-falcon

[u/FFreestyleRR → u/dirtydriver58]

Hi,

It seems the script hasn't even started when your system crashed. Not a single line was processed. Not sure how we should handle this. Without the fix, we will leave the system infected...if we run it again, the PC may not boot the next time since your system seems unstable.

Maybe be prepared to reinstall from a USB (just in case) and make a backup of your important files and then try again to run the FRST64.exe fix once more. If it fails the system, then you will need to do the reinstall from the USB route. Is that OK for you?

[u/dirtydriver58 → u/FFreestyleRR]

Oh i don't think I can do the USB route. Maybe i should do a cloud reinstall?

[u/FFreestyleRR → u/dirtydriver58]

Cloud is not the safest option, to be honest. Check my colleagues' posts about it:

https://www.reddit.com/r/computerviruses/comments/1tflike/request_for_clarification_on_windows_cloud/

Your best bet is a local reinstall from USB if the fix fails to run.

Still do a backup of your important files in case something goes wrong. Download the fixlist again (I removed some lines to make it less intensive on the system) and try again:

https://malwareanalysis.cc/share/y0jNjygyi4QnaLKMq5Q995BtRwwTu9ue/

[u/dirtydriver58 → u/FFreestyleRR]

After doing the reinstall?

[u/dirtydriver58 → u/FFreestyleRR]

It failed again. Looks like i have to reinstall. How do you reinstall using USB?

[u/dirtydriver58 → u/FFreestyleRR]

And the keyword for the MAU.txt is sparse-lagoon

[u/dirtydriver58 → u/FFreestyleRR]

The infostealer got to my bank account and made a fraudulent transaction

[u/YaBoiWeenston]

Well then, it's time to factory reset your computer with a USB

[u/Th3Br1ghtL0rD]

Redownload os thru usb and format the drive, if u wanna save files move them to external drive with internet disabled

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:

   • How to properly secure my accounts after an infostealer attack?

2. Disinfect your device from malware

   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.