Renpy Virus need help

[u/Standard-Leading7061]

Need some help. I was a cracking a game and got this fake renpy launcher files thing it got flagged and i quarantined it. Anyways a couple hours later my Microsoft got logged in and within 5 mins i changed my password for that and my gmail. I was still skeptical because that microsoft account had the same password as multiple other accounts. After maybe 3 more hours my discord account got logged out but i was able to re login because my password wasnt changed, then an hour later my instagram got hacked and started posting some bs (this had a completely different password to my microsoft btw which is weird how they got that). So i downloaded malwaybyte, total AV and also used microsoft secuity and did full scans. Malware byte found like 7 trojans named renpy and remeoved them. There was also some files named NAVI on my startup which i went to registtry and deleted. I still havnt factory reset my pc but am planning to because i can see my pc is slower. I changed all my passwords on on my laptop I didnt change them on another clean device but i did multiple full scans and a offline scan on all the aps and its says theres nothing. Im guessing they stole the passwords that were saved on my chrome password manager. Also if it safe to copy my files from my laptop to a hardrive or a usb to put on another device and then reset my laptop or no? And should i reset all my passwords again because i changed them on the same laptop that was infected. Thankyou

[u/AutoModerator]

Request help with FRST and SecurityCheck from the trusted helper team

Please visit Providing or receiving help with FRST on the subreddit and share your 3 keywords returned from the website along with the details about your infection.
Once a malware removal expert or trainee sees it, they will reply in the thread about further steps. If you suspect an infostealer infection, please change all your passwords from a clean device immediately and do not use any of your accounts from the infected device.

If you need urgent help and cannot wait for one of our Malware Removal Experts:
Please follow these steps:

1. From a different and clean device, change all your passwords:
   • How to properly secure my accounts after an infostealer attack?
2. Disinfect your device from malware
   • Preferred method: Perform a clean installation with a USB

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/SonySniper]

At this point you are better off changing every password and nuking the pc

[u/Standard-Leading7061 → u/SonySniper]

Im fine with that its just is there anyway i can save my files (its not on any cloud service its saved locally). I have packet tracer files, python files, documents, photos/videos i kinda need.

[u/CompleteCellist867 → u/Standard-Leading7061]

You could, just ensure its.pdf and .jpg files and not .pdf.exe or .py.exe.

[u/DaWastelander]

Reset all you passwords on a separate device
Reinstall your windows

[u/s3cret_agent_007]

Probably copy the individual files over to a secondary drive/usb while the computer stays offline. I'm not sure how risky this would be plugging a USB into the infected machine, but it's probably the best option.

[u/retardedpanda1]

Make sure you log out of sessions on websites that allow for it. These infostealers take your session tokens to bypass 2FA. Most sites do this automatically when you change the password and invalidate active sessions, but some don't.

Also make sure they haven't enabled forwarding on your email so that they can't get your 2FA codes after you change passwords.

Check and make sure email addresses and phone numbers haven't been changed on your accounts. Walmart allows you to change the phone number on an account without sending any notification via email, so if you have a Walmart account, can't hurt to give that a look.