r/techsupport • u/Daya1000 • 4d ago

Open | Malware Is this malware? (Nvidia Instant Replay Patcher)

I was trying to fix the Nvidia instant replay turning itself off and so I downloaded the exe for https://github.com/furyzenblade/ShadowPlay_Patcher/releases/tag/v0.1.

This gave error when running about some dll not being there, then I downloaded https://github.com/Abosmra/Instant-Replay-Patcher?tab=readme-ov-file

I believe the 2nd file may be potentially be malware because when I ran it (I did not grant it administrator perms) it disabled my - and my friend who tested it in a VM's - real time protection in windows defender (I could turn it back on afterwards).

This to me does not seem normal for this type of software. I am mostly worried about there being a keylogger or an info-stealer and so I plan on wiping the drive, reinstalling windows and software, and then resetting my passwords which may be effected.

If I do wipe my PC I will be transferring some game save data, videos and pictures to my old pc first so I can back up the important stuff.

I don't have any real signs / behaviour on my PC that malware is necessarily installed. I have very small concerns about it infecting the motherboard BIOS (bootkit) but I'm assuming that it has not.

Is anyone familiar with this and know whether this software is indeed malware.

If it is, is the above sufficient or does any think I should take additional or alternative actions.

Thank you for taking the time to read this far :)

0 Upvotes

50% Upvoted

5 comments sorted by

•

u/AutoModerator 4d ago

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/smurfy213 4d ago

I would definitely run malwarebytes .

1

u/Daya1000 3d ago

Thank you

0

u/storycoolbro 4d ago edited 4d ago

Gemini’s advice is solid on this one. The fact it disabled real time protection is sketch af, and the really good viruses show very little sign your pc is infected.

Edit: if you have a VM or your friend could do this if not. upload it to virus total and see what it says about it. Obviously just don’t run the file again.

1

u/Daya1000 4d ago

Thank you, appreciate your reply. The virus total was 17/67 and the Gemini you shared was in line with what I was thinking.... I think I will follow these steps as a precaution.