Spyware that stole my discord info, my search history and site passwords

[-JustAguy-]

everything happened on discord 
A person wrote to me in dm asking me to play his “game” so that I could review it later
he sent me the site where you can download the game and instead of the game there was only one file that caused some kind of java error and then this person who send the game send my discord data, search history and all my passwords from sites

the github page for the games site

 https://playarenawarsgame.github.io/

 

password is ARENAWARS

video gameplay:

 

there was also github page of the game: 

https://github.com/playarenawarsgame/playarenawarsgame.github.io

 

and even malware github page by the same guy: 

https://github.com/playarenawarsgame/jhgfdsadsw/blob/main/kjhgvfcds.js

 

a person helped me partially deobfuscate the malware code and showed me these segments from it:

 

I checked netplwiz in run command and didn't find other suspicious users

it also installed a logger of some sorts, I deducted that from the malware's code and that screenshot

also in two suspicious programs were also found in the task manager in startup (Launcher and startApp.vbs)

inside startapp vbs was this: Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "C:\Users\899A~1\AppData\Local\Temp\1cffed197ac052e9cb0c4c1e27c0e275.exe", 0
Set WshShell = Nothing

the path leads to nothing

What do I do now?

 

Edited September 6 by AdvancedSetup
Disabled hyperlinks

[1PW]

Hello @-JustAguy- and :

Thank you for the attachments.

Let us get the information to get the process started. Be aware it will take many steps and scans to fully remove malware.

Please respond to all future instructions from your helper in a timely manner.

 

Let us go ahead and run a couple of scans and get some updated logs from your system. Please read the entire post below before starting so that you're more familiar with the process.

Then, sequentially follow each step in the order provided. Unless otherwise asked, please attach all logs.

 

Please make the following system changes:  Please pay close attention to the instructions in all the following links.

• If you have not done so already, Enable System Protection and create a NEW System Restore Point.
• Temporarily disable your antivirus real-time protection or other security software first only if it blocks or interferes with the scans or downloads. Make sure to turn it back on once the scans are completed.
• Temporarily disable Microsoft SmartScreen to download software below only if needed. Make sure to turn it back on once the downloads are completed.
• Disable-Fast-Startup.
• Show-Hidden-Folders-Files-Extensions.

Please run the following scans:  Please pay close attention to the instructions in all the following links.

1. Click the following link and run a Scan with AdwCleaner Alternative AdwCleaner download.
2. Click the following link and run a Scan with Malwarebytes Alternative MB5 download. Please check for application and Update Package updates.
      RESTART the computer
3. Click the following link and run a Scan with Farbar Recovery Scan Tool.
    

Example image of where to click to attach the 5 files when posting your reply

 

[David H. Lipman]

Thank you @-JustAguy-

This is another example of the "try my Beta game" ploy affecting so many we see here that is spam'd via email, SMS and Discord Direct Message.  It is not a game but an Electron based password and data stealer and is an Ageo Stealer.

RE:     Fake Game password and data stealer

Edited September 6 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[AdvancedSetup]

@-JustAguy-

Please run the requested scans and attach the logs and we'll be  happy to assist you.

Thank you

 

[AdvancedSetup]

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks