downloaded when it was infected can't find "mysupergame" file or anything infected/hijacked did node.js error save me ?
RPGM Completed Amelie falls over and over again ~ An endless week in Magic Academy [v1.24] [AVANTGARDE]
- Thread starter dazedanon
- Start date
-
- Tags
- 2d game 2dcg ahegao anal sex big ass big tits bukkake cheating combat corruption creampie dilf exhibitionism fantasy group sex handjob humiliation japanese game male domination male protagonist masturbation multiple endings multiple penetration netorare oral sex pregnancy prostitution romance spanking teasing titfuck turn based combat vaginal sex virgin voiced
I only know about Fox Girls Never Play Dirty, not so much about Avantgarde's other works, but I remember that game (2020) having more content than Amelie (2025), for some reason, including multiple endings (that unfortunately do require a replay, which can be NG+) and a tiny post-game.
Although I also remember it being slightly more grindy, and all in all I prefer Amelie's art somewhat (besides Amelie's absurdly gigantic balloons).
Maybe someone else can chime in about other Avantgarde works.
Not sure how dazedanon or Bob69 get their files, I'm pretty sure it's by self-reporting on a request in the Game Requests forum, but uploaders do scan it with what's available - it's a bit more of a pain with browser-based games like RPG Maker games, since the malware launching points are usually obfuscated into otherwise innocent JavaScript libraries.
These are not binaries with harmful known signatures, which is why they go through. Same principles apply for Ren'py and/or Python-based games.
Said launching point does download an actual, known malware binary (Lumma Stealer in the recent cases), which does get immediately flagged by antiviruses - including Defender - provided real-time protection and cloud detection aren't disabled.
You can find more information about the process in the relevant thread.
Yeah, that's the dangerous part. The wave of noobs reporting windows defender false positives masks real cases like this one.
draxy
Newbie
- Dec 12, 2019
- 25
- 13
Ok so this is something that spooked me too but those file aren't the result of a previous infection but just RPGM due to it being built on NW.JS :
"NW.js is an app runtime based on Chromium and node.js"
1. The game is launched through the built-in web browser.
2. The web browser creates a new profile, where it later writes game saves.
rpgmaker is made with NW.js, which is based on Chromium and Node.js. Chromium in particular has a User Data folder where it stores info that would be useful for a web browser, which is mentioned in the Chromium documentation:
Also since Chrome obviously uses Chromium it has its own User Data and Default folders (which the docs mention is also located in Appdata/Local), and have a ton of files and folders, some of which are the same files seen in the other User Data folders that many people are worried about.
Also in the NW.js documentation it mentions where the data path for an NW.js app is located:
Just like Chromium, it's also located in Appdata/Local which likely means this was inherited from it. However, it has a <name> variable in the file path, which the docs say is located in a package.json manifest. If you look in any rpgmaker game folder where the exe for the game is, there is also a package.json file, and when opened with any text editor, a web browser, or even Notepad, it lists a few name/value pairs. The first in the list is almost always "name", and whatever value it has is what NW.js uses to name the data path.
For example, in some rpgmaker games that I've installed, the "name" value is "rmmz-game", which is probably a default name for rpgmaker MZ projects and explains why I have a rmmz-game folder in my Appdata/Local file path. Most games have empty quotations, which defaults to the file path Appdata/Local/User Data, some have random text which creates the Appdata/Local/<random-text> folder, and some actually have the name of the game, which also explains why game titles are in Appdata/Local.
"NW.js is an app runtime based on Chromium and node.js"
1. The game is launched through the built-in web browser.
2. The web browser creates a new profile, where it later writes game saves.
rpgmaker is made with NW.js, which is based on Chromium and Node.js. Chromium in particular has a User Data folder where it stores info that would be useful for a web browser, which is mentioned in the Chromium documentation:
You must be registered to see the links
Also since Chrome obviously uses Chromium it has its own User Data and Default folders (which the docs mention is also located in Appdata/Local), and have a ton of files and folders, some of which are the same files seen in the other User Data folders that many people are worried about.
Also in the NW.js documentation it mentions where the data path for an NW.js app is located:
You must be registered to see the links
Just like Chromium, it's also located in Appdata/Local which likely means this was inherited from it. However, it has a <name> variable in the file path, which the docs say is located in a package.json manifest. If you look in any rpgmaker game folder where the exe for the game is, there is also a package.json file, and when opened with any text editor, a web browser, or even Notepad, it lists a few name/value pairs. The first in the list is almost always "name", and whatever value it has is what NW.js uses to name the data path.
For example, in some rpgmaker games that I've installed, the "name" value is "rmmz-game", which is probably a default name for rpgmaker MZ projects and explains why I have a rmmz-game folder in my Appdata/Local file path. Most games have empty quotations, which defaults to the file path Appdata/Local/User Data, some have random text which creates the Appdata/Local/<random-text> folder, and some actually have the name of the game, which also explains why game titles are in Appdata/Local.
Last edited by a moderator:
So all this wasnt related with this game? I'll also say, about rpgmaker games, even for old versions, mcafee and other antivirus can trigger false positives.
The official release (072 Project) is generally better than the dazed version, it gets the names and subjects right as far as I can remember, which GPT 3.5 really struggled with.
However it sometimes felt like it was translated by an ESL or a JP > CN > EN game of telephone.
To put it simply: it's better than GPT 3.5, but it ain't great.
Precious Stones
Member
- Mar 14, 2018
- 127
- 209
name
Katainaka ni Totsui de Kita Russia Musume to H Shimakuru Ohanashi
Thank you so much for documenting your experience and your steps. I noticed how an Instagram and Linkedin account of mine got compromised, without any security notice from either platform. Despite geological ip tracking and it being from vastly different countries from mine.
I was able to find the reason by googling the .exe which is mentioned somewhere in this threat as my MS Defender hit that one.
I did the whole song and dance with resetting pws. Hopefully I'm good now.
And again - thanks you