Free Games Virus

Posted: December 3, 2013

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	4,612
Threat Level:	2/10
Infected PCs:	102,441

First Seen:	December 3, 2013
Last Seen:	October 17, 2023
OS(es) Affected:	Windows

The Free Games Virus is a colloquial name for Potentially Unwanted Programs associated with free gaming sites like Zulagames.com. Free Games Viruses often enjoy their installations through bundled installers along with the 'free' games offered on the website, and may not give you any good options for blocking these installations while still acquiring the primary gaming software. Side effects of a Free Games Virus often include browser hijacks and pop-up advertisements, which may be a threat to your online safety. As a natural conclusion, malware researchers consider it a good practice to remove the Free Games Virus from your browser with appropriate anti-malware, anti-adware or other general security software.

The Hidden Price Tag with Your So-Called Free Games

The Free Games Virus is a common accompaniment to the installers of freeware gaming websites that often offer hundreds of games without any obvious cost. Only after getting these programs installed, you will find the actual price: allowing the Free Games Virus to make modifications to your browser that provide revenue for the associated company. Some of the most identifying symptoms of a Free Games Virus that malware researchers often see include:

Your homepage being reset to another URL chosen by the Free Games Virus.
Search engine hijacks that may redirect your Web searches to the gaming site's preferred search engine.
Pop-up advertisements, injected banners and other advertisement-based content that's displayed automatically. Any relevant adjustments to your browser's settings usually are ineffectual at disabling these advertisements.

Due to its tendency to lack any extremely unreliable functions as well as the fact that the Free Games Virus usually is installed with your theoretical permission, the Free Games Virus usually is only classified as a Potentially Unwanted Program (PUP). On the other hand, even PUPs have the potential to be unintended sources of attacks against your PC, and malware researchers consider it wisest to delete a Free Games Virus with anti-malware tools to keep your browser completely under your own control. This advice still applies even if you intend to continue using any related gaming applications.

A Legitimate Way to Go Gaming for Free

With so many gaming sites on the Web, malware experts would recommend selecting free gaming sites that aren't in the habit of bundling a Free Games Virus or other PUPs with their products. That advice aside, if you do need to remove a Free Games Virus, its deletion usually is manageable with the assistance of anti-malware products without harming any related gaming clients. All of the advertisements, search results and other content often propagated via a Free Games Virus do have the potential to load harmful phishing attacks or other toxic content, which is why the Free Games Virus's deletion always is encouraged regardless of its format or brand.

Safe browsing behavior also is especially important while you're still dealing with the symptoms of a Free Games Virus. Try to make a habit of avoiding any actions that malware experts would consider highly unsafe, such as installing patches being offered on advertisement networks, giving untrustworthy companies exploitable information (like your e-mail password) or trusting system error messages from unauthorized sources.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

D:\System Volume Information\_restore{249D6A2E-1BB5-4F8D-9BBD-90AC93D2CCA4}\RP554\A0095801.dll

File name: A0095801.dll
Size: 438.78 KB (438784 bytes)
MD5: c22adee6cbbb6e8004675551311b0873
Detection count: 24,939
File type: Dynamic link library
Mime Type: unknown/dll
Path: D:\System Volume Information\_restore{249D6A2E-1BB5-4F8D-9BBD-90AC93D2CCA4}\RP554\A0095801.dll
Group: Malware file
Last Updated: May 16, 2023

C:\Program Files (x86)\Free Games\ScriptHost64.dll

File name: ScriptHost64.dll
Size: 425.98 KB (425984 bytes)
MD5: aa03383520bb9277760de011667a0ccc
Detection count: 9,345
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\Free Games\ScriptHost64.dll
Group: Malware file
Last Updated: November 11, 2022

C:\Program Files (x86)\Free Games (4357)\ScriptHost.dll

File name: ScriptHost.dll
Size: 400.7 KB (400704 bytes)
MD5: 95b6d6694a16363f0857accffd743387
Detection count: 7,673
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\Free Games (4357)\ScriptHost.dll
Group: Malware file
Last Updated: November 5, 2022

C:\Program Files (x86)\Free Games (4357)\ScriptHost64.dll

File name: ScriptHost64.dll
Size: 381.76 KB (381760 bytes)
MD5: b68b9dc55c03b0c5ace22601d5a6cf2a
Detection count: 4,900
File type: Dynamic link library
Mime Type: unknown/dll
Path: C:\Program Files (x86)\Free Games (4357)\ScriptHost64.dll
Group: Malware file
Last Updated: October 8, 2023

%PROGRAMFILES(x86)%\Free Games 135\ScriptHost64.dll

File name: ScriptHost64.dll
Size: 381.76 KB (381760 bytes)
MD5: cf3439aac82889b2286bbef882d21e90
Detection count: 810
File type: Dynamic link library
Mime Type: unknown/dll
Path: %PROGRAMFILES(x86)%\Free Games 135
Group: Malware file
Last Updated: October 24, 2014

freegames115SetupW.exe

File name: freegames115SetupW.exe
Size: 1.78 MB (1781064 bytes)
MD5: ec64ee867767e43570e2e6824968210d
Detection count: 1
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: August 17, 2022

Registry Modifications

The following newly produced Registry Values are:

CLSID{045F91B3-695F-423A-98C7-8DE3C47AA020}{1348BD1B-C32A-41A7-9BD4-5377AA1AB925}{16F7ED3A-ECD8-46C7-8FD3-E4A8C79884D7}{18B9B16E-716F-43DF-A6AD-512C7D2EB983}{19975B78-1907-4DD6-A437-4C48120F46A4}{1C1CAA5E-399B-4226-997D-DB55DE412FB1}{395AFE6E-8308-48DB-89BE-ED5F4AA3D3EC}{43969E3F-3E7C-4911-A8F1-79C6CA6AC731}{43B390F0-6BA2-45CA-ABF2-5DB0CEE9B49D}{562B9317-C08A-444A-9482-62080DD851AE}{94CADA2E-1D3F-419F-8A3D-06C58EDF53C8}{9E52EB8B-8DD9-4605-AD36-D352BCD482F2}{A1440EC3-F0FA-407A-B811-DE6668C06D29}{B9A84AD0-5777-46FD-8B8F-1EBD06750FBC}{C120A687-EFD3-408B-BCB4-7A44E9932B28}{C1995F88-1C7F-40D7-B0FA-6F107F6308B8}{C45EC9F0-8333-465D-9728-074BD41985C9}{C815E3DA-0823-49B0-9270-D1771D58B317}{E1B14679-BD01-4491-BF53-4C873B2E5CEB}{E4A994B0-5550-4680-A4C6-B9470B888069}{EE95078D-518C-4FD2-8093-FD1D4E33D3CA}{F9EB11AB-9384-4736-9B33-993940F88895}HKEY..\..\..\..{RegistryKeys}SOFTWARE\Classes\Free Games 111.BackgroundHostObjectSOFTWARE\Classes\Free Games 111.BackgroundHostObject.1SOFTWARE\Classes\Free Games 111.NavbarSOFTWARE\Classes\Free Games 111.Navbar.1SOFTWARE\Classes\Free Games 111.ScriptHostObjectSOFTWARE\Classes\Free Games 111.ScriptHostObject.1SOFTWARE\Classes\Free Games 111.ToolSOFTWARE\Classes\Free Games 111.Tool.1SOFTWARE\Classes\Free Games 115.BackgroundHostObjectSOFTWARE\Classes\Free Games 115.BackgroundHostObject.1SOFTWARE\Classes\Free Games 115.NavbarSOFTWARE\Classes\Free Games 115.Navbar.1SOFTWARE\Classes\Free Games 115.ScriptHostObjectSOFTWARE\Classes\Free Games 115.ScriptHostObject.1SOFTWARE\Classes\Free Games 115.ToolSOFTWARE\Classes\Free Games 115.Tool.1SOFTWARE\Google\Chrome\Extensions\abckmpjbfjfoabjhefcbpdckdfikghppSoftware\Microsoft\Internet Explorer\Approved Extensions\{C45EC9F0-8333-465D-9728-074BD41985C9}Software\Microsoft\Internet Explorer\Approved Extensions\{F4BD3468-8241-488D-B013-953D090FADCE}Software\Microsoft\Internet Explorer\Approved Extensions\{FB39D4AB-27D9-4713-9942-910644E663E3}Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\zulagames.comSOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C45EC9F0-8333-465D-9728-074BD41985C9}SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4BD3468-8241-488D-B013-953D090FADCE}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{C45EC9F0-8333-465D-9728-074BD41985C9}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F4BD3468-8241-488D-B013-953D090FADCE}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C45EC9F0-8333-465D-9728-074BD41985C9}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F4BD3468-8241-488D-B013-953D090FADCE}SOFTWARE\Wow6432Node\Google\Chrome\Extensions\abckmpjbfjfoabjhefcbpdckdfikghppSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F4BD3468-8241-488D-B013-953D090FADCE}HKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}Free Games 111Free Games 115

Additional Information

The following directories were created:

%APPDATA%\freegames111%APPDATA%\freegames115%APPDATA%\freegames119%LocalAppData%\Google\Chrome\User Data\Default\Extensions\abckmpjbfjfoabjhefcbpdckdfikghpp%PROGRAMFILES%\Free Games 111%PROGRAMFILES%\Free Games 115%PROGRAMFILES(X86)%\Free Games 111%PROGRAMFILES(X86)%\Free Games 115

The following URL's were detected:

@ZulaGamesFree Games 111Free Games 115