I realize that the “Windows Error Reporting” feature found on Windows XP has a purpose, and I applaud that. However, someone has found a method to subvert this feature to their own ends.
My sister-in-law called me and reported getting multiple WERs about a worm. I thought that was odd, and looked at her machine. I found
a window popping up, three times in succession. If it was connected to the net (broadband/cable), the “routine” would pop up every 30 minutes; if physically disconnected from the mode, the routine would repeat every 10 minutes.
I installed Adaware, Spybot S&D, AVG (6), & ZoneAlarm in an effort to block it but that didn’t work (it did, however, remove over 4000 instances of worms, virii, & trojans!).
The window that pops up is titled “Windows Error Report” or “Windows Error Reporting”. In the body of the message, is a big red ball with a white “X” centered, and the message “We detected I-Worm.Mydoom worm on this PC, Click to Download I-Worm.Mydoom Remover.” and then two buttons, one marked “OK” and the other “Cancel”.
When clicking “OK”, the user is taken to:
http://www.palsol.com/er/?hop=21project
via Internet Explorer (I have made sure that the latest patches have been installed on XP & IE). And for a modest fee of $19.99, the software may be obtained.
I haven’t found the software that is triggering this stuff.
I ran bhocop and found nothing unusual.
I checked for MyDoom and found nothing.
And, naturally, Office Depot/HP did not include the Windows Home XP disc when they sold the product, so an “fdsk & re-install” is out of the question.
Any ideas?