Pop-Up Windows That Contain Advertisements to Adult Web Sites Intermittently Appear on Your Desktop (810981)
The information in this article applies to:
- Microsoft Windows XP Professional
- Microsoft Windows XP Home Edition
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional
IMPORTANT: This article contains information about modifying the registry.
Before you modify the registry, make sure to back it up and make sure that you
understand how to restore the registry if a problem occurs. For information
about how to back up, restore, and edit the registry, click the following
article number to view the article in the Microsoft Knowledge Base: 256986 Description of the Microsoft Windows Registry SUMMARYOne or more pop-up windows that contain advertisements that
invite you to visit an adult Web site may periodically appear on your desktop.
You may also be prompted to download a phone dialer program to your computer.
The text contained in these pop-up windows may be in a language other than
English (for example, German).
Additionally, a Uniform Resource
Locator (URL) that is named "http://voyour-cams.xww.de" (without the quotation
marks) may appear in the History list of Microsoft Internet
Explorer.CAUSEThis behavior occurs if the W32.DSS.Trojan program is
installed on your computer. This Trojan Horse-style program inserts a Web page
onto the computer that starts in a hidden Internet Explorer window. The
W32.DSS.Trojan is typically contained in an e-mail attachment that is named
Openme.exe. RESOLUTIONRemove the Openme.exe file and its associated registry entry
from your hard disk. To do so, follow these steps:
- End the Openme.exe process in Task Manager. To do so:
- On the desktop, press CTRL+ALT+DELETE, and then click
Task Manager.
- Click the Processes tab.
- In the list of processes, right-click
Openme.exe (if it is in the list), and then click End
Process. Click Yes when you are prompted to confirm
the operation.
- Quit Task Manager.
- Delete the Openme.exe file on your hard disk. To do so:
Note Because there are several versions of Microsoft Windows, the
following steps may be different on your computer. If they are, see your
product documentation to complete these steps.
- Click Start, and then click
Search.
- Click All files and
folders.
- In the All or part of the file name
box, type openme.exe, in the Look in
box, click drive, where
drive is the drive on which Windows is installed,
and then click Search.
- Right-click the Openme.exe file that
is found, and then click Delete.
- Click Yes when you are prompted to
confirm the deletion.
- Remove the entry for Openme.exe in the Windows registry. To
do so:
WARNING: If you use Registry Editor incorrectly, you may cause serious
problems that may require you to reinstall your operating system. Microsoft
cannot guarantee that you can solve problems that result from using Registry
Editor incorrectly. Use Registry Editor at your own risk.
- Click Start, and then click
Run.
- In the Open box, type
regedit, and then click OK.
- Locate the following registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon - In the right pane, double-click
Shell.
- The following values appear in the Value
data box: Delete the Openme.exe value, and
then click OK.
Important: Do not delete the Explorer.exe value. The only value that should appear in the Value data box
is Explorer.exe. - Quit Registry Editor.
Modification Type: | Minor | Last Reviewed: | 6/23/2005 |
---|
Keywords: | kbACWsurvey KB810981 |
---|
|