Microsoft KB Archive/312931

= Advertising Windows Constantly Interfere with Internet Browsing =

Article ID: 312931

Article Last Modified on 8/7/2007

-

APPLIES TO


 * Microsoft Windows Millennium Edition
 * Microsoft Windows 98 Second Edition
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows 95

-



This article was previously published under Q312931



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
When you attempt to browse the Internet, you may receive one of the following error messages

WNAD has caused an error in unknown

-or-

Exception 0E Access Violation in Module Wnad.exe at :

where :  represents a memory address.

You may also notice the following symptoms:
 * Pop-up advertisements continually open while you attempt to browse the Internet or to open Web pages.

-or-
 * Web pages open very slowly or they are only partially displayed.



CAUSE
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

This problem can occur if you open the e-mail attachment game &quot;Yo Mama, Osama&quot;. This is a game that offers free phone products if you can shoot Osama Bin Laden. While you are playing the game, an Adware Trojan is installed on your computer without your knowledge. The Adware Trojan monitors your Internet usage and then sends pop-up advertising to you while your are browsing the Internet. The Adware Trojan is not removed even if you remove the game from your computer. For more information about the Adware Trojan, go to the following Web site:

http://antivirus.about.com/od/virusdescriptions/a/yomamaosama.htm

NOTE: The Adware Trojan may start from the Startup folder or from the following registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

with the values:

Name: WNAD

Data: C:\Windows\WNAD.exe



RESOLUTION
To resolve this problem you must remove the files that are associated with the Adware Trojan:  Click Start, and then click Run. In the Open box, type msconfig, and then click OK. On the Startup tab, click to select WNAD (if it is present), and then click OK. If WNAD is present but it is not checked, restart the computer. If WNAD is present and it is checked, go to the next step. Press CTRL+ALT+DELETE. In the Close Program dialog box, click WNAD, and then click End Task.</li> Click Start, point to Search, and then click For Files or Folders.</li> Search for the Wnad.exe file.</li> When Wnad.exe appears in the search results, right-click the file, and then click Delete.</li> When the confirmation message is displayed, click Yes.</li> Repeat steps 8 through 10 for the files Wnad.lgc (which is a hidden file), Wnag.dat, and Wnad-Update.exe. The Wnad-Update.exe file may not be present.</li> Click Start, and then click Run.</li> In the Open box, type regedit, and then click OK.</li> Locate the following registry key

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

right-click the WNAD value, and then click Delete.</li> When the confirmation message is displayed, click Yes.</li> Restart your computer.</li></ol>

Additional query words: kbtshoot kberrmsg

Keywords: kb3rdparty kberrmsg kbprb KB312931

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.