Microsoft KB Archive/810981

= Pop-Up Windows That Contain Advertisements to Adult Web Sites Intermittently Appear on Your Desktop =

Article ID: 810981

Article Last Modified on 5/23/2007

-

APPLIES TO


 * Microsoft Windows XP Professional
 * Microsoft Windows XP Home Edition
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition

-



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SUMMARY
One or more pop-up windows that contain advertisements that invite you to visit an adult Web site may periodically appear on your desktop. You may also be prompted to download a phone dialer program to your computer. The text contained in these pop-up windows may be in a language other than English (for example, German).

Additionally, a Uniform Resource Locator (URL) that is named &quot;http://voyour-cams.xww.de&quot; (without the quotation marks) may appear in the History list of Microsoft Internet Explorer.



CAUSE
This behavior occurs if the W32.DSS.Trojan program is installed on your computer. This Trojan Horse-style program inserts a Web page onto the computer that starts in a hidden Internet Explorer window. The W32.DSS.Trojan is typically contained in an e-mail attachment that is named Openme.exe.



RESOLUTION
Remove the Openme.exe file and its associated registry entry from your hard disk. To do so, follow these steps:  End the Openme.exe process in Task Manager. To do so:  On the desktop, press CTRL+ALT+DELETE, and then click Task Manager. Click the Processes tab. In the list of processes, right-click Openme.exe (if it is in the list), and then click End Process. Click Yes when you are prompted to confirm the operation. Quit Task Manager. </li> Delete the Openme.exe file on your hard disk. To do so:

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.  Click Start, and then click Search.</li> Click All files and folders.</li> In the All or part of the file name box, type openme.exe, in the Look in box, click , where   is the drive on which Windows is installed, and then click Search.</li> Right-click the Openme.exe file that is found, and then click Delete.</li> Click Yes when you are prompted to confirm the deletion.</li></ol> </li> Remove the entry for Openme.exe in the Windows registry. To do so:

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.  Click Start, and then click Run.</li> In the Open box, type regedit, and then click OK.</li> Locate the following registry key:

 

</li> In the right pane, double-click Shell.</li> The following values appear in the Value data box:

Explorer.exe

Openme.exe

Delete the Openme.exe value, and then click OK.

Important: Do not delete the Explorer.exe value. The only value that should appear in the Value data box is Explorer.exe.</li> Quit Registry Editor.</li></ol> </li></ol>

<div class="moreinformation_section">

MORE INFORMATION
For more information about the W32.DSS.Trojan program, visit the following Symantec Corporation Web site:

http://www.symantec.com/security_response/writeup.jsp?docid=2002-042413-3031-99

For additional information about Trojan programs, click the following article number to view the article in the Microsoft Knowledge Base:

129972 Description of Computer Viruses

Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:

List of Antivirus Software Vendors

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Keywords: kbacwsurvey KB810981

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.