Article ID: 312931
Article Last Modified on 8/7/2007
APPLIES TO
- Microsoft Windows Millennium Edition
- Microsoft Windows 98 Second Edition
- Microsoft Windows 98 Standard Edition
- Microsoft Windows 95
This article was previously published under Q312931
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SYMPTOMS
When you attempt to browse the Internet, you may receive one of the following error messages
-or-
where xxxx:xxxxxxxx represents a memory address.
You may also notice the following symptoms:
- Pop-up advertisements continually open while you attempt to browse the Internet or to open Web pages.
-or-
- Web pages open very slowly or they are only partially displayed.
CAUSE
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
This problem can occur if you open the e-mail attachment game "Yo Mama, Osama". This is a game that offers free phone products if you can shoot Osama Bin Laden. While you are playing the game, an Adware Trojan is installed on your computer without your knowledge. The Adware Trojan monitors your Internet usage and then sends pop-up advertising to you while your are browsing the Internet. The Adware Trojan is not removed even if you remove the game from your computer. For more information about the Adware Trojan, go to the following Web site:
NOTE: The Adware Trojan may start from the Startup folder or from the following registry key
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
with the values:
Name: WNAD
Data: C:\Windows\WNAD.exe
RESOLUTION
To resolve this problem you must remove the files that are associated with the Adware Trojan:
- Click Start, and then click Run.
- In the Open box, type msconfig, and then click OK.
- On the Startup tab, click to select WNAD (if it is present), and then click OK.
- If WNAD is present but it is not checked, restart the computer. If WNAD is present and it is checked, go to the next step.
- Press CTRL+ALT+DELETE.
- In the Close Program dialog box, click WNAD, and then click End Task.
- Click Start, point to Search, and then click For Files or Folders.
- Search for the Wnad.exe file.
- When Wnad.exe appears in the search results, right-click the file, and then click Delete.
- When the confirmation message is displayed, click Yes.
- Repeat steps 8 through 10 for the files Wnad.lgc (which is a hidden file), Wnag.dat, and Wnad-Update.exe. The Wnad-Update.exe file may not be present.
- Click Start, and then click Run.
- In the Open box, type regedit, and then click OK.
- Locate the following registry key
right-click the WNAD value, and then click Delete.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
- When the confirmation message is displayed, click Yes.
- Restart your computer.
Additional query words: kbtshoot kberrmsg
Keywords: kb3rdparty kberrmsg kbprb KB312931
