Pop-Up Windows That Contain Advertisements to Adult Web Sites Intermittently Appear on Your Desktop

Article translations Article translations
Article ID: 810981 - View products that this article applies to.
Expand all | Collapse all

SUMMARY

One or more pop-up windows that contain advertisements that invite you to visit an adult Web site may periodically appear on your desktop. You may also be prompted to download a phone dialer program to your computer. The text contained in these pop-up windows may be in a language other than English (for example, German).

Additionally, a Uniform Resource Locator (URL) that is named "http://voyour-cams.xww.de" (without the quotation marks) may appear in the History list of Microsoft Internet Explorer.

CAUSE

This behavior occurs if the W32.DSS.Trojan program is installed on your computer. This Trojan Horse-style program inserts a Web page onto the computer that starts in a hidden Internet Explorer window. The W32.DSS.Trojan is typically contained in an e-mail attachment that is named Openme.exe.

RESOLUTION

Remove the Openme.exe file and its associated registry entry from your hard disk. To do so, follow these steps:
  1. End the Openme.exe process in Task Manager. To do so:
    1. On the desktop, press CTRL+ALT+DELETE, and then click Task Manager.
    2. Click the Processes tab.
    3. In the list of processes, right-click Openme.exe (if it is in the list), and then click End Process. Click Yes when you are prompted to confirm the operation.
    4. Quit Task Manager.
  2. Delete the Openme.exe file on your hard disk. To do so:

    Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.
    1. Click Start, and then click Search.
    2. Click All files and folders.
    3. In the All or part of the file name box, type openme.exe, in the Look in box, click drive, where drive is the drive on which Windows is installed, and then click Search.
    4. Right-click the Openme.exe file that is found, and then click Delete.
    5. Click Yes when you are prompted to confirm the deletion.
  3. Remove the entry for Openme.exe in the Windows registry. To do so:

    Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756 How to back up and restore the registry in Windows
    1. Click Start, and then click Run.
    2. In the Open box, type regedit, and then click OK.
    3. Locate the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    4. In the right pane, double-click Shell.
    5. The following values appear in the Value data box:
      Explorer.exe
      Openme.exe
      Delete the Openme.exe value, and then click OK.

      Important: Do not delete the Explorer.exe value. The only value that should appear in the Value data box is Explorer.exe.
    6. Quit Registry Editor.

MORE INFORMATION

For more information about the W32.DSS.Trojan program, visit the following Symantec Corporation Web site:
http://www.symantec.com/security_response/writeup.jsp?docid=2002-042413-3031-99
For additional information about Trojan programs, click the following article number to view the article in the Microsoft Knowledge Base:
129972 Description of Computer Viruses
Microsoft does not provide software that can detect or remove computer viruses. If you suspect or confirm that your computer is infected with a virus, obtain current antivirus software. For a list of antivirus software manufacturers, click the following article number to see the article in the Microsoft Knowledge Base:
List of Antivirus Software Vendors
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Properties

Article ID: 810981 - Last Review: May 23, 2007 - Revision: 1.12
APPLIES TO
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Home Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
Keywords: 
kbacwsurvey KB810981

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com