How do i stop Limewire from opening when i Bootup my Comp . I have unticked the box in OPTIONS-SYSTEM STARTUP and APPLIED but it still keeps loading.I have looked in MSCONFIG-STARTUP but cant see anything there to do with Limewire.
I am running Win XP on Cable can anyone HELP?

thats the same thing that happens to me!!!!
how do you fix it?????
someone please help, its so annoying
bye

__________________
ben

Go to Tools>Options>Advanced>System Startup & untick option & press apply.

Limewire opened on bootup even after UNticking the SYSTEM STARTUP Box.The only way I could solve it was to Tick the box allowing the icon in the System Tray but it stopped it Automatically opening the Program.But I did untick the CONNECT on STARTUP box as i am on Cable a didn't want to be connected without Monitoring It.

Possibly the other item is to stop it closing down to the tray. Tools>Options>Shutdown & tick shutdown immediately. But if this was your last effort. Perhaps make a note of all your settings & try deleting your LW Preferences folder whilst LW is closed; instructions here: Fixes for Limewire You did go to advanced options in LW to stop it didn't you & not connections.

Yes= through Advanced Options-System Startup. I dont mind an Icon in System Tray but at least it does'nt open now on Bootup

I had this exact same problem, and after literally 24 hours of analyzing every inch of my computer, I solved the problem. I suspect that based on your descriptions of the problem (which I had as well), you are infected with a virus. It's unbelievable that none of my AntiVirus packages picked up this infection.

For me, everytime I restarted my computer, Limewire would automatically load up. Even if I closed it, it would just open back up again. On top of this, I could not even access the Task Manager in Windows XP to allow me to force a shutdown of Limewire. I hit CTRL-ALT-DEL and nothing would happen.

Anyways, here are the steps that need to be taken.

1) Uninstall Limewire. You can reinstall it at the end of these steps.

2) Disable System Restore in Windows. This can be done by right clicking on My Computer, selecting Properties, and then clicking on the System Restore tab. Then check the box Turn Off System Restore. Hit Apply, and then OK. If you are prompted to restart Windows, do so.

3) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

4) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

5) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

6) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

7) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

8) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

9) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

10) Finally, click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

11) Now restart your computer. Reinstall Limewire.

This should hopefully fix your problem.

Bobby Naini

Hi.

Just to add to the steps that I posted earlier, also do the following:

1) Go to the following directory and delete any file with winupdates in the name.

c:\windows\prefetch

2) When you're done with all of my steps, plase make sure to go back into the System Properties by right clicking on My Computer, and unchecking the Turn Off System Restore box under the System Restore tab.

For those of you who can't seem to find taskmgr.exe, cmd.exe, or regedit.exe, I would suggest you do the following if you have not already done so:

Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

Also, if you are using the Search function in Windows to locate these files, make sure that you do it in the following way:

1) Click on the Start button in Windows, and then select Search.

2) Select All Files and Folder

3) Enter the file name in the first box.

4) Click on More Advanced Options.

5) Make sure that the following all have checkmarks next to them:
Search System Folders
Search Hidden Files and Folders
Search Subfolders

Then once these are checked, click on Search.

I hope this helps! :-)

Bobby Naini

done the first bit but cant find SYSTEM32 only SYSTEM .Done a file search no luck (what next)

did a search for taskmgr.exe and found it. Removed winupdate which was using 50% of CPU now cant find (regedit.exe)or (system32) opend (regedit)in RUN but a message said (the programe was unsutable for running MSDOS and MICROSOFT WINDOWS APPLICATIONS

daughter just told me the Antivirus caught a virus yesterday and put it in quaratine. I am now able to open Task Manager after deleting Winupdate do you think i am clear of the Virus now as the computer seems to be running OK

Hi Nigel.

If you are able to open the Task Manager, you are safe from the virus only for so long as you don't reboot. The problem is that the moment you reboot your computer, the virus might be reactivated by a "call" that is placed in the registry. So in my opinion, it's absolutely essential that you get into the Windows registry to remove any references to the virus.

What version of Windows are you running?

Just to be 100% certain, are you following these additional steps to find those files:

Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

Also, if you are using the Search function in Windows to locate these files, make sure that you do it in the following way:

1) Click on the Start button in Windows, and then select Search.

2) Select All Files and Folder

3) Enter the file name in the first box.

4) Click on More Advanced Options.

5) Make sure that the following all have checkmarks next to them:
Search System Folders
Search Hidden Files and Folders
Search Subfolders

Then once these are checked, click on Search.

Post back if none of these apply. Once I know your version of Windows, I might be able to help you better.

Bobby Naini

I sent an email to Kaspersky Labs antivirus yesterday about this virus and got an email back from one of their virus analysts. However, I haven't been infected and so I wasn't able to provide them with a sample of the virus.

If you'd be so kind as to help prevent others form getting this virus, please make a password-protected zip (or rar) file containing any viral files you are about to delete. The password should be "infected" and it should be mailed to NewVirus@kaspersky.com, with a subject of KLAB-571146.

It's my understanding that the major anti-virus labs have informal agreements about sharing new viruses with eachother.

If you're extra motivated to help stop this virus, there's also a web submission form at http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7 . Presumably TrendMicro wants the winupdates file instead of the password protected zip file.

Unfortunately, it looks like Symantec/Norton Anti-Virus requires you to use Norton Anti-Virus to send in samples instead of using plain old email. If you have Norton Anti-virus, please by all means use Norton Anti-virus to send Symantec/Norton a copy of winupdates.

McAfee Anti-virus's website gives me the impression that there's no way for the average person to send them samples of suspected viruses.

Delving this deep into computers is a bit new to me . My Antivirus is AVASTwhich did quarantine the Virus called (Win32:adware).while all thiswas going on would this have been the same one

[Newly added]
It looks like this is called the "AN Worm" or the "Zodiak Worm".

I finally got my hands on a copy of this malware. I tested it against free trial versons of Norton AV and Kaspersky AV (and updated the virus definitions for both). Kasperky detects it as Worm.Win32.VB.an. Norton misses it.

There are two free trial versions of Kaspersky Antivirus on download.com

http://www.download.com/3120-20_4-0.html?qt=kaspersky

It's late. Let everyone know

[End of new stuff]


If your antivirus software had detected this virus, it probably would have moved the virus files (winupdate) to your quarantine folder and they wouldn't have been there when you tried the manual removal steps above. However, I'm not familiar with the specifics of AVAST.

AVAST's own website has a list of viruses, but it doesn't list anything named "Adware", so my guess is that it is detecting some kind of adware program (popup generator) and quarantining that. If I had to make a guess, I would guess that AVAST added virus definitions to make it's antivirus program think that various adware programs are viruses, and remove the adware just like it removes viruses. However, I really don't know enough about AVAST to know what it has found based on your description. Unfortunately, different anti-virus vendors often use different names for the same virus.

In any case, if your quarantine folder doesn't contain any winupdates files, my best guess is that AVAST caught some other nasty thing on your computer.