Limewire opening on Startup
 

How do i stop Limewire from opening when i Bootup my Comp . I have unticked the box in OPTIONS-SYSTEM STARTUP and APPLIED but it still keeps loading.I have looked in MSCONFIG-STARTUP but cant see anything there to do with Limewire.
I am running Win XP on Cable can anyone HELP?:confused:

limewire starting on startup
 

thats the same thing that happens to me!!!!
how do you fix it?????
someone please help, its so annoying
bye

Go to Tools>Options>Advanced>System Startup & untick option & press apply.

Limewire opened on bootup even after UNticking the SYSTEM STARTUP Box.The only way I could solve it was to Tick the box allowing the icon in the System Tray but it stopped it Automatically opening the Program.But I did untick the CONNECT on STARTUP box as i am on Cable a didn't want to be connected without Monitoring It.

Possibly the other item is to stop it closing down to the tray. Tools>Options>Shutdown & tick shutdown immediately. But if this was your last effort. Perhaps make a note of all your settings & try deleting your LW Preferences folder whilst LW is closed; instructions here: Fixes for Limewire You did go to advanced options in LW to stop it didn't you & not connections.

Yes= through Advanced Options-System Startup. I dont mind an Icon in System Tray but at least it does'nt open now on Bootup

I had this exact same problem, and after literally 24 hours of analyzing every inch of my computer, I solved the problem. I suspect that based on your descriptions of the problem (which I had as well), you are infected with a virus. It's unbelievable that none of my AntiVirus packages picked up this infection.

For me, everytime I restarted my computer, Limewire would automatically load up. Even if I closed it, it would just open back up again. On top of this, I could not even access the Task Manager in Windows XP to allow me to force a shutdown of Limewire. I hit CTRL-ALT-DEL and nothing would happen.

Anyways, here are the steps that need to be taken.

1) Uninstall Limewire. You can reinstall it at the end of these steps.

2) Disable System Restore in Windows. This can be done by right clicking on My Computer, selecting Properties, and then clicking on the System Restore tab. Then check the box Turn Off System Restore. Hit Apply, and then OK. If you are prompted to restart Windows, do so.

3) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

4) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

5) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

6) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

7) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

8) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

9) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

10) Finally, click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

11) Now restart your computer. Reinstall Limewire.

This should hopefully fix your problem.

Bobby Naini

Hi.

Just to add to the steps that I posted earlier, also do the following:

1) Go to the following directory and delete any file with winupdates in the name.

c:\windows\prefetch

2) When you're done with all of my steps, plase make sure to go back into the System Properties by right clicking on My Computer, and unchecking the Turn Off System Restore box under the System Restore tab.

For those of you who can't seem to find taskmgr.exe, cmd.exe, or regedit.exe, I would suggest you do the following if you have not already done so:

Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

Also, if you are using the Search function in Windows to locate these files, make sure that you do it in the following way:

1) Click on the Start button in Windows, and then select Search.

2) Select All Files and Folder

3) Enter the file name in the first box.

4) Click on More Advanced Options.

5) Make sure that the following all have checkmarks next to them:
Search System Folders
Search Hidden Files and Folders
Search Subfolders

Then once these are checked, click on Search.

I hope this helps! :-)

Bobby Naini

done the first bit but cant find SYSTEM32 only SYSTEM .Done a file search no luck (what next)

did a search for taskmgr.exe and found it. Removed winupdate which was using 50% of CPU now cant find (regedit.exe)or (system32) opend (regedit)in RUN but a message said (the programe was unsutable for running MSDOS and MICROSOFT WINDOWS APPLICATIONS

daughter just told me the Antivirus caught a virus yesterday and put it in quaratine. I am now able to open Task Manager after deleting Winupdate do you think i am clear of the Virus now as the computer seems to be running OK

Hi Nigel.

If you are able to open the Task Manager, you are safe from the virus only for so long as you don't reboot. The problem is that the moment you reboot your computer, the virus might be reactivated by a "call" that is placed in the registry. So in my opinion, it's absolutely essential that you get into the Windows registry to remove any references to the virus.

What version of Windows are you running?

Just to be 100% certain, are you following these additional steps to find those files:

Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

Also, if you are using the Search function in Windows to locate these files, make sure that you do it in the following way:

1) Click on the Start button in Windows, and then select Search.

2) Select All Files and Folder

3) Enter the file name in the first box.

4) Click on More Advanced Options.

5) Make sure that the following all have checkmarks next to them:
Search System Folders
Search Hidden Files and Folders
Search Subfolders

Then once these are checked, click on Search.

Post back if none of these apply. Once I know your version of Windows, I might be able to help you better.

Bobby Naini

Please send a copy to ant-virus labs to help stop this virus
 

I sent an email to Kaspersky Labs antivirus yesterday about this virus and got an email back from one of their virus analysts. However, I haven't been infected and so I wasn't able to provide them with a sample of the virus.

If you'd be so kind as to help prevent others form getting this virus, please make a password-protected zip (or rar) file containing any viral files you are about to delete. The password should be "infected" and it should be mailed to NewVirus@kaspersky.com, with a subject of KLAB-571146.

It's my understanding that the major anti-virus labs have informal agreements about sharing new viruses with eachother.

If you're extra motivated to help stop this virus, there's also a web submission form at http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7 . Presumably TrendMicro wants the winupdates file instead of the password protected zip file.

Unfortunately, it looks like Symantec/Norton Anti-Virus requires you to use Norton Anti-Virus to send in samples instead of using plain old email. If you have Norton Anti-virus, please by all means use Norton Anti-virus to send Symantec/Norton a copy of winupdates.

McAfee Anti-virus's website gives me the impression that there's no way for the average person to send them samples of suspected viruses.

Delving this deep into computers is a bit new to me . My Antivirus is AVASTwhich did quarantine the Virus called (Win32:adware).while all thiswas going on would this have been the same one

Worm.Win32.VB.an or Zodiak
 

[Newly added]
It looks like this is called the "AN Worm" or the "Zodiak Worm".

I finally got my hands on a copy of this malware. I tested it against free trial versons of Norton AV and Kaspersky AV (and updated the virus definitions for both). Kasperky detects it as Worm.Win32.VB.an. Norton misses it.

There are two free trial versions of Kaspersky Antivirus on download.com

http://www.download.com/3120-20_4-0.html?qt=kaspersky

It's late. Let everyone know

[End of new stuff]


If your antivirus software had detected this virus, it probably would have moved the virus files (winupdate) to your quarantine folder and they wouldn't have been there when you tried the manual removal steps above. However, I'm not familiar with the specifics of AVAST.

AVAST's own website has a list of viruses, but it doesn't list anything named "Adware", so my guess is that it is detecting some kind of adware program (popup generator) and quarantining that. If I had to make a guess, I would guess that AVAST added virus definitions to make it's antivirus program think that various adware programs are viruses, and remove the adware just like it removes viruses. However, I really don't know enough about AVAST to know what it has found based on your description. Unfortunately, different anti-virus vendors often use different names for the same virus.

In any case, if your quarantine folder doesn't contain any winupdates files, my best guess is that AVAST caught some other nasty thing on your computer.

I did everything BobbyNaini Instructed then i REBOOTED then went back and checked and everything regarding WINUPDATES had been removed.I then did a Deep Virus scan using AVAST then Microsoft AntiSpyware then AD-AWARE.6 then SPYBOT then CWSHREDDER and all was clear.Now all i want to do is put back
SYSTEM32 and REGEDIT in the right place

Thanks
 

I was having the same trouble, I wrote limewire for help and they told to uninstall limewire and java and installed them back again but it did not work, I had notice though that I was not able to enter the task manager either.

Follow everything so far and I found the windupdates.exe file in the task manager consuming 98% of my cpu, in the registry and in the prefetch folder.

I'm hoping I did it right because now I'm going to install limerwire again.

Thanks for the help.

Worm.Win32.VB.an
 

I got my hands on a copy of this malware, and in fact it is not detected by the 6/22/2005 virus definitions from Norton Anti-virus.

However, the free trial version of Kaspersky Anti-virus catches this worm.

Download.com has two versions:
http://www.download.com/3120-20_4-0.html?qt=kaspersky

I tested the less expensive of the two. (Well, they're both free for about a month, but you know what I mean.)

I downloaded both Norton AV and Kaspersky AV free trial versions from Download.com tonight, updated them both fully, and ran them against the malware sample I received.

If anyone knows of any other anti-virus programs that will catch this worm, let everyone know.

Hey Bobby,

Just a quick note to virtually shake your hand and give you a pat on the shoulder coz you really helped me out with that virus.

Your instructions were crystal clear for someone like who's not computer literate at all. Plus in the process, I got to get more familiar with my machine.

Thx man, keep up the good work

Peace :)

i got a slower computer. i noticed when limewire started up, i'd see something about digital audio access protocol.. then my computer would lag up, often causing me to kill limewire through task manager.

go to Tools -> Options
Click on the iTunes tab
Go to Sharing
uncheck the Share my Music box.
press apply
restart Limewire

I went up to "processes" step, and so far have not seen anything taking up almost 100% of my usage other than System Idlr Process. This virus is still taking its effect and i cant seem to stop it, i unintsalled limewire, java and still am getting errors. Im Using a Windows XP. Any ideas?

CTRL-ALT-DELETE still not working
 

I have eradicated the winupdates virus according to your steps (thanks a million, BobbyNaini!) but I still cannot bring up the task manager by pressing CTRL-ALT-DELETE. Is there a menu where I can turn this back on, or do you think I have another virus?

:confused:

No Winupdates file but fixed otherways
 

Like BlueDragon56 the only process I had running more than 1% & and at 99% was the idle Process! I couldnt see any winupdates file so I tried downloading the free demo software of Kaspersky Anti-Virus and it seemed to remove it! It also noted something interesting! When scanning my hard drive it scanned an invisible dir called "Complete" in my "C:\MY Documents\Admin\" of which I never saw before especially as my Documents is on a totally seperate drive. The folder was filled with 8GB of Zip files of which all had pornographic names! I wonder if this was affects of the virus as I defenitly dont allow porn to be on this PC at anytime!

I'm the same as above, i have the smae problem, but there is nothing eating my CPU... WHAT THE HELLB IS GOING ON??? if you could help i'd be really grateful...

Uninstall LimeWire and your current AntiVirus Software (to avoid your PC crashing later) and download Kaspersky Anti-Virus and install and run it! After a clean uninstall that software then reinstall your original AntiVirus and LimeWire and see if that helps :)

Good luck mate and hope that helps you! A hell of a lot of us got the same virus one way or another!


Regards
The Bishop

All of you still probably still have the virus

So if thats the case logic says

"We always had the virus to begin with!"

Sorry Mystical moment! I found that as I didnt have readings out of worry in my Proccesses tab and ran the anti virus software than re-installed LimeWire and been ok since it has worked!

If not for you then sorry!


Regards
Bishop!

:confused:

Don't quite get what you are saying.

No you didn't always have the virus I did not say that. And yes it is a good Idea to uninstall your AV some viruses have the capability to disable the ability for certain AV to find them once you have opened the file and become infected.

There is no reason to uninstall LimeWire it is not infected. The infected file / files may be in the share or incoming folders but uninstalling LimeWire does not remove those files / folders.

If a person is still getting new multiple copies of files the same size without downloading them then they are still infected.

I only uninstalled the software as per original cure posted by someone else earlier! I fully agree its not the program that infected but the shared files downloaded. The reason we uninstalled the software is to avoid it keep popping up and slowing the antivirus software part!

Sorry to confuse you gramps!


Regards
Bishop

Thanks for clearing that up now it makes sense.

no problem Gramps!

How are u for socks this Christmas? LOL

Glad that cleared things up!


Regards
The Bishop

Re: Worm.Win32.VB.an or Zodiak
 

Hi!
I installed LimeWire last week and had the same problem as you: LW opened again and again although I closed it. I tried to follow your steps to delete "winupdates". But it won't work because I couldn't find "C:\windows\prefetch". Maybe it is because I have Windows ME. Please help me!

If your having trouble ridding yourself of this virus you need to go to Norbiesworld....This is the link to his site, he will help you fix this......;)

http://www.norbiesworld.co.uk/Forums...ic/t=1295.html

Thanks! I'll try it and tell you, if everything is alright!!! :-))))))

Cool, please do let us know of the outcome as it will help others...;)

CRACKED IT!
 

Right, thanks to lots of people here, AVG, jeremy wilkes and sgtbadgerman i have finally figured it all out... :D

The Signs

There are three main things to look for if you think you may have the virus.
1) Limewire constantly keeps opening, and if you un-install it it still tries (and comes up with an error
2) Ctrl-Alt-Delete will not work. This is so the virus is not seen eatingall the cpu :mad:
3) In c/Documents and Settings/main user there will be a folder called complete or uploads or something of the sort. Its a hidden file, so make sure you have hidden files on and system filen on aswell. In complete will be a load of zip files, usually with porn names. DO NOT BE FOOLED! Each one is the virus, and each folder is uploaded to limewire, so more people get it. This is why limewire keeps opening!

The Virus

****** this thing is smart! It cannot be detected by any antivirus (that i know of) and can take over programs. (it took over my previous antivirus!! :( ) It also takes up all your CPU, so if your comp is running slowly, check the signs. Its also extremely good at hiding ;).

How to get rid of the bugger!

Right, this is the hard part.

1) Check all the signs
2) If you know you have the virus, uninstall limewire, this is the first place it hides.
3) Delete .limewire This is in c/Documants and Settings/Main User
4) Do a file find for limewire, delete everything.

5) Now limewire has gone, you can start getting rid of the virus. First, see if you can get into task manager a different way. Sometimes you can, sometimes you can't. To see, go to c/windows/system 32/taskman.exe If you cant open task manager this way, it will probably come up witht eh program is in use. You will need to make a shortcut to task manager on your desktop, re-start your PC and click it straight away.

6) If you can get into task manager, go to processes and double click CPU. Something will be using close to 100%. Write down what it is. It is most likely to be ms movies or winupdates. again, DO NOT BE FOOLED! This is the virus hiding under a windows program!. If the virus is not one of the two, do a file find for what it is. DELETE EVERYTHING that is suspicious. It may have taken over some programs (it did with my antivirus, i had to delete it)

7) Now, if you did or didnt find what the virus is named, turn your computer off and run it in safe mode. (push f8 at startup and select safe mode). If you get the option to cancel loading something using esc, do so. Booting in safe mode may take a while...

8) Go to c/program files and look for winupdates, or ms movies. It'll be hidden. If not, look for what you found in taskmanager. Delete this file, then go and delete complete or uploads. re-start the PC and check the signs. If none appear, :D. However, if they do appear, i'm afraid i cant help.... :(


I hope that this helps. If you have had the virus for a while, it may be slightly harder to get rid of the whole virus. Just keep looking through your system. Filefind is a wonderful tool ;)

GOOD LUCK

FuriousPanda

hey

i'm having the same problem than nigel. can't find task manager exe file. didn't find taskmgr.exe but taskman.exe, is it the same thing ? help fast

not working
 

hey, can't seem to launch the task manager exe even after the copy-paste process.When i double-click it, it just loads for like half a second and nothing happens. what should i do ? i'm doing this with the taskman.exe... aren't taskman.exe and taskmgr.exe the same thing ?Am i using the correct file ? really need help fast. thanks

oh...and i tried restarting. nothing changes. still the same crap

Are you having the problem with LW popping up all the time too? My best advice would be to go to Norbiesworld (click on link below). He sees this problem a lot & will be able to help you, it's all free. If you go to his site & register, follow the directions for free computer help. Download Hijackthis & post the log in the Viruses, Trojans, Spyware section of his forum.
Norbiesworld

Help!!!
 

HI, I cannot find the taskmgr.exe file. I have found numerous system32 files but its not in any of them. I cant find the cmd.exe file either. Limewire is realy beginning to get on my nerves, the thing just wont stay off!!