Ok so heres how i did it. THIS IS HOW I DID IT ON A WINDOWS 2000 BASED COMP.


1) Go to the following directory and delete any file with winupdates in the name. Do not be fooled this is not the actual windows update stuff its a virus. i know that might be hard for some of you to believe but i had it and ive got more than one virus scan which none picked this up.

c:\

2)Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

3)Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

4) Uninstall Limewire. You can reinstall it at the end of these steps.

5) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

6) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

7) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

8) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

9) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

10) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

11) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

12) click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

13) Now restart your computer. Reinstall Limewire

AGAIN THIS IS HOW I FIXED MY WINDOWS 2000 BASED COMP. RESULTS MAY VARY.

awesome job man. Im sorry i coudnt find a win2k based pc to help you out on. For the rest of you i am almost 100%+ this will work on your win98 and 95 pcs too. If not let me know. I have a win98, wi*** and ME pc's so i can for sure help there but this oughta work! Thanks Tattoo dude

man that wuz mind-blowing!!!

really dude.....that thing wuz a f****in pain in the ***.....it wuz so annoying man!!!

searched on the net and could'nt find any way to fix it!

i dont know how u figured out this thing,but it works like a charm,hats off to ya!really appreciate the time and effort u put in to help us out!

cheerz!

EBERY LIKE TEN MINUTES MY WINLOGON.EXE LOCKS AND ASKS IF I WANNA DEBUG. I CLICK OK OR CANCEL AND IT SAYS PROGRAM MUST REBOOT. WHAT THE HELL DID I DO NOW? PLEASE TELL ME THERE IS AN EASY FIX FOR THE F^%&D UP WINLOGON.EXE.

you had 2k right? Q1 You didnt accidentaly delete a winlogon file instead of winupdates did you? Thats kind of what it sounds like to me. If you did, i might be able to find the file that needs to be replaced. Q2 do you have a win2k disk for reinstall? Im not suggesting you need to but i might be able to get the right file(s) off that disk and figure out what you need to re-copy.

hey i cant find anything that's almost near a 100% other than the system idle process. i followed all your steps..i dont know what else to do. the pop ups are still appearing from time to time, and i already uninstalled limewire..please help me asap thanks

Scroll up to a post by Grandpa. Follow the link to Norbiesworld. Register on his site & follow the directions for free computer help. Norbie will be able to help you get rid of whatever nasty is hiding on your comp

Have you seen this sticky about virus probs? It's worth reading (see point 4)
WARNING: Viruses on the network you should be aware of

ooh thanks birdy. sorry i asked the question again =)

Folks. I hope I have been helping you but now i need a little help. If anyone out there has NOT removed this virus yet PLEASE follow the following instructions. Im litterally BEGGING you.

Instead of deleting any winupdate files, PLEASE move them to a new folder on the desktop. This will not work with registry keys so go ahead and delete them. I need files from ALL OS PC'S. After you have them moved, zip the folder. After you zip it, a file with the same name will appear on the desktop. It is okay to delete the FOLDER now. PLEASE email me the file as an attachment. Name it "Windows (whatever you have) Winupdates viral infection) Please include a small text document with the name of all files in the zip folder and where they were located and removed from. This should also be in the zip file i might add. After you email it to me, follow this link. Enter all info and upload that same file to them too. Then it is okay to delete the file. This will still work just as well as the original instructions but now we ought to start getting Norton, McAfee, and Etrustt updates to remove this virus automatically. At least i hope. Link 1 is for submitting the file. Link 2 is where i need ALL of the people who used these instructions to go and vote on these instructions. You might add a post at the bottom of Link 2 to say what OS you had too. Thank you for helping me out here. I hope I have been of help to you guys and now I hope you can help me.

Link 1 http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7

Link 2 http://www.gnutellaforums.com/showth...threadid=39696

no disc 1st of all. friend of a friends built the comp so he wants to charge me 40 buks to completely reinstall windows 2000. there has to be an easier way. as far as the winlogon.exe file, i am pretty sure i only deleted 3 files from the search of c:\, all3 named winupdates.whatever. then i deleted possibly 7 - 9 reg entries in regedit. all named winupdates.* then the F3 next came up with nada. so i rebooted and then i got the shutdown message. it seems to be happening less frequently now but i am gonna try windows update to see if it catchs any loose wires. any help on that complete winlogon.exe file would be greatly appreciated because i am pretty sure i can just copy and paste it into the existing location.