I started following the Help steps that "kc0rkx_finch" has posted but have a few problems with this.

1. Can't find any files with "Winupdates" in the name

2. Don't have any process except System Idle Process running at almost 100%

BUT i still can't use Ctrl+Alt+Del i.e Task Manager

Any ideas?

OS - Win XP

(OS WinXP Pro)

Ok, so i had to sit and watch LimeWire popping up while i didn't want it to. Very annoying. So read it had to be a virus. The following was what i did to get rid of it:

1. Make sure that every folder displays everything that is actually IN the folder. (See the first thread in the forum from kc0rkx_finch. http://www.gnutellaforums.com/showth...hlight=WORM%2A )

2. Run a scan with TrendMicro. It's free and it's good. I only
scanned the following maps of which i suspected could hold the virus: c:\windows, c:\documents and settings and c:\program files. It is much faster than scanning your entire PC. Though i recommend to do it after all done.

3. Copy taskmgr etc etc to the desktop (see the first thread)

4. Remove LimeWire with in the software configuration.

5. Search your PC for everything with LimeWire in it and keep that window opened (see 6). There still will be files with limewire in it even while it has been removed.

6. Start taskmgr from your desktop (NOT via Start)

7. Kill LimeWire and delete all files containing the name LimeWire.

8. Kill the infected files found by TrendMicro (if running)

9. Relocate the infected files to your desktop. (Mine was MsUpdate.exe and a few alike). You can also delete them i guess but i read something about donating them to norton for helping them out...

10. Reboot.

After everything above has been done you should be 'virusfree' and LimeWire will no longer be popping up. I must say this is how i got rid of it and i hope i didn't leave anything out. Don't forget to run another scan with TrendMicro.

Hope this will be of some help.

greetz,

EZ DC

edit: I forgot to mention to reinstall LimeWire


Edit: Ssquiffy, my system resources were also available for more than 98%. Doesn't say you don't have the virus!

10) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

11) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.



You know, I followed directions to a T, now my System32 is MISSING and WHERE the hell is C:windows\regdit.exe? Huh?

Real nice program. Slows everything up, takes DAYS to download and some ******* attaches a WORM to it!

NO THANKS

Tigerlily, You can not find your system32 because it is a hidden folder. In the first thread by kc0rkx_finch is mentioned the following:

3)Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

4)Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

Did you do those steps also?

The missing regedit.exe i can not explain but try and search your pc for the file (If you allready didn't do that, that is).

For TrendMicro: I don't understand. I have an ADSL connection and installing the files for TrendMicro didn't take all to long. And i completely don't understand the WORM story. Where did you go to to download TrendMicro??? And how did you find out a WORM was attached?

grtz

I recieved some pop ups from MangnetMix.com and from Bitzi.com then after that Limewire opened up 10 times with 10 Limewire icons displayed in my task bar I thought these were safe sites I am doing virus scans and spyware scans couldn't find Winupdate at all any help would be appreciated thank you

Man I dont know. I followed the instructions on here and still have the popup and VERY SLOW computer problem, so I uninstalled limewire and that java program, I think that java program is the worst thing ever invented. Jeez. Im tired now, but I will take a look at this again over the weekend and let you know what happens. But man, what a hassle, WinMX never did this to me and I used it for a couple years. They should find the *** that attached the worm to this. I guess its a trojan? horse, whatever its still BS. Is there a diff?

BeerBottleBill, Did you follow the instructions by kc0rckx_finch? That should get rid of the annoying limewire popping up every 10 secs. And by the way, i had something called MsUpdate.exe not WinUpdates.exe so it can have a different name.

TigerLily, Try to copy the taskmgr to your desktop if you can't open it normally ( CTRL-ALT-DEL ).
Then kill the process that's taking up all the resources (90+%). (That should give you a better performance and thus a faster PC. Then you can continue with the other steps mentioned in this thread.) When the process keeps starting itself up, find the process on your pc and replace/remove it. I had the luck i didn't have such a process but i did have the popupvirus. After replacing the inected files i didn't have the problem anymore.

Hope to be of some help.

grtz

Thanks darlin. I followed your instructions and there were no processes taking up that much resources. I already uninstalled limewire and java and all their files and everything seems fine now; except for the missing files I already mentioned. Havent had time to play with that yet though. I am afaid to re-install LW and of having the same problem again. Its really trying my patience, lol.

Ok I'm a bit confused here, I followed what kc0rckx_finch wrote but:

1. there are no winupdates files in c:\windows\prefetch

2. I still can't open taskmgr with ctrl+alt+del, I opened taskmgr the way kc0rckx_finch said, it worked, the only process taking up the most CPU was System Idle Process so does that mean I have to end it? For some reason I can open regedit normally but not taskmgr

3. limewire still tries to open every few seconds...

I can't beleive I paid for this virus!!! What the F*** was the creater thinking? Sheesh, I tried everything to fix it on this post, but it still keeps popping up.