How to get limewire to quit popping up every few seconds
 

1) Create a system restore point
Start>Allprograms>accessories>system tools>System restore
Follow on screen instructions.

2) Go to the following directory and delete any file with winupdates in the name. Do not be fooled this is not the actual windows update stuff its a virus. i know that might be hard for some of you to believe but i had it and ive got more than one virus scan which none picked this up.

c:\windows\prefetch

3)Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

4)Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

5) Uninstall Limewire. You can reinstall it at the end of these steps.

6) Disable System Restore in Windows. This can be done by right clicking on My Computer, selecting Properties, and then clicking on the System Restore tab. Then check the box Turn Off System Restore. Hit Apply, and then OK. If you are prompted to restart Windows, do so.

7) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

8) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

9) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

10) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

11) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

12) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

13) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

14) click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

16) make sure to go back into the System Properties by right clicking on My Computer, and unchecking the Turn Off System Restore box under the System Restore tab.

17) Now restart your computer. Reinstall Limewire

18) create a restore point after you have removed the virus. Then delete all but the latest resore points. Heres how.

To delete all but the last restore point you made
1) Right click on C:/ in My Computer
2) Click Properties
3) Click Disk Cleanup
4) Click Tab <More Options>
5) Under System Restore Click <Clean up...>

by the way, deleting restore points is OPTIONAL
and did because they will actually contain the virus file and if you restore to one of the infected points, Congradulations you're reinfected.

I think that pretty well covers it. if you find any mistakes please post here and i will correct my error. i have read through this like 10 times already though so i know none of the errors will be computer fatal errors. heck i did it on my own following these instructions which are actually from a guy in another post here. i copy pasted. Thanks Bobby Naini. youre a genius and i give all credit to him. I take none for my own. Bye and good luck.

Please send a copy to ant-virus labs to help stop this virus
 

[New Info]
This is malware has been identified as
Worm.Win32.VB.an, the "AN Worm", sometimes called the "Zodiak Worm".

I was able to obtain a sample of this malware. I got free trial versions of both Norton Anti-virus and Kaspersky Anti-virus from Downoad.com.

Norton's 6/22/2005 virus definition library misses this malware.

Kaspersky catches it and quarantines it.

http://www.download.com/3120-20_4-0.html?qt=kaspersky

Let us all know if you find any other anti-virus scanners that catch this worm. It might be a new variant, because Norton's website claims they've been able to catch this worm since October 2003.

[End of New Info]

I sent an email to Kaspersky Labs antivirus yesterday about this virus and got an email back from one of their virus analysts. However, I haven't been infected and so I wasn't able to provide them with a sample of the virus.

If you'd be so kind as to help prevent others form getting this virus, please make a password-protected zip (or rar) file containing any viral files you are about to delete. The password should be "infected" and it should be mailed to NewVirus@kaspersky.com, with a subject of KLAB-571146.

It's my understanding that the major anti-virus labs have informal agreements about sharing new viruses with eachother.

If you're extra motivated to help stop this virus, TrendMicro anti-virus has a web submission form at http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7 . Presumably TrendMicro wants the winupdates file instead of the password protected zip file.

Unfortunately, it looks like Symantec/Norton Anti-Virus requires you to use Norton Anti-Virus to send in samples instead of using plain old email. If you have Norton Anti-virus, please by all means use Norton Anti-virus to send Symantec/Norton a copy of winupdates.

McAfee Anti-virus's website gives me the impression that there's no way for the average person to send them samples of suspected viruses.

Sorry
 

If there is anyone out there who hasnt gotten rid of this virus yet, please be so kind as to send the files to this guys people. I cant as i already got rid of it. If i do ever get reinfected with it i will send them out but i cant. To do this, instead of deleting all of the files as stated above simply copy them into a new folder on your desktop and THEN delete the originals. I dont know if you can do that with the registry stuff though. :( Im sorry i had already gotten rid of the stuff but it ate up my printer stuff and everything. I wish you had said something sooner. I will be glad to send these instructions though if that helps. Let me know if it will. I dont have Norton as i hate it for crashing my dads system and putting me through h-e double hockey sticks and back. It took me 40 hours of recovery work to get that system back and it was right after i got norton on it. Im sorry i cant help other users that like it though. I have Etrust. I know nothing about sending virus info to them though. If oyu find anything out please feel free to post again, pm, or even email me at my username (kc0rkx_finch) at yahoo.com SORRY i cant be of anymore help!!

OMG YEAH!
 

I got rid of it! it was annoying me to HELL!
no taskmanager was driving me NUTZ, plus all the cpu usage and stupid popups. and the fact that it was so hard to make it f*** off =) THank you so mutch for helping :D

141414
 

ok so if i have win2000 what do i do about the restore point and the prefetch folder. they dont exist on 2k?

im glad these instructions helped somebody. I will try to get some 2k info soon and let you know. same for win 98 users I might not be able to do win 95 but ill try

At step 2 , c:\windows\prefetch , I do not have any files with winupdates in the name.

At step 7 , c:\windows\system32 , I do not have any files with .exe in the name.

Thank you for your continued support.

the taskmgr file will not have .exe at the end of it on win xp. it will just be called taskmgr. If you doi not have any of those files in the prefetch folder the the virus may not have progressed as far as it had on mine and bobby naini's systems. You should be okay there


Im still trying to find a win 2k pc and have not had a chance to get on one yet. I will try to find one soon and reply.

Tattoowayne, For your sake i hope to god im right on this. Is windows 2k generally the same format as win98?? If it is i have a win98 pc that i could use but the only 2k pc i can find is at my office and its 2kpro. Plus if i start screwin around on it and f*** somethin up then im out on my @$$. If 2k is like win98 ill get some info tommorrow. For those who want to send the viral info to the people mentioned above by anohter party the instructions are coming soon. I am having a little trouble re-configuring the entire instruction sheet but im working on it. Thank god i have these two weeks off from work so i can "work" helping you guys out. Its kinda fun though. Makes me regret not going into a computer type job. I guess i could switch though im still young ( at heart). Also please post your system specs for me. I have an odd idea but it just might work if your system is "up to snuff enough"

also please see the poll on this forum and vote. Its very important and could help us convince all of the antivirus folks to get an "antidote" out in their software. Please choose two.

http://www.gnutellaforums.com/showth...threadid=39696

I DID IT I FINALLY F%$#%ING DID IT! ON A WIN2000
 

Ok so heres how i did it. THIS IS HOW I DID IT ON A WINDOWS 2000 BASED COMP.


1) Go to the following directory and delete any file with winupdates in the name. Do not be fooled this is not the actual windows update stuff its a virus. i know that might be hard for some of you to believe but i had it and ive got more than one virus scan which none picked this up.

c:\

2)Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

3)Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

4) Uninstall Limewire. You can reinstall it at the end of these steps.

5) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

6) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

7) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

8) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

9) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

10) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

11) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

12) click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

13) Now restart your computer. Reinstall Limewire

AGAIN THIS IS HOW I FIXED MY WINDOWS 2000 BASED COMP. RESULTS MAY VARY.

awesome job man. Im sorry i coudnt find a win2k based pc to help you out on. For the rest of you i am almost 100%+ this will work on your win98 and 95 pcs too. If not let me know. I have a win98, wi*** and ME pc's so i can for sure help there but this oughta work! Thanks Tattoo dude

YOU ROCK!!!
 

man that wuz mind-blowing!!!

really dude.....that thing wuz a f****in pain in the ***.....it wuz so annoying man!!!

searched on the net and could'nt find any way to fix it!

i dont know how u figured out this thing,but it works like a charm,hats off to ya!really appreciate the time and effort u put in to help us out!

cheerz!

f&^% F&^% F&^% NOW MY WILOGON.EXE IS JACKED
 

EBERY LIKE TEN MINUTES MY WINLOGON.EXE LOCKS AND ASKS IF I WANNA DEBUG. I CLICK OK OR CANCEL AND IT SAYS PROGRAM MUST REBOOT. WHAT THE HELL DID I DO NOW? PLEASE TELL ME THERE IS AN EASY FIX FOR THE F^%&D UP WINLOGON.EXE.

you had 2k right? Q1 You didnt accidentaly delete a winlogon file instead of winupdates did you? Thats kind of what it sounds like to me. If you did, i might be able to find the file that needs to be replaced. Q2 do you have a win2k disk for reinstall? Im not suggesting you need to but i might be able to get the right file(s) off that disk and figure out what you need to re-copy.

Folks. I hope I have been helping you but now i need a little help. If anyone out there has NOT removed this virus yet PLEASE follow the following instructions. Im litterally BEGGING you.

Instead of deleting any winupdate files, PLEASE move them to a new folder on the desktop. This will not work with registry keys so go ahead and delete them. I need files from ALL OS PC'S. After you have them moved, zip the folder. After you zip it, a file with the same name will appear on the desktop. It is okay to delete the FOLDER now. PLEASE email me the file as an attachment. Name it "Windows (whatever you have) Winupdates viral infection) Please include a small text document with the name of all files in the zip folder and where they were located and removed from. This should also be in the zip file i might add. After you email it to me, follow this link. Enter all info and upload that same file to them too. Then it is okay to delete the file. This will still work just as well as the original instructions but now we ought to start getting Norton, McAfee, and Etrustt updates to remove this virus automatically. At least i hope. Link 1 is for submitting the file. Link 2 is where i need ALL of the people who used these instructions to go and vote on these instructions. You might add a post at the bottom of Link 2 to say what OS you had too. Thank you for helping me out here. I hope I have been of help to you guys and now I hope you can help me.

Link 1 http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7

Link 2 http://www.gnutellaforums.com/showth...threadid=39696

damn damndamn
 

no disc 1st of all. friend of a friends built the comp so he wants to charge me 40 buks to completely reinstall windows 2000. there has to be an easier way. as far as the winlogon.exe file, i am pretty sure i only deleted 3 files from the search of c:\, all3 named winupdates.whatever. then i deleted possibly 7 - 9 reg entries in regedit. all named winupdates.* then the F3 next came up with nada. so i rebooted and then i got the shutdown message. it seems to be happening less frequently now but i am gonna try windows update to see if it catchs any loose wires. any help on that complete winlogon.exe file would be greatly appreciated because i am pretty sure i can just copy and paste it into the existing location.

Cut the crap. The only serious and reliable way to remove a virus or worm is a complete reinstallation of your operating system. You didn't write the virus/worm (I assume) and therefore you have no way to tell what it does or what variants might exist.

What you are doing is treating symptoms.

I also found a hidden folder called Complete under C:\Documents and Settings\Your_User_Name that appeared to contain all the files that contained the virus. If this is indeed how the virus is spreading then everyone who had the virus needs to make sure to go to the library and stop sharing the Complete folder.

tattoowayne - if the real windows update does not do the trick i have a utilities disk i could copy for you. It is a miracle worker and just might work. If not i CAN get you a complete install win2k disk for free and 100% legal its NOT piracy. you just have to make sure you have a win2k key which you should. if you dont, talk to that guy who did your pc and if he wont give you one for the computer, which he HAS to legally, threaten to sue him, which you can. I hope the actual windows update site will work though.

i_have_no_account - for right now treating the symptoms is all we can do. And thats a load of bull about re-doing it all. I have removed many viruses in my days and ALL of the pc's ive done it on have the originally installed OS on them and are working perfect. so please keep your **** out of this forum where we really want to help people and not **** them off like you have me.

Guest With A Theory - yes if this folder does contain viral files not only should they be deleted but it is a good idea to stop sharing them over the gnutella and any other network your using at this time.

And PLEASE everybody go to that poll and vote as well as email me those files and the other people those files as stated in an earlier post. Thanks

kc0rkx_finch, your incompetence is neither appreciated nor will it be tolerated. People like you a security problem for the society. You, my dear friend, are not helping anyone at all. You may even cause serious trouble. Either you do not have any clue at all what you are talking about or you are actually spreading dangerous false information on purpose.

And no, whether people have a key or not, you have absolutely no right and no legitimation to copy Microsoft Windows 2000 installation media. What you are suggesting is clearly copyright infringement.

Furthermore, stop encouraging people to send you some of their files or run dubious programs of yours.

HELP!!!!
 

i followed all of your directions (which were very helpful, thank you) up to where i have to open regedit.exe. i copied it to the desktop, but when i double-click it a window that looks like the command prompt opens for a fraction of a second and then closes, and no window opens where i have to do all of the stuff with finding references to the bad file. What do I do???

Bussinator - Okay, try re-copying regedit to your desktop. If that doesnt work, open LW and look for the following file.
" 125894 regedit for LW prob "
That is a copy of MY regedit file, i imagine yours has been corrupted somehow. Just use doubleclick it after it opens up and follow the instrucions as posted.

I_have_no_account -

1. It is 100% perfectly legal to copy the install disk for ANY windows Operating System. If you have purchased a key for Win2k, why the crap should you have to fork over more money for another disk and another key which you dont need!!! I have been told by our local computer techs, which is where i got the disks, that its legal to copy the program but i cant give you a key. Eat that!
2. Quit falseifying the information that has been given here. For one I did NOT wrrite this info, Bobby Naini DID. I have posted that in the original instructions if only you were smart enought to read them. He knows i have used it here and kind of took over so dont throw copyright infringement in my face for that too! If there were some way i could ban you from posting here i would because you apparently have NO CREDIBILTY whatsoever. Look at all the other people here who have used these instructions and are happy with the results. As far as i can tell you are the only one who (A) hasnt used them at all and yet (B) youre knocking them before even trying them. I dont know who you think you are coming here and telling everyone that you have to reformat a hard drive to get rid of a virus when really you just sound like an amatuer who knows absolutely nothing about pc's and just wants to annoy people. What do you think antivirus systems do, tell you they removed the virus and reformated youre hard drive without youre knowledge. NO!!! they simplify the process of removing viruses by doing everything we are doing here in an automated process. Only thing is antivirus companies miss stuff too and turns out this one hasnt spread enough for them to notice it yet so thats what were trying to prevent. If you want to say something to me or cuss me out go ahead. Either get yourself kicked off of here or do it in private where innocent bystanders who dont give a hoot dont have to read it too. Please feel free to email me with all the 4 and 5 letter words you want. Id be more than happy to read it. If you really think you actully have some credibility at least ry helping the people here instead of hurting them.

All - sorry bout that little spat but scum like him make me angry. Anyway, please as i have posted before go to the other forum (link above in another of my posts) and vote on the instructions given here. You might also send BoobyNaini a PM and tell him thanks for writing the original instructions. Cya

kc0rkx_finch, you're like these wonder doctors you claim they can heal even cancer and tell their patients that they do need to go to a hospital. Unfortunately, you cannot "reinstall" a human's software or hardware. It's very easy to do this with a computer and it's the only reasonable way to get rid of an infection.

I do not need a single bit of credibility as I'm not telling any fairy tales or things you-just-have-to-believe. These are nothing but hard facts and the plain truth. If you don't trust me ask an independent expert - not some script kiddie or someone working for an AV tool vendor.

Giving a recipe without even diagnosing the problem at hand is anything but respectable.

Regarding the Win2k CD: No you have no permission to give away copies of the installation media. In any case, you'd have to check whether the receiver has a license first and that's something you cannot do. If you so certain about your words, then share the Win2k on Gnutella or put in on your web server. Only people with a key will be able to use it, right?

I'll give you a hint: The key is only half-baken technical protection because many people do not care about copyrights and copyrights only work in the court not in the wild.

There are also different license models and Windows versions. For example, if you have a OEM version, you have no permission to use the server version etc. Your offer is highly questionable in any case - even when you ignore the copyright issues. At least, I don't install operating systems
- or any software whatsoever - offered by anonymous random people at a web forum.

"AN Worm"
 

This is malware has been identified as
Worm.Win32.VB.an, the "AN Worm", sometimes called the "Zodiak Worm".

I was able to obtain a sample of this malware. I got free trial versions of both Norton Anti-virus and Kaspersky Anti-virus from Downoad.com.

Norton's 6/22/2005 virus definition library misses this malware.

Kaspersky catches it and quarantines it.

http://www.download.com/3120-20_4-0.html?qt=kaspersky

Let us all know if you find any other anti-virus scanners that catch this worm. It might be a new variant, because Norton's website claims they've been able to catch this worm since October 2003.

I've submitted a sample to Norton.

TrendMicro's webserver gave me an internal error when I tried submitting it via their web form.

Sounds like were almost done here. If you would rather not follow the instructions and use the virus removal tool go ahead it should work just as well. Im glad its beggining to get caught and removed by antivirus companies. For some reason i think ive been hit again, My firewall has been crippled. I cant change any settings on it. as for I_have_no_account. Im not even going to bother answering you anymore. You havent a clue what youre talking about so just leave me alone. I will not answer you anymore and any emails you send will be treated as harrasment. It sounds like this forum thread is not going to be needed anymore anyways. Cya guys l8er and im glad i was able to help someone. Cya

kc0rkx_finch, I've never ever sent you any mails nor will I do so in the future. Why would I?

I know, it can be painful to realize that well-done and well-meant are quite different. It is very common to give well-meant advises which seem to be useful and may actually work sometimes under the right conditions. Unfortunately, such advises come with bad side-effects like causing a false sense of security, confusing hacks with The Right Thing(TM), ignorance of reasonable concepts to keep your computer safe etc. Like usually, The Right Thing(TM) is often less comfortable than some botch but in the long run the former is a clear winner.

It's too bad that these pseudo-experts are ubiquitous all over the web. You can't fight them all without becoming a modern Don Quixote. This is really bad because it'll spoil the majority of people. Most people know very little about computers and how to use the internet properly. You cannot blame them at all because nobody teaches them. We're living in the mediaeval times of computer technology and people have more trust in computer "religion" than computer science. Virus scanners and other snake oil is the modern incarnation of excorcism.

WRONG
 

KASPERSKY CAN AND WILL NOT DETECT THIS HIDDIOUS WORM. FORGET IT. IF ANY OF YOU CANNOT FIND ESSENTIAL FOLDERS, IT'S BECAUSE YOU XP'S DEFAULT SETTING TO "HIDE" THESE FOLDERS IS ACTIVE. CHOOSE "SHOW" AND YOUR IN.

I_Have_No_Account

You need to just stay out of this forum. kc0rkx_finch just helped me get rid of a virus and a problem on my computer. Everyone is trying to help everyone in here. Why even bother to come in here and start problems? I guess no one will ever know. But please if you dont like what we are doing then stay out of here. Thanks again kc0rkx_finch.

Ok First of all I_ Have_No_Account F*** YOU!!!!!!!!!!

All you want to do is come in here and start something
And nobody wants to here what you got to say. :p


OK:D Now Thank you very much kc0rkx_finch and BoobyNaini you have helped saved me a great deal of trouble and by the way I_ Have_No_Account. THIS PROCESS WORKS JUST FINE
You are the one who is providing false information on things that are not even required for you to do to get rid of this thing.

So I thank those who have taken the time to find out how to get rid of this problem.

And as for you (I_ Have_No_Account) How bout you find yourself a different street corner to stand on.

AARomulus out............................................... .....................

My Limewire kept opening over and over, so I found this place and tried to fix it, but it isn't working.

I uninstalled Limewire but my ctrl+alt+delete isn't working, which makes me think that I have a virius. I'm really not very good at these type of things. It hasn't been long since this happened. It has only been a day, so I really want to fix this before everything gets screwed up.
(I'm on windows xp if that means anything to solving this problem)

I cannot find anything with "winupdates". I got that taskmgr onto my desktop and when I open it the system idle process is the only thing running at high cpu.
I can't find "c:\windows\regedit.exe", but I did find "c:\windows\system32\cmd.exe" so that is on my desktop for when I need it.

Someone please help me!!
-Diana

You probally have a virus the link below should help.


http://www.gnutellaforums.com/showth...threadid=41432

Where did this thing come from anyway? Was it embedded in the 4.9.30 update?

Some times I just have to Laugh :p :p :p


Check out the link below


http://www.gnutellaforums.com/showth...threadid=41432

I've already seen that. That's how I got here.

I'm not sure why you thought that would help me. It brings me here, where I asked the question, for you to direct me back there.

And as I wrote I'm not good at these things so half the things on that page talking about the virius I don't understand.

My computer seems fine now. I ran Norton Anti-Virius, and Ad-Aware a few times. Once the computer was turned on for the day today it has been fine and ctrl+alt+delete are working now.
My music volume isn't showing on the screen but I doubt that has anything to do with this.

Dianer7

That link was to explain to Searu where the viruses come from but I am guessing you are Searu. The Viruses do not come embedded on limeWire you download them from the network when you are download files. If you read the link and the off shots in it you would have figured that out.

Like I said some times I just have to Laugh.:)

You replied with the same link to my post. Thanks.

HELP!
 

I have just downloaded limewire and downloaded my first music file... and i know this may sound stupid but i can figure out how to get it onto i-tunes so i can put it on my i-pod. Can anyone help me coz im desperate! please?

Strange place to post you Question totally off topic you should at least have found a thread that was along the same line of question.

Any way the link below might help.


http://www.gnutellaforums.com/showth...threadid=36230

I FOLLOWED ALL THE INSTRUCTIONS BUT.....

i still get those 6 or 7 same old popups all the time.. they even try to pop up when the net is disconnected.. any suggestions?

Ok ok ok.
I havent got rid of the virus yet!!!!
My problem is that i cant find a file with winupdates in it in the prefetch folder.
And also too when i got to end the system idle process in task manager, it will not let me!!!
HELP ME!!!

IF anyone wants a sample of it, i know a file that containes the virus.
In limewire, search for the 'program' 'snes emulator'!!!
It is 852kb, same as the virus, it is zipped and it is exe.
this contains the virus!!
If you try browsing the host it wont let you so it does not give a IP address.

PLEASE HELP ME!!!

I think I may have found another file name for the infected firus file.
In the instrunctions it says delete anything with winupdates in it.
I have a file called aupdate.exe that was created the same day as i obtained the virus. Could this be the file?

mune was winupdater.. not winupdates

Hey i found out another way to find this virus.
Use avast to scan your computer. Then it has a list of files that could not be scanned, then i got Norton to scan my computer, and it scanned these files avast wouldnt, and those files had virii.

LIMEWIRE RESTARTING
 

I have the same problem as everyone else but when i go to task manager the only thing thats over 90% is SYSTEM PLEASE HELP!

I had to register this forum just to reply to this topic!
 

This totally ROCK!!!!

I have to register to this forum only for replying this topic, I really have to say thanks for letting me know this is actually a virus and helped me remove it.

it was driving me crazy.... performance drop by an insane amount and no Task manager....

God Bless whoever wrote the solution to this problem ;)

I started following the Help steps that "kc0rkx_finch" has posted but have a few problems with this.

1. Can't find any files with "Winupdates" in the name

2. Don't have any process except System Idle Process running at almost 100%

BUT i still can't use Ctrl+Alt+Del i.e Task Manager

Any ideas?

OS - Win XP

(OS WinXP Pro)

Ok, so i had to sit and watch LimeWire popping up while i didn't want it to. Very annoying. So read it had to be a virus. The following was what i did to get rid of it:

1. Make sure that every folder displays everything that is actually IN the folder. (See the first thread in the forum from kc0rkx_finch. http://www.gnutellaforums.com/showth...hlight=WORM%2A )

2. Run a scan with TrendMicro. It's free and it's good. I only
scanned the following maps of which i suspected could hold the virus: c:\windows, c:\documents and settings and c:\program files. It is much faster than scanning your entire PC. Though i recommend to do it after all done.

3. Copy taskmgr etc etc to the desktop (see the first thread)

4. Remove LimeWire with in the software configuration.

5. Search your PC for everything with LimeWire in it and keep that window opened (see 6). There still will be files with limewire in it even while it has been removed.

6. Start taskmgr from your desktop (NOT via Start)

7. Kill LimeWire and delete all files containing the name LimeWire.

8. Kill the infected files found by TrendMicro (if running)

9. Relocate the infected files to your desktop. (Mine was MsUpdate.exe and a few alike). You can also delete them i guess but i read something about donating them to norton for helping them out...

10. Reboot.

After everything above has been done you should be 'virusfree' and LimeWire will no longer be popping up. I must say this is how i got rid of it and i hope i didn't leave anything out. Don't forget to run another scan with TrendMicro.

Hope this will be of some help.

greetz,

EZ DC

edit: I forgot to mention to reinstall LimeWire :D


Edit: Ssquiffy, my system resources were also available for more than 98%. Doesn't say you don't have the virus!

Re: How to get limewire to quit popping up every few seconds
 

10) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

11) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.



You know, I followed directions to a T, now my System32 is MISSING and WHERE the hell is C:windows\regdit.exe? Huh?

Real nice program. Slows everything up, takes DAYS to download and some ******* attaches a WORM to it!

NO THANKS