LimeWire Starts Without User Authorisation

[masire]

Hey Guys

I have a problem (as you could probably guess), i'm running LimeWire 4.9.33 at the moment and all of a sudden it won't allow me to close it down completly. It keeps restarting itself and even when I uninstall it, it keeps giving me a Java window saying that it can't find a file and thus it must be corrupted etc etc.

Any help would be greatly appreciated as it is really starting to hack me off.

Thanx Again

Masire

[6_pac]

It's a virus. LimeWire continually Popping up & also Opening at System Startup

Good luck.

[deacon72]

Here is the virus brigade. Try this.
http://housecall.antivirus.com/house...tart_frame.asp

[topcop999]

Its a virus, simple as that.

It also prevents you running Taskmgr.exe (Task manager) or regedit.exe (Registy editor)

Fisrtly in search your computer for msmovies.exe and delete it.

Then search for regedit.exe and run it.

Within regedit, highlight My Computer and doe Edit/Find msmovies.exe

Delete any entries which make reference to this file msmovies.exe

I have heard of a user who has had a similar problem with another file called winupdates.exe which again was a virus sitting in the memory designed to keep re-loading Limewire.

No doubt there will be more and with different names.

The easiest way is to open task manager and if you computer wont run it search for taskmgr.exe, run it and try removing one task at a time, then close Limewire and give it 30 seconds to see if it re-loads before removing another task. This way you will identify the name of the offending program.

See it's simple good old fashioned computer detection work, so all you Computer Geeks stop rattling on about JAVA updates, internet option and other bollocks and get your logical heads on!

Alex Nisbet

[DarkSorrow]

Originally posted by topcop999
Its a virus, simple as that.

It also prevents you running Taskmgr.exe (Task manager) or regedit.exe (Registy editor)

Fisrtly in search your computer for msmovies.exe and delete it.

Then search for regedit.exe and run it.

Within regedit, highlight My Computer and doe Edit/Find msmovies.exe

Delete any entries which make reference to this file msmovies.exe

I have heard of a user who has had a similar problem with another file called winupdates.exe which again was a virus sitting in the memory designed to keep re-loading Limewire.

No doubt there will be more and with different names.

The easiest way is to open task manager and if you computer wont run it search for taskmgr.exe, run it and try removing one task at a time, then close Limewire and give it 30 seconds to see if it re-loads before removing another task. This way you will identify the name of the offending program.

See it's simple good old fashioned computer detection work, so all you Computer Geeks stop rattling on about JAVA updates, internet option and other bollocks and get your logical heads on!

Alex Nisbet

you didnt even tell him to go to safe mode first....

[topcop999]

You don't need to use safe mode in this instance

[kmag]

The problem with manual disinfection is that the latest variant of the AN/Alcra worm (variant D) installs Spybot.

"Gee I gosh reccon this will fix it" isn't good enough for my friends and family, and I hope it's not good enough for yours either.

Spybot listens on an IRC channel for stuff to download and run without the user's permission. It's nasty spyware that allows
the maker of the D variant to take over your computer.

Please encourage people to run real virus removal programs from the experts, followed by real spyware/adware removal tools from the experts.

Originally posted by topcop999
Its a virus, simple as that.

It also prevents you running Taskmgr.exe (Task manager) or regedit.exe (Registy editor)

Fisrtly in search your computer for msmovies.exe and delete it.

Then search for regedit.exe and run it.

Within regedit, highlight My Computer and doe Edit/Find msmovies.exe

Delete any entries which make reference to this file msmovies.exe

I have heard of a user who has had a similar problem with another file called winupdates.exe which again was a virus sitting in the memory designed to keep re-loading Limewire.

No doubt there will be more and with different names.

The easiest way is to open task manager and if you computer wont run it search for taskmgr.exe, run it and try removing one task at a time, then close Limewire and give it 30 seconds to see if it re-loads before removing another task. This way you will identify the name of the offending program.

See it's simple good old fashioned computer detection work, so all you Computer Geeks stop rattling on about JAVA updates, internet option and other bollocks and get your logical heads on!

Alex Nisbet

[6_pac]

Originally posted by joe_danger
Hello, i had the same problem as many of you, maybe this helps you in some form:

As you know, it was a virus, and that virus was installed because a file that was downloaded from a p2p program, like Kazaa, Limewire, etc. it seems that supports many of them.

When someone is infected by that virus, it makes a search, trying to find the Shared folder of one of the p2p programs supported and places a dummy file in that folder. The name of the file is obtained frow the names in warez pages, like phazeddl.com and others, and makes a zip file with a setup.exe file inside with a size of about 700kb or more, and because it is in shared folder, it is downloaded by members of the p2p programs.

If you download one of that files, and execute setup.exe it opens a dummy installer that sends an error to make the user that it wasn't installed, but in that moment it installs the virus and that installs a process, in my case it was winupdate.exe if i remember well.

Also the virus changes taskman.exe for a dummy file, that why you can't use Ctrl. + Alt. + Supr.. And creates some dummy com files for many common commands, like ping, regedit, etc. (about 10 in total). This is because when you call a program without the extension (.exe in this case) it executes the one with more precedence (.com haves more precedence than .exe), so when you try to execute one of this commands, it executes a dummy file, that does nothing.

Also as you have seen, it executes limewire every 15 seconds or so, so basically the computer begins to be full and slow.

THE SOLUTION (for me)

First, i changed the name of the Limewire was installed (to Limewir) so the virus could not execute limewire.

And easily enough, it was removed using Microsoft Anty Spyware Beta (last update). It detected the trojan and restored my taskman.exe file.

After that, i removed the .com copies(dummy's) of the command files the program installed.

And finally renamed my limewire folder and checked the shared folder to see if a file containing the trojan was created.

Maybe this can help you, i'm a Computer Systems Engineer and have experience with computer since i was 5, but this trojan was one of the most annoying things i have seen.

In internet you can find more information, using the name winupdates.exe and doing a google search.

Thought it might help
It's from another thread on the same subject: Limewire Acting Wierd (PLEASE HELP!!!)