Limewire Acting Wierd (PLEASE HELP!!!)

[bugmenot]

First, thanks to everyone for all the help here.
For me it wasn't "winupdates" it was a file called
"MSMOVIES" located in the prefetch folder. Good luck.

[st3alth]

didn't fit...maybe i'm too stupid...or did mistakes at translating from english to german...but wayne... i couldn't find any process that takes quite 100% of my CPU. next my taskmanager doesnt open anymore by hitting [Strg]+[Alt]+[Entf] (normal key combo for opening t.) and there's a program calld xz, i cant delete... whatever i do it's already there again =/... plz if anyone knows a solution (maybe in german too :] ) HELP ME...after kazaa now lime wire is going to mess up with my computer...(maybe it's a curse)

[topcop999]

Its a virus, simple as that.

It also prevents you running Taskmgr.exe (Task manager) or regedit.exe (Registy editor)

Fisrtly in search your computer for msmovies.exe and delete it.

Then search for regedit.exe and run it.

Within regedit, highlight My Computer and click Edit/Find msmovies.exe It'll probably be in the C:\WINDOWS\Prefetch folder

Delete any entries which make reference to this file msmovies.exe

I have heard of a user who has had a similar problem with another file called winupdates.exe which again was a virus sitting in the memory designed to keep re-loading Limewire.

No doubt there will be more and with different names now, sooner or later.

The easiest way is to open task manager and if your computer wont run it search for taskmgr.exe, run it and try removing one task at a time, then close Limewire and give it 30 seconds to see if it re-loads before removing another task. This way you will identify the name of the offending program. Then look for this offending program in C:\WINDOWS\Prefetch and other locations if it is not there. Then delete it.

See it's simple good old fashioned computer detection work, so all you Computer Geeks stop rattling on about JAVA updates, internet options and other bollocks that doesn't work but just sound complex and posh.

You can do this in safe mode if you desire but I didn't and it was ok and now problem free.

Alex Nisbet

[joe_danger]

Hello, i had the same problem as many of you, maybe this helps you in some form:

As you know, it was a virus, and that virus was installed because a file that was downloaded from a p2p program, like Kazaa, Limewire, etc. it seems that supports many of them.

When someone is infected by that virus, it makes a search, trying to find the Shared folder of one of the p2p programs supported and places a dummy file in that folder. The name of the file is obtained frow the names in warez pages, like phazeddl.com and others, and makes a zip file with a setup.exe file inside with a size of about 700kb or more, and because it is in shared folder, it is downloaded by members of the p2p programs.

If you download one of that files, and execute setup.exe it opens a dummy installer that sends an error to make the user that it wasn't installed, but in that moment it installs the virus and that installs a process, in my case it was winupdate.exe if i remember well.

Also the virus changes taskman.exe for a dummy file, that why you can't use Ctrl. + Alt. + Supr.. And creates some dummy com files for many common commands, like ping, regedit, etc. (about 10 in total). This is because when you call a program without the extension (.exe in this case) it executes the one with more precedence (.com haves more precedence than .exe), so when you try to execute one of this commands, it executes a dummy file, that does nothing.

Also as you have seen, it executes limewire every 15 seconds or so, so basically the computer begins to be full and slow.

THE SOLUTION (for me)

First, i changed the name of the Limewire was installed (to Limewir) so the virus could not execute limewire.

And easily enough, it was removed using Microsoft Anty Spyware Beta (last update). It detected the trojan and restored my taskman.exe file.

After that, i removed the .com copies(dummy's) of the command files the program installed.

And finally renamed my limewire folder and checked the shared folder to see if a file containing the trojan was created.

Maybe this can help you, i'm a Computer Systems Engineer and have experience with computer since i was 5, but this trojan was one of the most annoying things i have seen.

In internet you can find more information, using the name winupdates.exe and doing a google search.

[xX_JIMI_Xx]

Hi,

I think I have the same problem. Ive followed the instructions provided and I've copied taskmgr.exe, but its not allowing me to paste it to the desktop. What's wrong?

Also, I ran a search and found winupdates, so cant I just delete it?

Other people on here are also saying that Ctr-Alt-Del doesn't work, but for me it does.

This problem started this morning for me, and whe, I turned my computer on, I had to restore my active desktop, however I can't do that. When I clickon 'Restore my active desktop' nothing happens. Am I experiencing the same virus?

This is what I see when I press Ctr-Alt-Del:



EDIT: Also, what does this virus actually do? Is it just a really annoying few little things that can be aparently sorted, or are there more serious affects?

[joe_danger]

Hello, it seems that the virus is only annoying and it sends itself to other people when it makes copies of it in the shared folders of many p2p programs. Also i read that it connects with a web page (don't remember the page) and can download other trojans. At least it didn't manage to do some damage in my computer, but i don't know for certain if it can do something.

To remove winupdates you need to avoid it from loading when you restart your computer or to use anti spyware software (like Microsoft Anti Spyware beta) so they detect the trojan and remove it from memory.

It seems that it is the same virus, but i don't know about your problem with active desktop, it wasn't my case.

As i said before, using Anti Spyware, the virus was detected and removed and after that i remover the directories and files created by the virus(you can check them in my other post).

It's a very annoying trojan. It took me about 2 hours to remove it (i didn't know anything about it), but at least it didn't remove any files or made another type of damage.

I hope this helps you.

[jmk17]

I started 2 follow the Task manager method etc. but their was no process called winupdates or any thing using 100% except for system idle process at 95% and i still kept getting the error message

wat do i do now?

[meggiepooh]

I have gotten my task manager to open but no process other than system idle are using any of my cpu. I can't find the virus and now that I have uninstalled LimeWire my computer keeps trying to open it and it won't let it. How do I fix this? I have been trying now for the better part of three hours. I don't know what other process it could be other than winupdates.exe, which is not showing up. I am getting so frustrated with this and desperately need to know how to eradicate the problem before I can log off. Please any other advice?

[joe_danger]

Try using the Microsoft Antispyware as i said before. It was effective in my case, i only had the virus for about two hours and is very annoying as you say. Since i removed the virus, i haven't seen any problem related. Check my posts in this thread to see if they help you.

[ljuk67]

To update everyone - I recommend to surf through all threads related to this issue - you'll find different versions of this virus, different names (for me it was winlogi.exe (yes, without the "n" at the end )

just try to search the threads for virus or problem etc.

there's tons of stuff for this topic!

Lukas