Ok so heres how i did it. THIS IS HOW I DID IT ON A WINDOWS 2000 BASED COMP.


1) Go to the following directory and delete any file with winupdates in the name. Do not be fooled this is not the actual windows update stuff its a virus. i know that might be hard for some of you to believe but i had it and ive got more than one virus scan which none picked this up.

c:\

2)Open My Computer. Select Tools from the menu, followed by Folder Options. Click on the View tab. Make sure that there is a check mark next to the following items:

Display the Contents of System Folders
Show Hidden Files and Folder

3)Now, make sure there are no checkmarks beside the following:
Hide protected Operating System Files.

4) Uninstall Limewire. You can reinstall it at the end of these steps.

5) Now we need to fool the virus into allowing us to open the Task Manager. This can be done by copying the Task Manager executable file from the Windows directory. To do this, go to c:\windows\system32, select the file taskmgr.exe, right click on it, and select Copy. Go to the desktop, and click on an empty part of the desktop. Then right click on the desktop, and select Paste.

6) Double click on the taskmgr.exe file on your desktop. This should open the Task Manager. Click on the Performance tab. If you are in fact infected with a virus, you will likely (although not necessarily) see close to 100% CPU usage!! Now click on the Processes tab, followed by clicking twice on the CPU column header. What this does is order the files running on your computer based on the amount of CPU resources they are consuming in real time. If there is a process, other than System Idle Process, that is consuming close to 100% of the CPU, then it is this process (or file) that is infecting your computer. For me, and likely for a lot of you, that file will be winupdates.exe. Don't be tricked. This is not a Microsoft program. It's a virus masking itself as a legitimate file. Please remember the exact name of this process, because you will need it in a later step.

7) Click on this process to highlight it, then click the button End Process. A warning prompt should pop up. Click on Yes.

8) Now that this process is killed, we need to remove any references to it from the Registry. Once again, because this virus is blocking us from opening the Registry Editor, we need to trick the virus by copying the file to the desktop. Follow the same steps as in number 3, except this time, copy the following two files from their respective directories, and paste them on the desktop.

c:\windows\regedit.exe
c:\windows\system32\cmd.exe

9) Open regedit from the desktop. In the left window, click on My Computer so that it is highlighted. Now select Edit from the menu, followed by Find. In the Find box, type the name of the process that you ended from the Task Manager. If you recall, mine was winupdates. Do not include the .exe, just winupdates. Then click Find.

10) For the item that it found in the right window, click it to highlight it if it isn't highlighted already, and then right click on it, and select Delete. If a prompt pops up, select Yes or OK to confirm the delete.

11) Now, hit the F3 button once. This will find the next reference to that bad file. Follow step 8 again to delete the reference. Repeat steps 9 and 8 until the editor indicates that there are no more references to this file. Then exit the editor.

12) click on cmd.exe which you copied to the desktop. It will open the Command Prompt (which looks like DOS). Type the following commands in order, and hit Enter after each line:

cd c:\
cd program files
rd /s /q winupdates

13) Now restart your computer. Reinstall Limewire

AGAIN THIS IS HOW I FIXED MY WINDOWS 2000 BASED COMP. RESULTS MAY VARY.

awesome job man. Im sorry i coudnt find a win2k based pc to help you out on. For the rest of you i am almost 100%+ this will work on your win98 and 95 pcs too. If not let me know. I have a win98, wi*** and ME pc's so i can for sure help there but this oughta work! Thanks Tattoo dude

man that wuz mind-blowing!!!

really dude.....that thing wuz a f****in pain in the ***.....it wuz so annoying man!!!

searched on the net and could'nt find any way to fix it!

i dont know how u figured out this thing,but it works like a charm,hats off to ya!really appreciate the time and effort u put in to help us out!

cheerz!

EBERY LIKE TEN MINUTES MY WINLOGON.EXE LOCKS AND ASKS IF I WANNA DEBUG. I CLICK OK OR CANCEL AND IT SAYS PROGRAM MUST REBOOT. WHAT THE HELL DID I DO NOW? PLEASE TELL ME THERE IS AN EASY FIX FOR THE F^%&D UP WINLOGON.EXE.

you had 2k right? Q1 You didnt accidentaly delete a winlogon file instead of winupdates did you? Thats kind of what it sounds like to me. If you did, i might be able to find the file that needs to be replaced. Q2 do you have a win2k disk for reinstall? Im not suggesting you need to but i might be able to get the right file(s) off that disk and figure out what you need to re-copy.

Folks. I hope I have been helping you but now i need a little help. If anyone out there has NOT removed this virus yet PLEASE follow the following instructions. Im litterally BEGGING you.

Instead of deleting any winupdate files, PLEASE move them to a new folder on the desktop. This will not work with registry keys so go ahead and delete them. I need files from ALL OS PC'S. After you have them moved, zip the folder. After you zip it, a file with the same name will appear on the desktop. It is okay to delete the FOLDER now. PLEASE email me the file as an attachment. Name it "Windows (whatever you have) Winupdates viral infection) Please include a small text document with the name of all files in the zip folder and where they were located and removed from. This should also be in the zip file i might add. After you email it to me, follow this link. Enter all info and upload that same file to them too. Then it is okay to delete the file. This will still work just as well as the original instructions but now we ought to start getting Norton, McAfee, and Etrustt updates to remove this virus automatically. At least i hope. Link 1 is for submitting the file. Link 2 is where i need ALL of the people who used these instructions to go and vote on these instructions. You might add a post at the bottom of Link 2 to say what OS you had too. Thank you for helping me out here. I hope I have been of help to you guys and now I hope you can help me.

Link 1 http://subwiz.trendmicro.com/SubWiz/...sp?opgWizard=7

Link 2 http://www.gnutellaforums.com/showth...threadid=39696

no disc 1st of all. friend of a friends built the comp so he wants to charge me 40 buks to completely reinstall windows 2000. there has to be an easier way. as far as the winlogon.exe file, i am pretty sure i only deleted 3 files from the search of c:\, all3 named winupdates.whatever. then i deleted possibly 7 - 9 reg entries in regedit. all named winupdates.* then the F3 next came up with nada. so i rebooted and then i got the shutdown message. it seems to be happening less frequently now but i am gonna try windows update to see if it catchs any loose wires. any help on that complete winlogon.exe file would be greatly appreciated because i am pretty sure i can just copy and paste it into the existing location.

Cut the crap. The only serious and reliable way to remove a virus or worm is a complete reinstallation of your operating system. You didn't write the virus/worm (I assume) and therefore you have no way to tell what it does or what variants might exist.

What you are doing is treating symptoms.

I also found a hidden folder called Complete under C:\Documents and Settings\Your_User_Name that appeared to contain all the files that contained the virus. If this is indeed how the virus is spreading then everyone who had the virus needs to make sure to go to the library and stop sharing the Complete folder.

tattoowayne - if the real windows update does not do the trick i have a utilities disk i could copy for you. It is a miracle worker and just might work. If not i CAN get you a complete install win2k disk for free and 100% legal its NOT piracy. you just have to make sure you have a win2k key which you should. if you dont, talk to that guy who did your pc and if he wont give you one for the computer, which he HAS to legally, threaten to sue him, which you can. I hope the actual windows update site will work though.

i_have_no_account - for right now treating the symptoms is all we can do. And thats a load of bull about re-doing it all. I have removed many viruses in my days and ALL of the pc's ive done it on have the originally installed OS on them and are working perfect. so please keep your **** out of this forum where we really want to help people and not **** them off like you have me.

Guest With A Theory - yes if this folder does contain viral files not only should they be deleted but it is a good idea to stop sharing them over the gnutella and any other network your using at this time.

And PLEASE everybody go to that poll and vote as well as email me those files and the other people those files as stated in an earlier post. Thanks