remvd limewire... still people accessing my pc... HELP PLEASE!!!

[midianad]

my system:
winxp pro (clean install prior to limewire free version installation)
cable internet service 3mb/384kbps
useing a linksys router / firewall enabled
f-secure firewall

issue:
I installed limewire (free version 4.10.5?) last night and tried it out for about 30mins. I found it to be slow searching and downloading so I thought i'll buy it and run it to see if it changes. well when i uninstalled it i noticed that my internt connection was a bit slow. so i rebooted. i ran a netstat -a -n and i noticed people were now connecting to my pc as well as limewire. i proceeded to remove /.limewire folder and anything else i found. still no change. people kept connecting to my port 80 and bogging me down. as a last resort and 3 hours later I turned off my file & printer shareing in tcp/ip. it has stopped the connections to my pc but i need to keep that on for other reasions. my fire wall is not catching the connectiion unless i block all traffic.

has anyone else seen this issue or corrected it before me? if more info is needed i can provide anything that is asked. whois responces as well as netstat.

Thanks
Midianad.com

[Lord of the Rings]

Can you give us a total desciption of your set up:
1. OS version? (eg: Windows 98)
2. What firewalls you have?
3. How much ram?
4. Hard Disk space available?
5. Connection type? (eg: dialup, broadband, cable, etc.)
6. Modem & router brand name & model numbers?
7. Where are you trying to connect from (home, school, work, etc.)?
8. What version of Limewire (LW) & Java do you have? (Go to LW's menu Help>About LW...) Will show both LW & Java version.
9. Who is your isp provider (Internet Service Provider)?
10. Are you sharing the connection with other computers or p2p sharing programs? If yes, please give details of set up.
11. Which port do you have LW running on? Go to LW's menu bar, Tools>Options>Advanced>Firewalls & see which ports it is using.
These details are vital if you want us to find out what your connection problem is.

Port 80 is a web port. Do you run a web page anywhere? Do you have messenger or any other communication software open? Are you running any other p2p program or video conferencing or gaming program?

BTW are you running in UPnP mode on your router? If yes, then only programs on your computer will open ports that LW has not requested. LW can only request a maximum of 2 ports. Connection & listening for incoming. Most people use the same port for both. Whereas the other programs I hinted above may request multiple ports to be opened!

[midianad]

1. winxp pro sp2 fully updated
2. f-secure firewall/antivirus
3. 1gb of ram
4. 160gb harddrive
5. cable modem / 3mbps/384kbps
6. Linksys 802.11g Wireless Router WRT54G (wireless function disabled) & a Linksys EtherFast Cable Modem with USB BEFCMU10
7. home
8. fully up to date on java and the free limewire 4.10.5(not currently installed)
9. insightbb.com
10. only 1 pc on the network and no other p2p software has ever been installed.
11. limewire has been uninstalled 30 mins after it was installed. i'll provide a netstat for the port number later today.

Do you run a web page anywhere? nothing is open when i run the netstat / no/none

Do you have messenger or any other communication software open? no/none

Are you running any other p2p program or video conferencing or gaming program? no/none
--------------------------------------------------------------

I'll check UPnP mode on my router tonight. if it isn't on and i turn it on will it effect any of my online multiplayer games? (ie... FEAR, DOOM3, WoW, etc...)

i'll provide a netstat for the port number later today.

Thanks for your help & support,
midianad.com

[et voilà]

If you have access to the cable modem interface, be sure to turn off the firewall as the router is more appropriate for that. Also, UPnP won't make games run slower and all, in fact it might help some (be sure UPnP is on).

Also, I hope you do not connect throught your modem with USB. Ethernet port is more stable, faster.

Ciao

[midianad]

THANKS FOR THE ADVICE. ANY MORE SUGGESTIONS BEYOND TURNING UPnP ON?

I'm looking for any potential remaining files that were installed when limewire was installed. I wanna know what changes were made to my system causing me to still have 3rd party connections connect to my pc now even after i have remove limewire & it's pref. folder /.limewire/. Does anyone know where the registry entries are in regedit?

Thanks!
Midianad.com

[LonestarSecurity]

Download and install this program...RegSeeker

*Freeware* (Guaranteed Virus/Malware/Spyware Free)

Once you have installed this program, run it.

Click on "Find Files in Registry"

Type LimeWire

When the search has completed, untick the check box for "backup deleted items"

Choose only the keys that have the word "limewire" highlighted in blue.

Delete those keys.

Click Start
Search
All Files and Folders
More Advanced Options
Search Hidden Files and Folders

Type LimeWire

Delete all files and folders found for LimeWire.

If you have a dynamic IP such as with ADSL or Cable try releasing and renewing your connection through your router.

Any other questions let me know.

Good Luck!

[midianad]

UPDATE....
UPnP mode is on in my router before the issue started.

Will have the netstat tonight.
will run the Regseeker tonight too.

---------------------------------------------------------------------
Question...
if i leave "file & print sharing" off in my tcp/ip could i still use lime wire?

And also does anyone have any good reasions to why it is better to switch to Limewire Pro?

Thanks,
Midianad.com

[Grandpa]

midianad

I see you are using a Linksys router. I do not know if this is your problem or not but I also have a Linksys and when I am downloading from LW I have found that I have to reset the router by depressing the reset button for 10 sec.

It appears that Linksys routers have a hard time with DL from multiple sources. I can do a Internet speed test prior to DL and my speed will be 6500/351, 800KB/s / 44KB/s after running a while I will notice a drop in speed. I can then do another speed test and it will come back 1500/351, 190KB/s / 44KB/s the only way to get it back to where it should be is to reset my router.

How long it takes for this slowdown to happen depends on how I have set things up, if I am set up to port forward it will happen within a few minutes 10 or so. If the router and limewire are both set to UPnP it will happen on varying intervals sometimes 1/2 hr. or so other times days usually at least 24hrs.

But I do know from my own personal experience that Linksys has this problem at least mine does it is a Linksys BEFSR41 V3

As far as connection to your computer that have appeared after you installed LW I have no idea of what that is it is possible that if you did not get LW from the official site it could be a altered version of it and contain spyware.

I have never heard of the app you are using to detect these connections if you could leave a link to it here I would like to check it out and run it so I could investigate this further. LW has been checked by eTrust and they said it is spyware free. http://www3.ca.com/securityadvisor/p...x?id=453088059

[midianad]

here is the netstat i promised...
after about 10 mins the connections will go to time wait and then close out. later with out even opening anything that connects to the internet i will begin to show ip address established / connected to me on port 80.

-----------------------------------------------------------------------------------

C:\Documents and Settings\Midian After Dark>netstat -a -n

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:58581 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1034 0.0.0.0:0 LISTENING
TCP 127.0.0.1:59591 0.0.0.0:0 LISTENING
TCP 192.168.1.100:139 0.0.0.0:0 LISTENING
TCP 192.168.1.100:1135 68.142.81.3:27030 ESTABLISHED <----limelight networks, llc
TCP 192.168.1.100:1142 69.28.148.250:27014 ESTABLISHED <----limelight networks, llc
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:1029 *:*
UDP 0.0.0.0:9370 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1900 *:*
UDP 192.168.1.100:123 *:*
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
UDP 192.168.1.100:1900 *:*

[Grandpa]

There are allot of possibilities as to why limelight networks, llc is connecting to you. It could be software on your machine. I did a search on them If you have Macromedia on your machine there is a good chance that could be the cause. Along with a host of others. You might find the link below interesting.


http://www.bedagi.com/news/3494

I Have LimeWire Pro on my machine below is the log I took a few minutes after I shut it down.

C:\Documents and Settings\Rick>NetStat -a -n

Active Connections

Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3260 0.0.0.0:0 LISTENING
TCP 0.0.0.0:3261 0.0.0.0:0 LISTENING
TCP 127.0.0.1:1039 0.0.0.0:0 LISTENING
TCP 127.0.0.1:2990 127.0.0.1:12080 CLOSE_WAIT
TCP 127.0.0.1:3836 127.0.0.1:12080 CLOSE_WAIT
TCP 127.0.0.1:4047 127.0.0.1:12080 CLOSE_WAIT
TCP 127.0.0.1:12025 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12080 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12110 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12119 0.0.0.0:0 LISTENING
TCP 127.0.0.1:12143 0.0.0.0:0 LISTENING
TCP 192.168.1.100:139 0.0.0.0:0 LISTENING
TCP 192.168.1.100:2927 192.168.1.102:445 Microsoft ESTABLISHED
UDP 0.0.0.0:445 *:*
UDP 0.0.0.0:500 *:*
UDP 0.0.0.0:1025 *:*
UDP 0.0.0.0:1026 *:*
UDP 0.0.0.0:1040 *:*
UDP 0.0.0.0:1063 *:*
UDP 0.0.0.0:1845 *:*
UDP 0.0.0.0:4500 *:*
UDP 127.0.0.1:123 *:*
UDP 127.0.0.1:1029 *:*
UDP 127.0.0.1:1033 *:*
UDP 127.0.0.1:1900 *:*
UDP 127.0.0.1:2979 *:*
UDP 127.0.0.1:3809 *:*
UDP 127.0.0.1:4030 *:*
UDP 192.168.1.100:123 *:*
UDP 192.168.1.100:137 *:*
UDP 192.168.1.100:138 *:*
UDP 192.168.1.100:1900 *:*