i'm just new here and i never had a problem with limewire until today...all my downloaded files especially the audio files was converted into .exe or zip files...i tried to unzip a few files and gave me an icon which is labelled setup,but are not working...with the rest, a pop up message was shown say that the file is corrupted.
i have been trying to figure this out the whole day and am really getting frustrated!
why would the files be changed int an .exe file? and it all shows the same file size.
i've already tried scanning my my whole system for virus and adware or spyware but the does not detect anything.
is there still a way to fix the files which i collected for more than a year now?
there must be a way to solve this problem and salvage all my downloads.
please help me!

Double-Post

http://www.gnutellaforums.com/showthread.php?t=67146

Have a look at this

http://www.gnutellaforums.com/showthread.php?t=67143

thank you! i was hoping to get a walk through of exactly what to do . and if i should just dump all the files i downloaded or is there a way to salvage them?
thank you for the quick response!

Sorry, but I don't think anyone has come up with a solution, yet

If you figure it out, let us know...many people are frustrated just like you!

Good Luck

Dano

Hi Everybody.
From what ive been reading this is a worm/trojan, Havent got a name for it yet But working on that. Looks like its targeting the defalt L/Wshared so as a
tempary fix try making a new share folder on another drive with a diffrent name then point L/W to it.
I beileve it is coppying the names of files, then deleting original files, then
puting user file names on newly created virus files So trying to open them may be a no no.
Has anyone tryed to copy them to desktop in a new folder and scan them.?
Has anyone looked in the bin or done a file recovery.?
Can you people who have this problem Give us some feedback on whats happning exactly.
What did you D/L just befor it started ?
I dont have this problem So Im in the dark.
Peace.

__________________
mickjapa108

Looks like many of limewire's zip file are infected with a (goabot worm) I tried to download about 5 different files today limewire caught 1 out of those 5 file infected with a virus my antivirus picked out 4 that Limewire allowed me to down load and failed to identify as corrupt files. Every file that I tried to download was infected, unless limewire does something about this it will become a ghost town on here

What Limewire really needs is if your system happens to be able to identify a virus you should be able to flag the program so that others won't down load it. I am thankful I have an excellent internet security that updates it's definitions sometime 4 to 5 times daily sometimes more because if I would have that Norton junk I would of been dead after the first one.

Norton couldn't catch a cold if it's life depended on it, I am willing to bet the people whop have been infected all had Norton, word of warning don't download anything if you use Norton unless that is you want to risk losing everything everything

Hi Grauwl....
So what is the exact file size of those L/W missed,? and there are warnings
everywhere DONT D/L EXE files, (There just for testing AV programs) Yea man
We all keep shouting about it, But they must like Viruses
Peace.

__________________
mickjapa108

If mp3s are turning into exe files and then turning the rest of your shared folder into the same, you would think that the original infected file would be to small to be an actual song...
I think it comes down to not downloading anything that is under 1000kbs no matter what file extension it has...Also always scan each and every file before playing them....

__________________


If you dont live for something...
You die for nothing...

Pranaams, Wondering why.
I would go even further n say 2000kbs, What real song is less than two min's
unless they are a crap bit-rate, n whats the use of a track that sounds like its
being played from a transistor radio under water
MP3 files cannot be converted to .EXE its not possible, They are being Deleted, Then replaced with (Who knows what) with an .EXE extension
It may be a zip/rar file with multiple files inside, e.g. worm,trojan & virus
combined.
I believe its a new threat, not an existing one & a bad one at that.
My addvice move your shared folder n rename it, till a threat signture can be put on it, and backup shared folder to exturnal drive. if thats not an option
then back it up to a password zip folder.
On last count I had 21,500 files & all are very dear to me. I would Die if I lost
my collection.
Peace.

__________________
mickjapa108

Hi all Just found this. Dont know if its relevant.

The Kazaa file-swapping network has been hit by another worm, just months after the first such attack, according to antivirus vendors.

Antivirus company Sophos said it had received several reports of the KWBot worm in the wild. KWBot appears to be the second worm to hit the Kazaa network, which fell prey to the Benjamin worm in May.

KWBot spreads in a similar way to Benjamin in that it alters Windows registry keys and then disguises itself as files that are likely to prove popular with file-swappers. It makes particular use of the names of movies and applications. When first executed, the worm copies itself to the Windows system folder as xplorer32.exe, said Sophos. It will then create two registry entries so that the copy is run each time Windows is started.

The worm may also allow attackers to gain control of an infected computer using commands transmitted over Internet Relay Chat, said Sophos.

Kazaa is not the only file-swapping network to have been targeted by virus writers. The Gnutella file-swapping network was hit by a proof-of-concept worm in February.

There have also been threats from other quarters. In April, a bug was found in the popular Winamp software for playing digital music files. The bug could allow an attacker to embed malicious code into an MP3 file, potentially damaging the user's PC and infecting other MP3s.

In addition, the music industry recently began planting "decoys" on free peer-to-peer services in its fight against online piracy, according to sources. This practice, known as "spoofing," entails the hiring of companies to distribute "decoy" files that are empty or do not work in order to frustrate would-be downloaders of movies and music.

Overpeer, a New York-based software firm funded by South Korea's SK Group, is understood to be one of the firms helping the industry disguise online files to thwart unauthorized swapping.

Examples of filenames used by the KWBot worm are:


Star Wars Episode 2 - Attack of the Clones VCD CD1.exe
Spiderman The Movie - The Game.exe
Grand Theft Auto 3 CD1 ISO.exe
ZoneAlarm Firewall Pro.exe
Windows XP Professional iso.exe
Unreal Tournament cracked (works on all servers).exe
University Study Guide (cheat sheet).exe
Quicken Pro 2002 iso.exe
Perl Ultimate Study Guide.exe
Office XP Corporate Ed. iso.exe
Norton Utilities 2002.exe
Microsoft Visual C++ 7.0 iso.exe
MCSE Ultimate Study Guide.exe
Max Payne full iso.exe
Macromedia Flash 5.exe
Kazaa Advertisement Ad remover.exe
DSL Anonymizer.exe
DoS Attacker.exe
DivX Codec 6.0 beta (codec only).exe
Credit Card number generator VERIFIER (cc cc#).exe
cows gone wild.exe
100 XXX Passwords (verified 3-24-02).exe
Sophos has a virus identity file that includes a fix for the KWBot virus here.

Peace.

__________________
mickjapa108