Re-boot message over and over and over 2

[DrJorde]

I am getting a message that says:
"You must restart your computer before the new settings will take effect. Do you want to restart now?"
This just started 3 days ago. My McAfee on line virus protection is up to date and will not find anything with a scan. As usuall, Mcafee is nearly impossible to find anything on their site.
Does anyone have a solution?
Thanks
Dave


DrJorde
Webmaster

http://plansbyjorde.tripod.com

 

[MilwTD]

Hi,
Try Google and search for sasser. That is if your system is XP or 2000. There are others but sasser and it's variants are prime suspects. And, there are very good manual removal instuctions on the symantec site.

--
"If we all did the things we are capable of doing, we would literally astound ourselves."
Thomas Edison

 

[DrJorde]

Thanks Milw TD
I went to Symantec and started to follow their directions for the Win 2000 Pro operating system.
They said to go to the task Manager and click on the Processes Tab... Well all the Tabs are missing and I can't close the window. No X in the corner either to close it.
I have gotten 3 useless responses from McAfee so far.
I think I will have to work on this tomorrow when I am not so angry.
I wonder if I need to do a repair on the operating system?
Last time I tried that I spent 2 weekends doing it. I wound up reformatting the drives on both computers and reloading everything.
Dave

DrJorde
Webmaster

http://plansbyjorde.tripod.com

 

[MilwTD]

Dave,
Good plan I make to many mistakes in the heat of battle.

Redoing the system is such a major pain. As soon as this gets straightened out Ghost your system then the pain of a reinstall goes down to about 15 minutes.

I support a number of nonprofits and have gone to making Ghost CD's and then leaving them inside the case taped down so they won't rattle. saves me many many hours.

--
"If we all did the things we are capable of doing, we would literally astound ourselves."
Thomas Edison

 

[diogenes10]

http://ghost.radified.com/ghost_2.htm

Nice tutorial on ghost.

If you can run stuff online, smah has a faq on online scanners.
Try TrendMicro, Pandasoft, or RAV.



-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[jbrackett]

Regarding the sasser suspicion:

If you are still concerned that you may have a sasser variant, try looking on

http://vil.nai.com/vil/content/v_125007.htm

for several good tips. This link is for the generic sasser worm, but if you wany, you might check some of the other variants by going to

http://vil.nai.com/vil/alphar.asp

and typing sasser into the search field. There are twelve variants listed, as well as several aliases.

You may also want to download and run McAfee's Stinger from

http://vil.nai.com/vil/stinger/

Best of luck to you.

_{"The Crystal Wind is the storm, and the storm is data, and the data is life. You have been slaves, denied the storm, denied the freedom of your data. That is now ended; the whirlwind is upon you . . . . . . Whether you like it or not."}

^{"Trent the Uncatchable" in The Long Run by Daniel Keys Moran}

 

[DrJorde]

Fresh day and it still has problems.
I would run Sasser but I still have not identified which one to run.
One more thing I discovered while trying to follow a symantec remedy. They had me open my Task Manager and said to click on the "Processes" Tab to shut off something, Guess what?, All the tabs are missing and I cannot close the abbreviated window. The frame is smaller and the "X" close window is also missing from the top RH corner.
I'm at work now but when I get home I will be working this problem again. Thanks for all your help!!! Any more suggestions?
I am definetly going to learn how to image or ghost my drive after this.
Dave


DrJorde
Webmaster

http://plansbyjorde.tripod.com

 

[DrJorde]

Hi again
Well last night I discovered the culprit. Now how to fix it.
Just before the window appears telling me:
"You must restart your computer before the new settings will take effect. Do you want to restart now?"
I noticed a "Hotfix" button on the lower status bar of the screen. So I looked at it and found a hotfix bat file is causing this restart message. A fellow worker said he thought it could all be related to a common dll that my Task Manager and the McAfee uses.
I traced it to a subdirectory under Program Files called REX2XCU and under that is msxml3 hotfix...
I renamed the directory to see what would happen then rebooted. The problem went away but so did my backspace and delete function and all other keyboard functions. It would not even let me re-name it back.
I rebooted again and immediatly went back to renaming it back and was able to do so.
That fixed my keyboard, but now I'm back to where I started.
1. Restart message
2. Incomplete Task Manager
3. No McAfee icon (Sheild with a V in it).
By the way McAfee had me do an Ultimate DOS virus scan and it came up clean.
I think this REX2XCU is a "Real Estate Exchange" Active X thing. I seem to recall a real estate site asking me if I wanted to install something.
How do I get this to either go away or complete it's task so it will stop asking me to restart and give me back my Task Manager?
I also went to the install/Uninstall and found so many hotfixes I don't know which one this is.
Sorry for the length..
Can anyone see a fix with this new information?
Dave

DrJorde
Webmaster

http://plansbyjorde.tripod.com

 

[MilwTD]

Is this the line in your registry

Global Startup: Run hotfix bat file.lnk = C:\Program Files\REX2XCU\msxml3 hotfix\runhfix.bat

If it is you can try only renaming runhfix.bat.

You might find some help here

http://www.microsoft.com/technet/security/tips/sechotfx.mspx

hth

--
"If we all did the things we are capable of doing, we would literally astound ourselves."
Thomas Edison

 

[DrJorde]

Milw TD
When I get home today, I will check. This seems like a hotfix that didn't get fully installed.
Do you reccommend doing a search for this exact line
"C:\Program Files\REX2XCU\msxml3 hotfix\runhfix.bat" or for "Global Startup" The Registry allways bogles my mind how large it is.
Thanks

DrJorde
Webmaster

http://plansbyjorde.tripod.com

 

[MilwTD]

No search for the file and rename it it will cause an error but should cause no permanent harm.

--
"If we all did the things we are capable of doing, we would literally astound ourselves."
Thomas Edison

 

[tlcscousin]

For the missing tabs on taskmanager double click an empty spot on the taskmanager window the tabs should reappear.

 

[DrJorde]

Thanks Futuretech204, that got them back and now I can close the window as well.
Dave

DrJorde
Webmaster

http://plansbyjorde.tripod.com