Computer Help forum

Alert

PQSERVICE

by DoubleD59 / December 11, 2012 1:30 AM PST

I have Windows Vista on a EMACHINE. Since yesterday when I boot up after everything loads it give me a empty page, like when you go to COMPUTER and see all the drives and give me a

I:\refers to a location that is unavailable......etc.

And it keeps popping up even though I close it. I have a Screen Print of it but don't know how to post it in here. HELP....this is annoying.
<div>
</div>

Post a reply
Discussion is locked
You are posting a reply to: PQSERVICE
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: PQSERVICE
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Try this
by wpgwpg / December 11, 2012 1:53 AM PST
In reply to: PQSERVICE

Hold down the Windows key and press the letter R. Type in MSCONFIG and press enter. Click the Startup tab. There you'll see a list of things getting started when you boot up. You can uncheck anything there except your antivirus program, but look for something in the list that might be trying to access an I: drive. If it isn't obvious, you'll need to do some trial and error.

Good luck.

Collapse -
Nothing there
by DoubleD59 / December 11, 2012 8:41 AM PST
In reply to: Try this

I tried what you suggested and there is nothing there with that in it. I am gonna do a complete spyware/malware run.

Collapse -
Looks like you ...
by Edward ODaniel / December 11, 2012 3:41 PM PST
In reply to: PQSERVICE

have done something to unhide the PQSERVICE partition that ACER uses for its eRecovery recovery partition.

Have you been playing with a partition editor or something of that nature?

Collapse -
Nope
by DoubleD59 / December 12, 2012 8:08 AM PST
In reply to: Looks like you ...

Nothing was done that I know of. Spyware/malware check came up zero....so no clue.

Collapse -
Maybe something like ...
by Edward ODaniel / December 13, 2012 12:39 PM PST
In reply to: Nope

using glary utilities or some registry cleaner or something like that?

PQSERVICE partition type is EISA type (type 12 in Ptedit32). You can download PTEDIT32.exe here http://www.pendriveapps.com/partition-table-editor-ptedit/ and run it to see what the PQSERVICE partition type is set to. Change it to 12 but only for the PQSERVICE partition. That should put things back on track.

Normally when the partition becomes visible (like you can see it in windows explorer or My Computer) it can't be accessed via the keyboard for recovery purposes.

Collapse -
OK, a really quick test.
by R. Proffitt Forum moderator / December 12, 2012 8:12 AM PST
In reply to: PQSERVICE
Collapse -
results
by DoubleD59 / December 13, 2012 8:45 AM PST

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/13/2012 07:42:53 PM in x86 mode.
Windows Version: Windows Vista (TM) Home Basic Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Users\Howard\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (PID: 1472) [UP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost
::1 localhost

Program finished at: 12/13/2012 07:43:13 PM
Execution time: 0 hours(s), 0 minute(s), and 19 seconds(s)

Collapse -
So what is that DTUPDATE.exe?
by R. Proffitt Forum moderator / December 13, 2012 12:12 PM PST
In reply to: results

Very strange for such to run from roaming area like that. I'd really like to know why you have that item.

Looks like malware to me.

They tossed it at a prior discussion (here's just one) at
http://forums.malwarebytes.org/index.php?showtopic=115651

Before you begin more repairs, be sure you are ready for any disaster.
Bob

Popular Forums
icon
Computer Help 47,885 discussions
icon
Computer Newbies 10,322 discussions
icon
iPhones, iPods, & iPads 3,188 discussions
icon
Security 30,333 discussions
icon
TVs & Home Theaters 20,177 discussions
icon
HDTV Picture Setting 1,932 discussions
icon
Phones 15,713 discussions
icon
Windows 7 6,210 discussions
icon
Networking & Wireless 14,510 discussions

Big stars on small screens

Smosh tells CNET what it took to make it big online

Internet sensations Ian Hecox and Anthony Padilla discuss how YouTube has changed and why among all their goals, "real TV" isn't an ambition.