PQSERVICE

PQSERVICE

by DoubleD59 Dec 11, 2012 1:30AM PST

I have Windows Vista on a EMACHINE. Since yesterday when I boot up after everything loads it give me a empty page, like when you go to COMPUTER and see all the drives and give me a

I:\refers to a location that is unavailable......etc.

And it keeps popping up even though I close it. I have a Screen Print of it but don't know how to post it in here. HELP....this is annoying.
<div>
</div>

Discussion is locked

- Collapse -

Try this

by wpgwpg Dec 11, 2012 1:53AM PST

Hold down the Windows key and press the letter R. Type in MSCONFIG and press enter. Click the Startup tab. There you'll see a list of things getting started when you boot up. You can uncheck anything there except your antivirus program, but look for something in the list that might be trying to access an I: drive. If it isn't obvious, you'll need to do some trial and error.

Good luck.

- Collapse -

Nothing there

by DoubleD59 Dec 11, 2012 8:41AM PST

I tried what you suggested and there is nothing there with that in it. I am gonna do a complete spyware/malware run.

- Collapse -

Looks like you ...

by Edward ODaniel Dec 11, 2012 3:41PM PST

have done something to unhide the PQSERVICE partition that ACER uses for its eRecovery recovery partition.

Have you been playing with a partition editor or something of that nature?

- Collapse -

Nope

by DoubleD59 Dec 12, 2012 8:08AM PST

Nothing was done that I know of. Spyware/malware check came up zero....so no clue.

- Collapse -

Maybe something like ...

by Edward ODaniel Dec 13, 2012 12:39PM PST

using glary utilities or some registry cleaner or something like that?

PQSERVICE partition type is EISA type (type 12 in Ptedit32). You can download PTEDIT32.exe here http://www.pendriveapps.com/partition-table-editor-ptedit/ and run it to see what the PQSERVICE partition type is set to. Change it to 12 but only for the PQSERVICE partition. That should put things back on track.

Normally when the partition becomes visible (like you can see it in windows explorer or My Computer) it can't be accessed via the keyboard for recovery purposes.

- Collapse -

OK, a really quick test.

by r. proffitt Former Forum moderator Dec 12, 2012 8:12AM PST

Go get RKILL from http://www.bleepingcomputer.com/download/rkill/ and tell me the output.

http://www.bleepingcomputer.com/forums/topic308364.html tells more for those that complain of the false positive.
Bob

- Collapse -

results

by DoubleD59 Dec 13, 2012 8:45AM PST

Rkill 2.4.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 12/13/2012 07:42:53 PM in x86 mode.
Windows Version: Windows Vista (TM) Home Basic Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Users\Howard\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (PID: 1472) [UP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost
::1 localhost

Program finished at: 12/13/2012 07:43:13 PM
Execution time: 0 hours(s), 0 minute(s), and 19 seconds(s)

- Collapse -

So what is that DTUPDATE.exe?

by r. proffitt Former Forum moderator Dec 13, 2012 12:12PM PST

Very strange for such to run from roaming area like that. I'd really like to know why you have that item.

Looks like malware to me.

They tossed it at a prior discussion (here's just one) at
http://forums.malwarebytes.org/index.php?showtopic=115651

Before you begin more repairs, be sure you are ready for any disaster.
Bob

CNET Forums

Other Forums

Forum Info