DCOM and certificate issues?

First, everything on this system worked fine before I retired it (thought it had a bad mobo, was a coincidental two bad PS in a row).

 

Ran SFC a few weeks ago, no problems.

 

I've no idea what certificates are, or why suddenly they are an issue, but will try that file.

 

Auto-update has been disabled for ages.  No issues there....

 

... When SFC reports problems I prefer to address that before moving to other issues....

 

Hi originaljgf:

If you want to pursue your SFC errors first I'd suggest posting your CBS.log file in your thread possible malware interfering with internet to see what nasdaq has to say, since they have advanced training and might have some experience interpreting CBS.log files. If you've run SFC as few times and it still can't repair your damaged system files your options are a bit limited now that Microsoft has turned off the Windows Update servers for Win XP and Vista as of 03-Aug-2020.  At this point I don't even know if you turned off Windows Update before Vista SP2 was patched to end of support on 11-Apr-2017.  You said in post # 3 that you "Ran SFC a few weeks ago, no problems" but your CBS.log seems to show that you ran several SFC scans in 2017 just before you mothballed this machine and that SFC found the same errors it's reporting now.

Since your Vista machine has been mothballed for at least 4 years I assume that means you have another working computer (presumably the Win 7 SP1 machine you've been using to download software before you copy it to the Vista SP2 machine).  You also said in post # 3 you suspected a bad MOBO before this Vista SP2 computer was mothballed. Are you trying to resurrect this Vista SP2 computer just to play the java-based Haven & Hearth game mentioned in your thread java error in game launcher?  After reading the developer's FAQ <here> about system requirements (Q: What are the system requirements A: We have not ran any tests) and security concerns (Q: I hear bots are a problem in this game, so why don't you ban them? A: We get this question a lot, as well as the related question) I wouldn't be surprised to learn that's where you picked up your browser hijacker in the first place.  If you're determined to get this game running on your Vista SP2 computer I'd suggest your post in the Haven & Hearth user forum and ask for help - there seem to be lots of threads there from users who couldn't (or still can't) get Haven & Hearth to run on their computer.

If you want to publish a basic Speccy diagnostic I can take a quick look at your system components and try to figure out what Vista SP2 security updates you're missing, but right now I'm not sure it's worth my time (or yours) trying to salvage this machine.  To publish a Speccy snapshot:

• Download Speccy Portable (spsetup132.zip) <here> from the Softpedia site and save to a USB thumb drive (or any other location you prefer).
• Unzip spsetup132.zip and double-click the .exe executable (Speccy.exe for a 32-bit OS; Speccy64.exe for a 64-bit OS) to launch the program. Wait for Speccy to collect system information and populate the interface.
• Go to File | Publish Snapshot and then copy and paste the URL this generates (e.g., http: // speccy.piriform.com/results/xxx... ) in your next post (see the support article Publishing a Speccy Profile to the Web for more information).

 Speccy Snapshot Copy to Clipboard.png   5.8KB   0 downloads
---------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, NVIDIA GeForce 8400M GS
-----------
64-bit Win 10 Pro v20H2 build 19042.1110 * Firefox v90.0.2 * Microsoft Defender v4.18.2107.4 * Malwarebytes Premium v4.4.4.126-1.0.1413
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

At this point I don't even know if you turned off Windows Update before Vista SP2 was patched to end of support on 11-Apr-2017....If you want to publish a basic Speccy diagnostic I can take a quick look at your system components and try to figure out what Vista SP2 security updates you're missing, but right now I'm not sure it's worth my time....

You think a more complete collection of old Microsoft patches might solve these issues? I never heard of corruption being fixed by patching, although corruption may prevent patches from installing. If this is all about security, there is obviously nothing secure about a Vista system that was fully updated to April 2017 these days.

Since the OP requires inexpensive solutions, someone should mention that Linux is free - although I am not a Linux enthusiast myself.

Hi originaljgf :

I just read your post # 10 in possible malware interfering with internet where you said that the video card on your Win 7 SP1 machine might be failing so I understand why you'd like to get your mothballed Vista SP2 machine up and running again.  If you'd like to post a Speccy snapshot as requested in post # 16 I'd be happy to throw out a few more suggestions.  I'd definitely uninstall insecure software like Adobe Flash Player and Java, especially if the latter is only needed to run Java-based games like Haven & Hearth.  There's a lot of out-dated and/or non-critical software on this machine that should be updated or removed if you want to get this Vista SP2 machine up and running again and isolate the cause of your browser re-directs.

Regardless of how you decide to proceed, I noticed that your FRST logs show a potential problem with your firewall.  It looks like nasdaq tried to fix some of those issues in your FRST repair script but if you're still using PC Tools Firewall Plus v6.0 make sure you either update to v7.0.0.123 that's available <here> on the Softpedia site (AFAIK this was last version released before this software was retired in 2011 - see the 2010 WildersSecurityForum thread <here>), or even better, uninstall this unsupported third-party firewall and just use the default Windows Firewall for now.  Here's one error I found in your FRST logs:

 

Error: (07/30/2021 10:44:04 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The PC Tools Firewall Plus service terminated unexpectedly.  It has done this 1 time(s)

 

I also forgot to ask you if you ran a thorough Check Disk to look for bad sectors on your hard drive. My old Vista machine has a magnetic platter / spinning HDD and before I run System File Checker (SFC)  on this machine I always perform a thorough Check Disk first to make sure I don't re-corrupt any files SFC is trying to repair by writing them into a bad sector. If you haven't done so lately, run a thorough Check Disk by entering the command chkdsk /r from an elevated command prompt with Administrator rights and re-boot to start the scheduled scan as described in the VistaForum tutorial <here>. It can take a few hours to run a thorough Check Disk so be patient and wait for your system to boot into Windows after the scan runs to completion. The Ask Leo! article How Do I See the Results of a CHKDSK That Ran on Boot? shows how to find the Check Disk results in your Windows Event Viewer (i.e., look in Event Viewer under Windows Logs | Application and search for an event with the Source listed as Wininit).
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, Western Digital Scorpio 256 GB SATA HDD, NVIDIA GeForce 8400M GS
-----------
64-bit Win 10 Pro v20H2 build 19042.1110 * Firefox v90.0.2 * Microsoft Defender v4.18.2107.4 * Malwarebytes Premium v4.4.4.126-1.0.1413
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited by lmacri, 09 August 2021 - 10:11 AM.

"I just read your post # 10 in possible malware interfering with internet where you said that the video card on your Win 7 SP1 machine might be failing so I understand why you'd like to get your mothballed Vista SP2 machine up and running again."

 

Thank you.  

 

No idea whether this old laptop (Inspiron 1720, was Vista, had Win10 when I bought it, I installed Win7) will run another year, another week, or will die as i type this;  hence the desire to resuscitate the Vista system.  (Am building a new system, slowly;  the PS for it is currently in the Vista system.)

 

I've always liked the old PCTools firewall, used it in all XP systems and Vista, sadly doesn't work in Win7 or later (fwiw, was purchased by Symantec and became part of Norton Security Suite).  Did temporarily disable it while troubleshooting, noticed no difference.   Laptop still using windows firewall, never bothered trying anything else ...didn't expect to be using this computer this long.

 

Ran chkdsk shortly after first firing up Vista system as a matter of course.

Edited by originaljgf, 11 August 2021 - 03:32 PM.

Can you go to file in speccy and publish a snapshot then share the link here?

http://speccy.piriform.com/results/UKC7TvK0UjDJGXuGXrMGbIF

 

Odd that cpu, ram, and mobo listed as "bad allocation".

"No optical disk drives detected" ...yet there it is in windows explorer.

"No audio card detected", system has onboard audio.

When do you get this dcom error on your computer?

http://speccy.piriform.com/results/UKC7TvK0UjDJGXuGXrMGbIF

 

Odd that cpu, ram, and mobo listed as "bad allocation".

"No optical disk drives detected" ...yet there it is in windows explorer.

"No audio card detected", system has onboard audio.

Hi originaljgf:

Even your Windows OS looks wrong in your Speccy snapshot - it's listed as "32-bit SP2", when it should say something like "Windows Vista Home Premium 32-bit SP2" (i.e, as it did in your earlier FRST logs in possible malware interfering with internet). Did you run the 32-bit Portable build of Speccy from a removable USB thumb drive as I suggested in post # 16?

I'm not a hardware specialist but I'll take a closer look at your Speccy snapshot and post back later if anything else obvious jumps out.  In the mean time here's a Speccy v1.32.740 snapshot for my own 32-bit Vista SP2 Home Premium machine from July 2019 (when I was using the legacy Norton Security Deluxe v22.15.2.22 as my antivirus) if you'd like to compare our machine specs: http://speccy.piriform.com/results/z2qoNAESuxQeYKCK2QGx3or

The latest Speccy v1.32.740 was released on 20-May-2018 and I know the diagnostics aren't always reliable for newer hardware components (see my post in the Speccy thread No SSD NVM Info about Speccy problems reading the S.M.A.R.T. attributes of the NVMe SSD in my Win 10 laptop) but it generally does a decent job with the hardware configurations you find in most Vista SP2 machines.  If I recall correctly you made some hardware upgrades to your Vista SP2 machine (a new hard drive?) so you might want to try the free HWiNFO to see if this utility correctly detects your CPU, RAM, MOBO, etc.  Again, since you're having problems downloading and installing software on your Vista SP2 machine I'd recommend downloading the HWiNFO Portable build (currently hwi_706.zip) to a removable USB thumb drive using your Win 7 SP1 machine and unzip it, and then run the 32-bit executable (HWiNFO32.exe) from the USB thumb drive while it's plugged into your Vista SP2 computer.  If you haven't used HWiNFO before make sure you disable both the Sensors-only and Summary-only check boxes as shown below to launch the main HWiNFO interface.

 

 HWiNFO v7_06 Start Main GUI at Launch 11 Aug 2021.png   28.4KB   0 downloads
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365 * Speccy Portable v1.32.740 * HWiNFO Portable v7.06
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, Western Digital Scorpio 256 GB SATA HDD, NVIDIA GeFoce 8400M GS
-----------r
64-bit Win 10 Pro v20H2 build 19042.1110 * Firefox v90.0.2 * Microsoft Defender v4.18.2107.4 * Malwarebytes Premium v4.4.4.126-1.0.1413
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

When do you get this dcom error on your computer?

 

 

I never got any error message.  Something I was asked to run in the Malware Forum reported an issue.

Per your speccy dcom is running, but the fact that soeccy is having issues reading your hardware I would wager that a reinstall of Vista is needed. There is massive corruption

"Did you run the 32-bit Portable build of Speccy from a removable USB thumb drive as I suggested in post # 16?"

 

I extracted it to a subfolder in "downloads" and ran from there.

 

"If I recall correctly you made some hardware upgrades to your Vista SP2 machine "

 

It's on it's fourth PS, third vid card, cpu upgraded, secondary HD added (not currently connected).  Mobo (Winfast), RAM, and primary HD original.

Per your speccy dcom is running, but the fact that soeccy is having issues reading your hardware I would wager that a reinstall of Vista is needed. There is massive corruption

 

 

Interesting.  Except for  the issues I've reported everything seems to be working -  word processor, graphics editors, video editors, games - even going online to other sites, including this one, works well, a browser game is fine, can watch videos, etc.  DVD playback is spotty, but drive is ten years old, and after four years storage may need lens cleaning.  On the system page of CP processor and memory are both listed as "Not Available", when last in use both were correct (Athlon 64x2 6000+ and 2gig).

 

I have no Vista disk, this was an "off the shelf" unit with a recovery drive (useless once you've used the system a couple of weeks).  I've considered an upgrade install of Win7 over Vista (after cloning the C drive for backup).

Can you go to device manager and expand all entries and take screenshots and post them here?

http://speccy.piriform.com/results/UKC7TvK0UjDJGXuGXrMGbIF

 

Odd that cpu, ram, and mobo listed as "bad allocation".

"No optical disk drives detected" ...yet there it is in windows explorer.

"No audio card detected", system has onboard audio.

Hi originaljgf:

 

Just a guess, but if everything looks fine in Device Manager it's also possible one of your third-party utilities that loads at boot-up (perhaps UnHackMe or DriveGLEAM ??) is interfering with Speccy.  You might want to try Speccy again with fewer third-party programs running in the background. For example, if you start your computer in Safe Mode or Safe Mode with Networking (i.e., restart your computer and repeatedly tap the F8 key before Windows loads until you are presented with the Windows Vista Advanced Boot menu - see the Bleeping Computer tutorial How to Start Windows in Safe Mode) I think Speccy Portable should still run.  While you're in Safe Mode you might also want to launch your old Firefox v28 browser and see if you're still re-directed to the Russian porn site.

 

I haven't finished reviewing your Speccy snapshot, but I noticed you stopped updating your Vista SP2 OS on 13-May-2013 and then installed KB2999226 (Update for Universal C Runtime in Windows, last revised 12-Oct-2015) a few weeks ago on 09-Jul-2021. Was there a particular reason why you installed KB2999226?
 
I'd have to agree with cryptodan that a clean reinstall of Vista SP2, followed by a re-install of minimal third-party software that is still compatible with Vista SP2 [e.g., your legacy Kaspersky Free 2018 v18.0.0.405 antivirus, Firefox ESR v52.9.0 browser (with a new profile and the latest Adblock Plus v3.11.x as your only browser extension), Malwarebytes Free v3.5.1, PC Tools Firewall Plus v7.0.0.123 and Thunderbird 17.0 email client] and updated hardware drivers from NVIDIA, etc. (if still available - you'd have to check before starting) would be the ideal way to proceed.  If your Firefox v52.9.0 browser was still re-directing to the Russian porn site after all that and a full system scan with Kaspersky and Malwarebytes still couldn't detect any malware or PUPs then you could post in Malwarebytes' Windows Malware Removal Help & Support forum and ask one of their trained malware removal specialists to take a second look at your system.

As previously mentioned, though, a clean reinstall of Vista SP2 isn't a straightforward process these days since Microsoft deactivated the Windows Update servers for Win XP and Vista on 03-Aug-2020 per the MS support article Windows Update SHA-1 Based Endpoints Discontinued for Older Windows Devices.  There are Vista ISOs available that are slipstreamed with both SP1 and SP2 as well as the ~230 security updates released after May 2009 (the release date of SP2) that would patch you back to end of support on 11-Apr-2017, but you would have to do that clean re-install at your own risk.  Microsoft seems to be going out of their way to kill off Vista and I've heard of some users who recently performed a clean reinstall of Vista SP2 and then couldn't re-activate their OS with their product key (e.g., the "slui.exe 4" method to start the automated phone activation service as described in the Vista Forums tutorial How to Activate Vista Normally and by Phone Activation​ wouldn't work), so if you attempt a clean re-install of Vista SP2 you could potentially end up in a worse place than you are now.
----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365 * Speccy Portable v1.32.740 * HWiNFO Portable v7.06
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, Western Digital Scorpio 256 GB SATA HDD, NVIDIA GeFoce 8400M GS
-----------
64-bit Win 10 Pro v20H2 build 19042.1110 * Firefox v90.0.2 * Microsoft Defender v4.18.2107.4 * Malwarebytes Premium v4.4.4.126-1.0.1413
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

 

Edited by lmacri, 11 August 2021 - 11:31 PM.

http://speccy.piriform.com/results/UKC7TvK0UjDJGXuGXrMGbIF

 

Odd that cpu, ram, and mobo listed as "bad allocation".

"No optical disk drives detected" ...yet there it is in windows explorer.

"No audio card detected", system has onboard audio.

Hi originaljgf:

I took a closer look at your Speccy profile this morning but there's so much information missing that it's not really worthwhile taking a deep dive into the details.  However, here are  a few more things I noticed:

As previously noted, your OS is only listed there as "32-bit SP2", not "Windows Vista Home Premium 32-bit SP2"

There is no CPU listed so I can't see the instruction sets it supports.  Your FRST logs indicate you have an AMD Athlon 64 X2 Dual Core Processor 6000+, so based on the TechPowerUp specs <here> I'll assume your CPU supports SSE, SSE2 and SSE3.

The is no RAM listed but your FRST logs show you only have 2 GB of RAM with 89% in use.

There is no hard drive listed under "Storage" but your FRST logs indicate your C:\ partition (boot drive) is only ~ 70 GB in total and has only 12 GB of free disk space left (it looks like you use J:\ and K:\ partitions for personal data storage and gaming).

 

There is no third-party antivirus or firewall listed at the top of the "Operating System" section (compare with my Nov 2019 Speccy profile <here> for my Vista SP2 machine that detected my  legacy Norton Security antivirus and Norton Security Firewall).  I can see a Kaspersky Anti-Virus Service 18.0.0 (Kaspersky v18.x is intended for computers with a very old CPU that does not support SSE2; v19.x is for CPUs that support SSE2) is loading on your Vista machine at boot up and there are .exe processes located at C:\Program Files\PC Tools Firewall Plus\ that are running after boot-up, but like your FRST logs, there's no indication that your Kaspersky AV is actually running in real-time.  Speccy does detect your built-in Windows Defender (a basic anti-malware scanner built into Win Vista and Win 7 that only scans for a small subset of prevalent malware), but your Windows Defender virus definitions haven't been updated since 03-Apr-2014 (Definition set v1.169.1377.0). Note that current Win Defender virus definition sets for Win 7 / Win Vista at https://www.microsoft.com/en-us/wdsi/defenderupdates are now uniquely signed with SHA-2 digital certificates and can't be manually installed on a Vista SP2 machine, even if the OS is patched to end of support (11-Apr-2017).

Under "Uptime" your system clock says Current Time: 8/11/2021 4:11:25 PM but Last Boot Time says "No data about Last Boot Time. Event log may be stopped"

Speccy indicates you have a GeForce GTX 950 graphics card with v10.18.13.6519 drivers and lists Gigabyte as the sub-vendor.  If this driver is also known as v365.19 (I always find the NVIDIA version numbering a bit confusing ) then I'll assume this driver was released on 12-May-2016 per the NVIDIA release notes <here>.  However, the official NVIDIA site at https://www.nvidia.com/en-us/geforce/drivers/ no longer offers Vista-compatible drivers for this graphics card.  If you're going to start removing unnecessary software from your system be sure you keep important utilities provided by the hardware manufacturer (e.g. the NVIDIA control panel, software for your printer, etc.), and keep in mind if you perform a clean re-install of your Windows OS that finding Vista-compatible drivers for your hardware from a reliable source is not going to be an easy task.

 

I can't see any evidence that the legacy Malwarebytes Free v3.5.1 is installed, but when I asked you to run a new Threat Scan in post # 9 I was left with the impression that current Malwarebytes scans were not detecting any malware or PUPs (e.g., a browser hijacker) that might have been missed by Kaspersky.  When was the last time you actually scanned your system with Malwarebytes?
-----------
32-bit Vista Home Premium SP2 * Firefox ESR v52.9.0 * Malwarebytes Premium v3.5.1.2522-1.0.365 * Speccy Portable v1.32.740 * HWiNFO Portable v7.06
HP Pavilion dv6835ca, Intel Core2Duo T5550 @ 1.83 GHz, 3 GB RAM, Western Digital Scorpio 256 GB SATA HDD, NVIDIA GeFoce 8400M GS
-----------
64-bit Win 10 Pro v20H2 build 19042.1110 * Firefox v91.0.0 * Microsoft Defender v4.18.2107.4 * Malwarebytes Premium v4.4.4.126-1.0.1413
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited by lmacri, 12 August 2021 - 10:43 AM.