Help needed with a acrer aspire all in one Z3801 with malware problems

Please could anyone help re trying to sort out my sick all in one pc, for a few weeks now I have been noticing small changes like the DVD Rom drive stopped working but would play cd's and now I am having simple issues like being unable to log on to the wifi network (please note I use BT wifi to get on the net as I do not have my own Internet connection at the moment,) never the less never had problems streaming content or downloading files etc, today I've tried all sorts to try and find out what is the problem but am now stuck, I have a new win7 disc set but find the dvdrom stopped working , can load a Disc and hear it trying to start clicking and wiring but after about 10 seconds gives up, any ideas what I can do to get my pc working again. I can get into most services via run, also the diagnostics re the wifi not working gives a DNS not responding message when I run the troubleshoot tool,
I also noticed on thinking maybe it would help I let windows update some critical updates and since then things went from bad to worse so to speak. Also I tried to go back to an earlier restore point and although it goes through the motions on restart you get an error message saying it wasn't successful etc etc, tried that 4 or 5 times,

One thread is more than enough.

http://www.sevenforums.com/system-s...er-aspire-all-one-z3801-malware-problems.html

When a member that deals with security problems sees your post you will get help. The free help can take a little while. Just hang in there.

Hi,
What were the last successful updates to install ?
Also which ones are failing ?
Post a screen shot of the history with the link on the top left View updates history.
See the links above my signature on how to take and upload screen shots here if you need help with that.

Re posting the second thread, was done in error as I wanted to edit and add further content to my original thread, but by mistake posted a second time, how do I remove the first sent thread?,

Don't worry about the other thread. Just stay on this thread. I was just trying to stop more threads starting with same problem.
Management will take care of the extra thread. Thanks for your understanding.

Read ThrashZone post and continue on.

Can you do all our scans and post results PCHF System Scans

Hi Thrashzone,
Thank you for your help, ok I am posting using an old ipad1 so not sure how I can do you a screen shot?, I will try and answer your question, the updates were 15 security updates for Microsoft windows ( I can list them individually if it helps?) there is one security update for Microsoft office 2007 suites and two for Microsoft .net framework 4.5 and lastly one more for Adobe acrobat reader DC, as to which ones are failing I have no idea or if any are failing( is there a way to check?, if so I can for you) had the Internet wifi been working I could of sent it but the wifi as I said previously has stopped working,
As an after thought I have an iPhone 5 so could take a picture and send or will that just complicate maters,

samuria said:

Can you do all our scans and post results PCHF System Scans

Click to expand...

Problem is I can not get the wifi to work so not sure what I can do, I can take the infected machine to a family member and try their wifi link as I have often used that in the past, (trouble is its 75 miles away so not local) never the less I will if it helps,

samuria said:

Can you do all our scans and post results PCHF System Scans

Click to expand...

I now have a working laptop with Internet access, if that is of any help?,

In that case can you run the following
Malwarebytes free (uncheck trial, in dashboard settings check rootkit detection)
Then ESET on-line, you will have to dissable your current AV.
Report any findings

Roy

Hi,
Click Start and type in the search box
windows update
Click on the suggestion or the enter key
On the top left of the windows you'll see View update history that will show you successful and failed updates.

Pictures are good too
Just turn off the flash on the camera first.

torchwood said:

In that case can you run the following
Malwarebytes free (uncheck trial, in dashboard settings check rootkit detection)
Then ESET on-line, you will have to dissable your current AV.
Report any findings

Roy

Click to expand...

Re your question Roy, I had a laptop lent to me, this was what I ment, the malware infected machine is the acer all in one etc, just noticed Malwarbytes has stopped opening on the infected machine, think there is not much hope fixing the Acer what without being able to use the internet or use the DVD drive plus other mounting issues

ThrashZone said:

Hi,
Click Start and type in the search box
windows update
Click on the suggestion or the enter key
On the top left of the windows you'll see View update history that will show you successful and failed updates.

Pictures are good too
Just turn off the flash on the camera first.

Click to expand...

Re your question, what do you want to know?, I opened update history and I notice a lot of failed updates mostly from the beginning of the year, apart from that I am not sure what you need to know?,

Hi,
A list of the failing to install updates would be nice
If too many to list just reset the update system

Try using this to reset the update system it's very good,
Use Option 2 on the list after right clicking it and select run as administrator
https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc

Download it to your downloads folder
Right click it and select Extract all to the downloads folder.
Then right click ResetWUEng and select run as administrator
Follow the rest of the prompts
Press any key to continue
Type 2 for that Option on the list and the Enter key to reset update services..
Press y for Yes and then the Enter key I believe twice
After it has completed
Type 15 for that option and the Enter key to restart the machine.
Should say will restart in 60 seconds save your work.... press any key to continue.
After restart go to windows updates and manually check for updates shouldn't take a few minutes.

ThrashZone said:

Hi,
A list of the failing to install updates would be nice
If too many to list just reset the update system

Try using this to reset the update system it's very good,
Use Option 2 on the list after right clicking it and select run as administrator
https://gallery.technet.microsoft.com/scriptcenter/Reset-Windows-Update-Agent-d824badc

Download it to your downloads folder
Right click it and select Extract all to the downloads folder.
Then right click ResetWUEng and select run as administrator
Follow the rest of the prompts
Press any key to continue
Type 2 for that Option on the list and the Enter key to reset update services..
Press y for Yes and then the Enter key I believe twice
After it has completed
Type 15 for that option and the Enter key to restart the machine.
Should say will restart in 60 seconds save your work.... press any key to continue.
After restart go to windows updates and manually check for updates shouldn't take a few minutes.
View attachment 391355

Click to expand...

OK, update from 1 week ago,
I Have now moved this Acer Aspire Z3801 pc to my friends home and i am now able to get onto the internet using his internet connection, (BT hub)
Before i couldn't get the wifi to work through BT-WiFi-Fon of which i have been using for some time at my place, OK i did as you suggested and downloaded and ran as administrator the windows reset update agent tool, i ran as per your instructions option 2 from the list and it ran/finished, completed successfully, it then asked to press any key to continue/finish which i did, it brought it back to the main menu, but!,as per your instructions press y for yes?? but its here i am not following you, where can i put y for yes? its just the 1 to 16 options list that appears after option 2 runs and finishes, then next you say Enter key I twice, that's a capital i!, thinking maybe to try option 15 ''download diagnostics'' i typed 15 and it opened a new options list 1 to 5 ''Download and run diagnostics for your system'', 1 on the list is for win7, 2, 3 ,4 and 5 are for 8, 8-1, and 10 etc etc, anyway i pressed option 1 and it opened up a scan, of which it ended with another box saying it had found two issues and it had fixed them, but i now notice it appears this copy of windows7 is not a legal copy, so will have to sort that problem out as well. ok, will do the restart and post back what i find re manually checking for updates, fingers crossed,

update history and updates are all reset and showing as if a new instal!, what next? click update? what about this unlicensed copy of win7?
i have a new win7 disc set disc set here and just tried to put the licence number in but it does not accept it?

Hi,
Can't help with activation besides use phone activation options.
You can post this report just simply copy and paste the results
http://go.microsoft.com/fwlink/?LinkID=52012

ThrashZone said:

Hi,
Can't help with activation besides use phone activation options.
You can post this report just simply copy and paste the results
http://go.microsoft.com/fwlink/?LinkID=52012

Click to expand...

Diagnostic Report (1.9.0027.0):
-----------------------------------------
Windows Validation Data-->

Validation Code: 0
Cached Online Validation Code: 0x0
Windows Product Key: *****-*****-X92GV-V7DCV-P4K27
Windows Product Key Hash: aU2z1/fnhnLHmhBm699qYZT2E6s=
Windows Product ID: 00426-OEM-8992662-00400
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 6.1.7601.2.00010100.1.0.001
ID: {C4F2230C-BACC-4B29-8170-E195C34FC171}(1)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: N/A, hr = 0x80070002
Signed By: N/A, hr = 0x80070002
Product Name: Windows 7 Ultimate
Architecture: 0x00000000
Build lab: 7601.win7sp1_gdr.150525-0603
TTS Error:
Validation Diagnostic:
Resolution Status: N/A

Vista WgaER Data-->
ThreatID(s): N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002

Windows XP Notifications Data-->
Cached Result: N/A, hr = 0x80070002
File Exists: No
Version: N/A, hr = 0x80070002
WgaTray.exe Signed By: N/A, hr = 0x80070002
WgaLogon.dll Signed By: N/A, hr = 0x80070002

OGA Notifications Data-->
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data-->
Office Status: 109 N/A
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-364-80041010_025D1FF3-229-80041010_025D1FF3-230-1_025D1FF3-517-80040154_025D1FF3-237-80040154_025D1FF3-238-2_025D1FF3-244-80070002_025D1FF3-258-3

Browser Data-->
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Google\Chrome\Application\chrome.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

Other data-->
Office Details: <GenuineResults><MachineData><UGUID>{C4F2230C-BACC-4B29-8170-E195C34FC171}</UGUID><Version>1.9.0027.0</Version><OS>6.1.7601.2.00010100.1.0.001</OS><Architecture>x32</Architecture><PKey>*****-*****-*****-*****-P4K27</PKey><PID>00426-OEM-8992662-00400</PID><PIDType>2</PIDType><SID>S-1-5-21-3069225087-1665415207-3981302129</SID><SYSTEM><Manufacturer>Acer</Manufacturer><Model>Aspire Z3801</Model></SYSTEM><BIOS><Manufacturer>American Megatrends Inc.</Manufacturer><Version>P01-A2</Version><SMBIOSVersion major="2" minor="7"/><Date>20110707000000.000000+000</Date></BIOS><HWID>02FF3407018400FE</HWID><UserLCID>0809</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>GMT Standard Time(GMT+00:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM><OEMID>ACRSYS</OEMID><OEMTableID>ACRPRDCT</OEMTableID></OEM><GANotification/></MachineData><Software><Office><Result>109</Result><Products/><Applications/></Office></Software></GenuineResults>

Spsys.log Content: 0x80070002

Licensing Data-->
Input Error: Can not find script file "C:\Windows\system32\slmgr.vbs".

Windows Activation Technologies-->
HrOffline: 0x00000000
HrOnline: 0x80072EE7
HealthStatus: 0x0000000000000000
Event Time Stamp: 9:3:2016 19:13
ActiveX: Registered, Version: 7.1.7600.16395
Admin Service: Registered, Version: 7.1.7600.16395
HealthStatus Bitmask Output:


HWID Data-->
HWID Hash Current: LAAAAAEAAQABAAEAAAABAAAAAgABAAEAeqggVVy2useUEbK9Sq+K+8ClLnM=

OEM Activation 1.0 Data-->
N/A

OEM Activation 2.0 Data-->
BIOS valid for OA 2.0: yes
Windows marker version: 0x20001
OEMID and OEMTableID Consistent: yes
BIOS Information:
ACPI Table Name OEMID Value OEMTableID Value
APIC ACRSYS ACRPRDCT
FACP ACRSYS ACRPRDCT
HPET ACRSYS ACRPRDCT
MCFG ACRSYS ACRPRDCT
SSDT AMICPU PROC
SLIC ACRSYS ACRPRDCT
ASF! INTEL HCG

Hi Marc,

The install is classified as counterfiet.

You have the Dell factory W7 Ultimate default key on your Acer computer.
The exploit used to circumvent activation has failed and MS has picked it up.
File Scan Data-->
File Mismatch: C:\Windows\system32\systemcpl.dll[6.1.7600.16385], Hr = 0x800b0100
File Mismatch: C:\Windows\system32\user32.dll[6.1.7600.16385], Hr = 0x800b0100

You need to use the code on the OEM sticker, and it will also tell you which version,(shipped with Home premium)

Having stated its counterfiet in your case it can be caused by incorrect OS media, did you use Dell re-installation discs?
the report is also incomplete
Licensing Data-->
Input Error: Can not find script file "C:\Windows\system32\slmgr.vbs".
run the following
regsvr32 vbscript.dll

i would also like to see the results from this run the following command from a command Prompt window.

reg query HKEY_CLASSES_ROOT\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

finally did you realise your running 32bit

Roy

hi Roy, ok this machine/pc i bought a few years ago as back up machine and at the time it switched on and operated just fine and apart from a pop up after booting saying windows was not genuine and click to make genuine i just stored it away until it was needed, i had no part in altering or modifying it so just dont know its pre history, when my tower type pc gave up i started using this acer aspire (all in one) of which has operated faultlessly until only a few months ago, i have a windows 7 box set i bought back in 2010 that is a 2 discs win7 32 and 64bit box set so if what you say its a mismatch of different programmes would it be best to do a clean instal? or do you think we can rectify what i have got installed?, ok in the mean time i will carry on with your last suggestion ''regsvr32 vbscript.dll and post the outcome, thanks,