PC Cleaner Pro Preventing Avast 2016 from installing

system · March 2, 2016, 9:33pm

Having found a previous topic on this subject (https://forum.avast.com/index.php?topic=180173.0) I’ve started carrying out the steps used in that fix, but I’m unable to understand the files produced by the FRST tool and TDSSKiller application.

I’ve tried everything I can think of to remove PC Cleaner Pro, but it can’t be found in Add/Remove Programs, there’s nothing in the registry (manual search) and even searching the C drive turns up nothing. I’ve started in Safe Mode but it still doesn’t appear anywhere. I tried running CCleaner, MalwareBytes and HitmanPro but none of these managed to solve the issue.

I’m currently running MBAR and will attach the logs when it completes.

Other info:
Windows XP SP3
Avast Internet Security

system · March 2, 2016, 9:36pm

Attached are the log files for TDSSKiller and FRST.

system · March 2, 2016, 10:09pm

MBAR logs attached.

bob3160 · March 2, 2016, 10:31pm

essexboy has been alerted. Please be patient.

Eddy · March 2, 2016, 10:36pm

The MBam log is not readable.
Please run it again and safe the log as a plain txt file.

essexboy · March 3, 2016, 11:08am

Let me know what problems remain after this

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.

If you have bookmarks, let’s save them by exporting them - Export Bookmarks
Then I need you to go Google Sync and sign into your account
Scroll down until you see the “Stop and Clear” button and click on the button. At the prompt click on “Ok”
Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
Import your bookmarks back into Chrome
Sign back in to your Chrome browser so that your bookmarks sync with your online account.

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521 SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521 FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30] 2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old 2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe C:\Documents and Settings\User\Application Data\SearchProtect Hosts: Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

[*]Close all open programs and internet browsers.
[*]Double click on AdwCleaner.exe to run the tool.
[*]Click on Scan.
[*]After the scan is complete click on “Clean”
[*]Confirm each time with Ok.
[*]Your computer will be rebooted automatically. A text file will open after the restart.
[*]Please post the content of that logfile with your next answer.
[*]You can find the logfile at C:\AdwCleaner[S0].txt as well.

system · March 4, 2016, 9:17am

Thanks for your input. I have read through your instructions and I was unable to find any evidence of Chrome on my system and would appreciate receiving clarification on this action, before proceeding with the other measures.

essexboy · March 4, 2016, 12:50pm

If you cannot find this I will manually delete after this run

Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19] CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19] CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06] CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23] CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29] CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19] CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx

system · March 4, 2016, 4:37pm

Thanks. So that I am quite clear ,do you want me to commence at Open notepad and copy/paste the text in the quotebox below into it: and just ignore the initial instructions on Chrome and you will deal with this manually .

essexboy · March 4, 2016, 5:49pm

Use this fix now as I have incorporated the chrome elements

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19] CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19] CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06] CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23] CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29] CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19] CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/ URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521 SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521 FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30] 2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old 2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe C:\Documents and Settings\User\Application Data\SearchProtect C:\Documents and Settings\User\Local Settings\Application Data\Google Hosts: Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f RemoveProxy: EmptyTemp: CMD: bitsadmin /reset /allusers

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · March 5, 2016, 9:33am

Thanks. Log attached as requested.

essexboy · March 5, 2016, 10:12am

If you now run adwcleaner that should remove the remnants

system · March 5, 2016, 10:16am

Good,
ADW logs attached.

essexboy · March 5, 2016, 12:52pm

How is the computer behaving now ?

system · March 5, 2016, 4:26pm

No difference as far as I can see. Original error message still appears when I try to load Avast.

essexboy · March 5, 2016, 4:29pm

Hmm all related keys were removed by adwcleaner, what warning does Avast give when you try to install it

system · March 5, 2016, 6:18pm

Another antivirus cleaner has been detected - PC Cleaner Pro is displayed at instal stage. When I accept this a seperate error window appears advising that Avast cannot be installed in the folder you entered. I assume that the folder referred to must be a default included in the Avast setup as there was no provision provided to select a folder at setup.
Hope this gives a clearer picture of my problem.

essexboy · March 5, 2016, 7:02pm

OK let me know if this allows you to install

CAUTION : This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:

CreateRestorePoint: AV: PC Cleaner Pro (Disabled - Up to date) {737A8864-C2D9-4337-B49A-B5E35815B9BB}

Save this as fixlist.txt, in the same location as FRST.exe

https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG

Run FRST and press Fix
On completion a log will be generated please post that

system · March 6, 2016, 9:04am

Good morning.When I first ran FRST it came up with an error message which I have attached.Also attached log.

essexboy · March 6, 2016, 11:23am

It looks to have removed the registry entry, will Avast install now ?

Download Avast Uninstall Utility to your Desktop.
Download the correct version of Avast
Avast Free
Avast Pro
Avast Internet Security
Avast Premier
Disconnect from the net
Uninstall Avast via control panel

[]Run the uninstall tool and accept the reboot to safe mode
[]Once complete reboot your system
[*]Reinstall Avast

PC Cleaner Pro Preventing Avast 2016 from installing

Announcements