Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: REDACTED on March 02, 2016, 10:33:01 PM
-
Having found a previous topic on this subject (https://forum.avast.com/index.php?topic=180173.0 (https://forum.avast.com/index.php?topic=180173.0)) I've started carrying out the steps used in that fix, but I'm unable to understand the files produced by the FRST tool and TDSSKiller application.
I've tried everything I can think of to remove PC Cleaner Pro, but it can't be found in Add/Remove Programs, there's nothing in the registry (manual search) and even searching the C drive turns up nothing. I've started in Safe Mode but it still doesn't appear anywhere. I tried running CCleaner, MalwareBytes and HitmanPro but none of these managed to solve the issue.
I'm currently running MBAR and will attach the logs when it completes.
Other info:
Windows XP SP3
Avast Internet Security
-
Attached are the log files for TDSSKiller and FRST.
-
MBAR logs attached.
-
essexboy has been alerted. Please be patient. :)
-
The MBam log is not readable.
Please run it again and safe the log as a plain txt file.
-
Let me know what problems remain after this
Re-install Chrome
Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.
1. If you have bookmarks, let's save them by exporting them - Export Bookmarks (http://support.google.com/chrome/bin/answer.py?hl=en&answer=96816)
2. Then I need you to go Google Sync (https://www.google.com/settings/chrome/sync) and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome (https://www.google.com/intl/en/chrome/browser/)
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.
NEXT
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
THEN
Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on AdwCleaner.exe to run the tool.
- Click on Scan.
- After the scan is complete click on "Clean"
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the content of that logfile with your next answer.
- You can find the logfile at C:\AdwCleaner[S0].txt as well.
-
Thanks for your input. I have read through your instructions and I was unable to find any evidence of Chrome on my system and would appreciate receiving clarification on this action, before proceeding with the other measures.
-
If you cannot find this I will manually delete after this run
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
-
Thanks. So that I am quite clear ,do you want me to commence at Open notepad and copy/paste the text in the quotebox below into it: and just ignore the initial instructions on Chrome and you will deal with this manually .
-
Use this fix now as I have incorporated the chrome elements
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
C:\Documents and Settings\User\Local Settings\Application Data\Google
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
-
Thanks. Log attached as requested.
-
If you now run adwcleaner that should remove the remnants
-
Good,
ADW logs attached.
-
How is the computer behaving now ?
-
No difference as far as I can see. Original error message still appears when I try to load Avast.
-
Hmm all related keys were removed by adwcleaner, what warning does Avast give when you try to install it
-
Another antivirus cleaner has been detected - PC Cleaner Pro is displayed at instal stage. When I accept this a seperate error window appears advising that Avast cannot be installed in the folder you entered. I assume that the folder referred to must be a default included in the Avast setup as there was no provision provided to select a folder at setup.
Hope this gives a clearer picture of my problem.
-
OK let me know if this allows you to install
CAUTION : This fix is only valid for this specific machine, using it on another may break your computer
Open notepad and copy/paste the text in the quotebox below into it:
CreateRestorePoint:
AV: PC Cleaner Pro (Disabled - Up to date) {737A8864-C2D9-4337-B49A-B5E35815B9BB}
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
-
Good morning.When I first ran FRST it came up with an error message which I have attached.Also attached log.
-
It looks to have removed the registry entry, will Avast install now ?
Download Avast Uninstall Utility (http://www.avast.com/en-gb/uninstall-utility) to your Desktop.
Download the correct version of Avast
Avast Free (http://files.avast.com/iavs9x/avast_free_antivirus_setup.exe)
Avast Pro (http://files.avast.com/iavs9x/avast_pro_antivirus_setup.exe)
Avast Internet Security (http://files.avast.com/iavs9x/avast_internet_security_setup.exe)
Avast Premier (http://files.avast.com/iavs9x/avast_premier_antivirus_setup.exe)
Disconnect from the net
Uninstall Avast via control panel
- Run the uninstall tool and accept the reboot to safe mode
- Once complete reboot your system
- Reinstall Avast
----------
-
I came across this other log from this morning which I have attached.I will wait until you have seen this before I proceed with your latest instructions.
-
Winlogon\Notify\SDNotify: C:\Program Files\Max Spyware Detector\SDNotify.dll [X]
Did you install this ?
Continue with an installation attempt
-
Good news.I was able to instal successfully without need to carryout your latest fix. I do not recall installing the program you refer to. Should it be removed ?
-
Yes as it is a bit dubious :)
-
Thanks I will attempt to remove it. I am very grateful for your guidance and support to enable PC Cleaner Pro to be removed and allow Avast to be reinstalled. :)