Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: brian.treetops1@tiscali.co.uk on March 02, 2016, 10:33:01 PM

Title: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 02, 2016, 10:33:01 PM
Having found a previous topic on this subject (https://forum.avast.com/index.php?topic=180173.0 (https://forum.avast.com/index.php?topic=180173.0)) I've started carrying out the steps used in that fix, but I'm unable to understand the files produced by the FRST tool and TDSSKiller application.

I've tried everything I can think of to remove PC Cleaner Pro, but it can't be found in Add/Remove Programs, there's nothing in the registry (manual search) and even searching the C drive turns up nothing. I've started in Safe Mode but it still doesn't appear anywhere. I tried running CCleaner, MalwareBytes and HitmanPro but none of these managed to solve the issue.

I'm currently running MBAR and will attach the logs when it completes.

Other info:
Windows XP SP3
Avast Internet Security
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 02, 2016, 10:36:33 PM
Attached are the log files for TDSSKiller and FRST.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 02, 2016, 11:09:02 PM
MBAR logs attached.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: bob3160 on March 02, 2016, 11:31:05 PM
essexboy has been alerted. Please be patient. :)
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: Eddy on March 02, 2016, 11:36:45 PM
The MBam log is not readable.
Please run it again and safe the log as a plain txt file.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 03, 2016, 12:08:43 PM
Let me know what problems remain after this

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.
1. If you have bookmarks, let's save them by exporting them - Export Bookmarks (http://support.google.com/chrome/bin/answer.py?hl=en&answer=96816)
2. Then I need you to go Google Sync (https://www.google.com/settings/chrome/sync) and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome (https://www.google.com/intl/en/chrome/browser/)
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

NEXT

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner (http://www.bleepingcomputer.com/download/adwcleaner/) by Xplode onto your desktop.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 04, 2016, 10:17:24 AM
Thanks for your input. I have read through your instructions and I was unable to find any evidence of Chrome on my system and would appreciate receiving clarification on this action, before proceeding with the other measures.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 04, 2016, 01:50:29 PM
If you cannot find this I will manually delete after this run

Quote
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 04, 2016, 05:37:16 PM
Thanks. So that I am quite clear ,do you want me to commence at Open notepad and copy/paste the text in the quotebox below into it: and just ignore the initial instructions on Chrome and you will deal with this manually .
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 04, 2016, 06:49:56 PM
Use this fix now as I have incorporated the chrome elements

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
C:\Documents and Settings\User\Local Settings\Application Data\Google
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 05, 2016, 10:33:58 AM
Thanks. Log attached as requested.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 05, 2016, 11:12:18 AM
If you now run adwcleaner that should remove the remnants
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 05, 2016, 11:16:41 AM
Good,
ADW logs attached.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 05, 2016, 01:52:24 PM
How is the computer behaving now ?
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 05, 2016, 05:26:25 PM
No difference as far as I can see. Original error message still appears when I try to load Avast.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 05, 2016, 05:29:41 PM
Hmm all related keys were removed by adwcleaner, what warning does Avast give when you try to install it
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 05, 2016, 07:18:20 PM
Another antivirus cleaner has been detected - PC Cleaner Pro is displayed at instal stage. When I accept this a seperate error window appears advising that Avast cannot be installed in the folder you entered. I assume that the folder referred to must be a default included in the Avast setup as there was no provision provided to select a folder at setup.
 Hope this gives a clearer picture of my problem.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 05, 2016, 08:02:01 PM
OK let me know if this allows you to install

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
AV: PC Cleaner Pro (Disabled - Up to date) {737A8864-C2D9-4337-B49A-B5E35815B9BB}

 
Save this as fixlist.txt, in the same location as FRST.exe
(https://dl.dropboxusercontent.com/u/73555776/FRSTfix.JPG)
Run FRST and press Fix
On completion a log will be generated please post that
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 06, 2016, 10:04:41 AM
Good morning.When I first ran FRST it came up with an error message which I have attached.Also attached log.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 06, 2016, 12:23:19 PM
It looks to have removed the registry entry, will Avast install now ?

Download Avast Uninstall Utility (http://www.avast.com/en-gb/uninstall-utility) to your Desktop.
Download the correct version of Avast 
Avast Free (http://files.avast.com/iavs9x/avast_free_antivirus_setup.exe)
Avast Pro (http://files.avast.com/iavs9x/avast_pro_antivirus_setup.exe)
Avast Internet Security (http://files.avast.com/iavs9x/avast_internet_security_setup.exe)
Avast Premier (http://files.avast.com/iavs9x/avast_premier_antivirus_setup.exe)
Disconnect from the net
Uninstall Avast via control panel

----------
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 06, 2016, 01:01:23 PM
I came across this other log from this morning which I have attached.I will wait until you have seen this before I proceed with your latest instructions.
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 06, 2016, 02:07:17 PM
Winlogon\Notify\SDNotify: C:\Program Files\Max Spyware Detector\SDNotify.dll [X]

Did you install this ?

Continue with an installation attempt
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 06, 2016, 02:25:22 PM
Good news.I was able to instal successfully without need to carryout your latest fix. I do not recall installing the program you refer to. Should it be removed ?
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: essexboy on March 06, 2016, 03:45:41 PM
Yes as it is a bit dubious :)
Title: Re: PC Cleaner Pro Preventing Avast 2016 from installing
Post by: brian.treetops1@tiscali.co.uk on March 06, 2016, 06:21:41 PM
Thanks I will attempt to remove it. I am very grateful for your guidance and support to enable PC Cleaner Pro to be removed and allow Avast to be reinstalled. :)