Author Topic: PC Cleaner Pro Preventing Avast 2016 from installing  (Read 6810 times)

0 Members and 1 Guest are viewing this topic.

Offline briantree

  • Newbie
  • *
  • Posts: 14
PC Cleaner Pro Preventing Avast 2016 from installing
« on: March 02, 2016, 10:33:01 PM »
Having found a previous topic on this subject (https://forum.avast.com/index.php?topic=180173.0) I've started carrying out the steps used in that fix, but I'm unable to understand the files produced by the FRST tool and TDSSKiller application.

I've tried everything I can think of to remove PC Cleaner Pro, but it can't be found in Add/Remove Programs, there's nothing in the registry (manual search) and even searching the C drive turns up nothing. I've started in Safe Mode but it still doesn't appear anywhere. I tried running CCleaner, MalwareBytes and HitmanPro but none of these managed to solve the issue.

I'm currently running MBAR and will attach the logs when it completes.

Other info:
Windows XP SP3
Avast Internet Security
« Last Edit: March 02, 2016, 10:41:32 PM by briantree »

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #1 on: March 02, 2016, 10:36:33 PM »
Attached are the log files for TDSSKiller and FRST.

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #2 on: March 02, 2016, 11:09:02 PM »
MBAR logs attached.

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 44958
  • 61 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #3 on: March 02, 2016, 11:31:05 PM »
essexboy has been alerted. Please be patient. :)
Free avast! Security Seminar: http://bit.ly/2N1eaR2  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 10 Pro v20H2 64bit, 24 Gig Ram, 1TB SSD, AvastOmni 20.7.xxx, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31333
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #4 on: March 02, 2016, 11:36:45 PM »
The MBam log is not readable.
Please run it again and safe the log as a plain txt file.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40627
  • Dragons by Sasha
    • Malware fixes
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #5 on: March 03, 2016, 12:08:43 PM »
Let me know what problems remain after this

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.
1. If you have bookmarks, let's save them by exporting them - Export Bookmarks
2. Then I need you to go Google Sync and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

NEXT

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S0].txt as well.

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #6 on: March 04, 2016, 10:17:24 AM »
Thanks for your input. I have read through your instructions and I was unable to find any evidence of Chrome on my system and would appreciate receiving clarification on this action, before proceeding with the other measures.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40627
  • Dragons by Sasha
    • Malware fixes
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #7 on: March 04, 2016, 01:50:29 PM »
If you cannot find this I will manually delete after this run

Quote
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #8 on: March 04, 2016, 05:37:16 PM »
Thanks. So that I am quite clear ,do you want me to commence at Open notepad and copy/paste the text in the quotebox below into it: and just ignore the initial instructions on Chrome and you will deal with this manually .

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40627
  • Dragons by Sasha
    • Malware fixes
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #9 on: March 04, 2016, 06:49:56 PM »
Use this fix now as I have incorporated the chrome elements

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 
Quote
CreateRestorePoint:
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
C:\Documents and Settings\User\Local Settings\Application Data\Google
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that
« Last Edit: March 04, 2016, 06:52:13 PM by essexboy »

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #10 on: March 05, 2016, 10:33:58 AM »
Thanks. Log attached as requested.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40627
  • Dragons by Sasha
    • Malware fixes
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #11 on: March 05, 2016, 11:12:18 AM »
If you now run adwcleaner that should remove the remnants

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #12 on: March 05, 2016, 11:16:41 AM »
Good,
ADW logs attached.

Offline essexboy

  • Malware removal instructor
  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 40627
  • Dragons by Sasha
    • Malware fixes
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #13 on: March 05, 2016, 01:52:24 PM »
How is the computer behaving now ?

Offline briantree

  • Newbie
  • *
  • Posts: 14
Re: PC Cleaner Pro Preventing Avast 2016 from installing
« Reply #14 on: March 05, 2016, 05:26:25 PM »
No difference as far as I can see. Original error message still appears when I try to load Avast.