PC Cleaner Pro Preventing Avast 2016 from installing

[REDACTED]

Having found a previous topic on this subject (https://forum.avast.com/index.php?topic=180173.0) I've started carrying out the steps used in that fix, but I'm unable to understand the files produced by the FRST tool and TDSSKiller application.

I've tried everything I can think of to remove PC Cleaner Pro, but it can't be found in Add/Remove Programs, there's nothing in the registry (manual search) and even searching the C drive turns up nothing. I've started in Safe Mode but it still doesn't appear anywhere. I tried running CCleaner, MalwareBytes and HitmanPro but none of these managed to solve the issue.

I'm currently running MBAR and will attach the logs when it completes.

Other info:
Windows XP SP3
Avast Internet Security

[REDACTED]

Attached are the log files for TDSSKiller and FRST.

[REDACTED]

MBAR logs attached.

[bob3160]

essexboy has been alerted. Please be patient.

[Eddy]

The MBam log is not readable.
Please run it again and safe the log as a plain txt file.

[essexboy]

Let me know what problems remain after this

Re-install Chrome

Unless you did this yourself, malware has changed your Chrome version into the Development Build. Among other things this allows malware to install any extension it wants. We need to resolve this.
1. If you have bookmarks, let's save them by exporting them - Export Bookmarks
2. Then I need you to go Google Sync and sign into your account
3. Scroll down until you see the "Stop and Clear" button and click on the button. At the prompt click on "Ok"
4. Now we need to uninstall chrome.
Note: When asked about user data or settings you must remove this also so please check the box.
5. Restart the computer and reinstall chrome, You can download The latest version from here - Google Chrome
6. Import your bookmarks back into Chrome
7. Sign back in to your Chrome browser so that your bookmarks sync with your online account.

NEXT

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

THEN

Please download AdwCleaner by Xplode onto your desktop.

• Close all open programs and internet browsers.
• Double click on AdwCleaner.exe to run the tool.
  
• Click on Scan.
  
• After the scan is complete click on "Clean"
• Confirm each time with Ok.
  
• Your computer will be rebooted automatically. A text file will open after the restart.
• Please post the content of that logfile with your next answer.
• You can find the logfile at C:\AdwCleaner[S0].txt as well.
  

[REDACTED]

Thanks for your input. I have read through your instructions and I was unable to find any evidence of Chrome on my system and would appreciate receiving clarification on this action, before proceeding with the other measures.

[essexboy]

If you cannot find this I will manually delete after this run

Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>

[REDACTED]

Thanks. So that I am quite clear ,do you want me to commence at Open notepad and copy/paste the text in the quotebox below into it: and just ignore the initial instructions on Chrome and you will deal with this manually .

[essexboy]

Use this fix now as I have incorporated the chrome elements

CAUTION :  This fix is only valid for this specific machine, using it on another may break your computer

Open notepad and copy/paste the text in the quotebox below into it:
 

CreateRestorePoint:
CHR Profile: C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-19]
CHR Extension: (Google Search) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-19]
CHR Extension: (No Name) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\ealchnonpofjocgofjpopjdoegbbkofj [2013-06-06]
CHR Extension: (avast! Online Security) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Advanced SystemCare Surfing Protection) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfengeggddojhakldhlpjdlddgkkjkdd [2013-08-29]
CHR Extension: (Gmail) - C:\Documents and Settings\User\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-19]
CHR HKLM\...\Chrome\Extension: [bdhhofhnnmneeblfcfpnnnbbbjbkfbig] - C:\DOCUME~1\User\LOCALS~1\Temp\ccex.crx <not found>
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  No File
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-2976242549-4080258417-2515734705-1007\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-1008-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
HKU\S-1-5-21-2976242549-4080258417-2515734705-500-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.pcservicecall.co.uk/
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
URLSearchHook: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 - (No Name) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} -  No File
HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "about:newtab" <======= ATTENTION
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
SearchScopes: HKU\S-1-5-21-2976242549-4080258417-2515734705-1007-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {5AA2BA46-9913-4DC7-9620-69AB0FA17AE7} URL = hxxp://search.alot.com/web?q={searchTerms}&pr=prov&client_id=1824ECC001CB689500E24664&install_time=2010-10-10T16:05:56Z&src_id=11407&camp_id=38&tb_version=2.5.15000.521
FF user.js: detected! => C:\Documents and Settings\User\Application Data\Mozilla\Firefox\Profiles\2atnz65p.default-1402334749156\user.js [2014-11-30]
2016-02-29 09:31 - 2011-05-20 19:19 - 00000000 ____D C:\Program Files\AVAST Software-old
2015-01-22 20:13 - 2015-01-22 20:13 - 0000311 _____ () C:\Documents and Settings\User\Local Settings\Application Data\poetsch.bat
Task: C:\WINDOWS\Tasks\ARO 2012.job => C:\Program Files\ARO 2012\ARO.exe
C:\Documents and Settings\User\Application Data\SearchProtect
C:\Documents and Settings\User\Local Settings\Application Data\Google
Hosts:
Reg: reg delete HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
Reg: reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local /f
RemoveProxy:
EmptyTemp:
CMD: bitsadmin /reset /allusers

 
Save this as fixlist.txt, in the same location as FRST.exe

Run FRST and press Fix
On completion a log will be generated please post that

[REDACTED]

Thanks. Log attached as requested.

[essexboy]

If you now run adwcleaner that should remove the remnants

[REDACTED]

Good,
ADW logs attached.

[essexboy]

How is the computer behaving now ?

[REDACTED]

No difference as far as I can see. Original error message still appears when I try to load Avast.