Help With Albireo Virus

Bunga · 07 May 2016

Not that I am aware of. The problem is that I can't locate it anywhere on the computer. I have not seen anything on any removal that remotely resembles it by name or other.

Callender · 07 May 2016

Okay I'm not a malware removal expert but I figured that at least one of those suggested tools should have detected something/

That Albeiro virus would appear to be adware that is bundled with another program. You'd really need to be looking at recently installed programs rather than looking for a program named "Albeiro" or similar.

If no other help is offered by a malware removal expert I'd suggest:

Run a system scan with UVK and upload the log.

Help With Albireo Virus-uvk-scan-log.jpg

Download link for UVK: UVK - Ultra Virus Killer

Right click the desktop icon and choose "Run as administrator"

Go to "Scan and create log" and use the settings in the above screenshot. Upload the results.

On the "System Repair" tab you could also initiate the scans highliighted in the screenshot below and run them one at a time. Avoid the others.

Bunga · 08 May 2016

Here is the log you requested. Thanks and if you need anything further, please let me know.

Callender · 08 May 2016

Thanks. Nothing obvious shows up in your log!

Would you mind launching Firefox then type:

about:support

into the address bar and press enter. In the widow that opens choose "Copy Text To Clipboard"

Paste the results here. Maybe it will provide a clue. Thanks.

Bunga · 08 May 2016

Screen reader users, click here to turn off Google Instant.
Donald
Happy Mother's Day!
About 108,000 results (0.79 seconds)
Did you mean: *about:support*
Search Results
about_ActiveDirectory_Filter - TechNet - Microsoft
https://technet.microsoft.com/.../hh531527(v=ws.10).a...
Microsoft TechNet
Oct 28, 2011 - TOPIC Active Directory Filter SHORT DESCRIPTION Describes the syntax and behavior of the search filter supported by the Active Directory module for Windows PowerShell. LONG DESCRIPTION Most get-AD* Active Directory module cmdlets use the Filter parameter to search for objects.
About Windows Containers - MSDN - Microsoft
https://msdn.microsoft.com/.../about/about...
Microsoft Developer Network
7 days ago - Learn about Windows containers. ... The natural agility of Containers supports modern app development patterns in large scale, virtualized and ...
What We Do - FinCEN
https://www.fincen.gov/about_fin...
Financial Crimes Enforcement Network
About FinCEN ... Issues and interprets regulations authorized by statute;; Supports and enforces compliance with those regulations;; Supports, coordinates, and ...
About_dhs Home Page - Minnesota Department of Human Services
502 - Web server received an invalid response while acting as a gateway or proxy server....
Mar 29, 2016 - What's new for: About DHS ... and county-specific costs and revenue shares for economic support, health and social service programs.
Cerner | About Cerner
Cerner | About Cerner
Cerner
Our technologies connect people and systems at more than 18,000 facilities worldwide, and our wide range of services support the clinical, financial and ...
About protocol links - MozillaZine Knowledge Base
kb.mozillazine.org/About_protocol_links
Nov 16, 2015 - Beginning with March 8th, 2008 trunk builds, it's now available on Firefox 3.0b5. about:sessionrestore; about:support — Starting in Firefox 3.6 ...
About The Open Web Application Security Project - OWASP
https://www.owasp.org/.../About_The_...b_Application_...
OWASP
Feb 1, 2016 - OWASP is an international organization and the OWASP Foundation supports OWASP efforts around the world. OWASP is an open community ...
About NAMI
https://www.nami.org/Abo...
National Alliance for the Mentally Ill ‑ NAMI
Our toll-free NAMI HelpLine allows us to respond personally to hundreds of thousands of requests each year, providing free referral, information and support—a ...
I support lgbt+ (@i_.care_.about_.you) • Instagram photos and videos
https://www.instagram.com/i_.care_.about_.you/
If you read this promise to not hurt yourself. I hope I can make you smile. Comment: If I made you smile. - 3. My Pronouns- she/her.
WHO | About the WHO Global Malaria Programme
WHO | About the WHO Global Malaria Programme
World Health Organization
The Programme sets evidence-based norms, standards, policies and guidelines to support malaria-affected countries around the world. As one of its key ...
Searches related to *about_:support*
apple support
dell support
hp support
support lenovo
support sentence
support.snapchat.com/a/failed-login iphone
support math
child support
1
2

3

4

5

6

7

8

9

10

Next
Charter Township of Clinton, MI - From your Internet address - Use precise location
- Learn more
Help Send feedback Privacy Terms

Bunga · 08 May 2016

Hope it's what you are searching for.

Callender · 08 May 2016

No that's not it! Type about:support in the address bar like this:

Help With Albireo Virus-mozilla-firefox-1.jpg

Then select copy text to clipboard:

Help With Albireo Virus-mozilla-firefox-2.jpg

Then reply here - just click CTRL+V to paste the results into your reply.

torchwood · 08 May 2016

Hi Bunga,
Lookin at that log,
i can see an awful lot of iffy stuff,
Your running 2 AV's Webroot & AVG, get rid of 1.
The IP that everything is being routed via, MY AV SAYS GET ME OUTTA HERE. (torrent or TOR?)
Youve run multiple clean up programs
There are a number of unsigned drivers and browser helper objects

THIS lS by far, in my opinion, the biggest problem, looks like a rootkit
<Services> | zigipyro | File not found: | No description | Stopped - Boot | Hash error: File not found | Unsigned : No publisher

You will need the assistance of a qualified Malware expert.

Roy

.

Callender · 08 May 2016

Hey Roy:

<Services> | zigipyro | File not found: | No description | Stopped - Boot | Hash error: File not found | Unsigned : No publisher

File not found: UVK could not parse the file. It may not exist. Plus it's stopped.

Two unsigned drivers from - CPUZ and Trend are nothing suspicious and removal will not fix the problem.

I do really appreciate your help though! :)

@Bunga.

If you like you can run this script:

Code:

<UVKCommandsScript>
<sDelete>
<Services> | zigipyro | File not found:  | No description | Stopped - Boot | Hash error: File not found | Unsigned :  No publisher
<CleanAllUsersTemp>
<EmptyBrowsersCache>
<AvastBCScan>

Bunga script.txt

- save the attached file to your desktop and rename it with the file extension .uvk

(Change .txt to .uvk)

Run UVK and from the welcome screen choose "Run Scripts" > "Import Commands From File"

Browse to the file saved on your desktop and import it and run it.

Cheers.

Bunga · 08 May 2016

Application Basics

Name Firefox Version 46.0.1 Build ID 20160502172042 Update History Show Update History Update Channel release User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 Profile Folder Show Folder Enabled Plugins about

lugins Build Configuration about:buildconfig Memory Use about:memory Registered Service Workers about:serviceworkers Multiprocess Windows 0/3 (Disabled) Safe Mode false Profiles about

rofiles Crash Reports for the Last 3 Days

Report ID Submitted All Crash Reports
This application has not been configured to display crash reports.
Extensions

Name Version Enabled ID Adblock Plus2.7.3true{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}Adblock Plus Pop-up Addon0.9.2.1-signed.1-signedtrueadbl...hakanen.netCopy Plain Text 21.5truecopyplaintext@teo.plFirefox Hello1.2.6trueloop@mozilla.orgIDM integration6.25.16truemozilla_cc2@in...manager.comMulti-process staged rollout1.0truee10srollout@mozilla.or...tpocket.comWebroot Filtering Extension1.2.0.40truewebrootsecure@webroot.comWebroot Password Manager3.2.40true{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}Customizations for Adblock Plus1.0.5falsecustomization@adblockplus.orgElement Hiding Helper for Adblock Plus1.3.8falseelemhidehelper@adblockplus.org Graphics

Adapter DescriptionIntel(R) HD Graphics 4400Adapter Driversigdumdim64 igd10iumd64 igd10iumd64 igdumdim32 igd10iumd32 igd10iumd32Adapter RAMUnknownAsynchronous Pan/ZoomnoneDevice ID0x041eDirect2D EnabledtrueDirectWrite Enabledtrue (6.2.9200.16571)Driver Date1-29-2014Driver Version10.18.10.3412GPU #2 ActivefalseGPU Accelerated Windows3/3 Direct3D 11 (OMTC)Subsys ID367d17aaSupports Hardware H264 DecodingYesVendor ID0x8086WebGL RendererGoogle Inc. -- ANGLE (Intel(R) HD Graphics 4400 Direct3D11 vs_5_0 ps_5_0)windowLayerManagerRemotetrue AzureCanvasBackenddirect2d 1.1AzureContentBackenddirect2d 1.1AzureFallbackCanvasBackendcairoAzureSkiaAccelerated0 Important Modified Preferences

Name Value accessibility.loadedInLastSessiontruebrowser.cache.disk.capacity358400browser.cache.disk.filesystem_ reported1browser.cache.disk.hashstats_reported1browser.cache.disk.smart_size.first_runfalsebrowser.c ache.disk.smart_size.use_old_maxfalsebrowser.cache.frecency_experiment4browser.download.importedFrom Sqlitetruebrowser.places.smartBookmarksVersion7browser.sessionstore.upgradeBackup.latestBuildID20160 502172042browser.startup.homepagewww.bbc.co.ukbrowser.startup.homepage_override.buildID2016050217204 2browser.startup.homepage_override.mstone46.0.1browser.tabs.loadInBackgroundfalsebrowser.urlbar.user MadeSearchSuggestionsChoicetruedom.apps.reset-permissionstruedom.mozApps.usedtrueextensions.lastAppVersion46.0.1gfx.crash-guard.d3d11layers.appVersion46.0.1gfx.crash-guard.d3d11layers.deviceID0x041egfx.crash-guard.d3d11layers.driverVersion10.18.10.3412gfx.crash-guard.d3d11layers.feature-d2dtruegfx.crash-guard.d3d11layers.feature-d3d11truegfx.crash-guard.glcontext.gfx.driver-init.direct3d11-angletruegfx.crash-guard.glcontext.gfx.driver-init.webgl-angletruegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-d3d11falsegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-warpfalsegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-try-d3d11truegfx.crash-guard.status.d3d11layers2gfx.crash-guard.status.d3d9video2gfx.crash-guard.status.glcontext2gfx.direct3d.last_used_feature_level_idx0media.gmp-eme-adobe.abix86-msvc-x64media.gmp-eme-adobe.lastUpdate1461853686media.gmp-eme-adobe.version17media.gmp-gmpopenh264.abix86-msvc-x64media.gmp-gmpopenh264.lastUpdate1461146555media.gmp-gmpopenh264.version1.5.3media.gmp-manager.buildID20160502172042media.gmp-manager.lastCheck1462731746media.hardware-video-decoding.failedfalsenetwork.cookie.prefsMigratedtruenetwork.predictor.cleaned-uptrueplaces.database.lastMaintenance1462480001places.history.expiration.transient_current_max_pages 104858plugin.disable_full_page_plugin_for_typesapplication/pdfplugin.importedStatetrueplugin.state.npnitromozilla2plugin.state.npspwrap2print.printer_Canon_MP6 40_series_Printer.print_bgcolorfalseprint.printer_Canon_MP640_series_Printer.print_bgimagesfalseprin t.printer_Canon_MP640_series_Printer.print_duplex-437918235print.printer_Canon_MP640_series_Printer.print_edge_bottom0print.printer_Canon_MP640_series _Printer.print_edge_left0print.printer_Canon_MP640_series_Printer.print_edge_right0print.printer_Can on_MP640_series_Printer.print_edge_top0print.printer_Canon_MP640_series_Printer.print_evenpagestruep rint.printer_Canon_MP640_series_Printer.print_footercenter
print.printer_Canon_MP640_series_Printer.print_footerleft&PTprint.printer_Canon_MP640_series_Printer .print_footerright&Dprint.printer_Canon_MP640_series_Printer.print_headercenter
print.printer_Canon_MP640_series_Printer.print_headerleft&Tprint.printer_Canon_MP640_series_Printer. print_headerright&Uprint.printer_Canon_MP640_series_Printer.print_in_colortrueprint.printer_Canon_MP 640_series_Printer.print_margin_bottom0.5print.printer_Canon_MP640_series_Printer.print_margin_left0 .5print.printer_Canon_MP640_series_Printer.print_margin_right0.5print.printer_Canon_MP640_series_Pri nter.print_margin_top0.5print.printer_Canon_MP640_series_Printer.print_oddpagestrueprint.printer_Can on_MP640_series_Printer.print_orientation0print.printer_Canon_MP640_series_Printer.print_page_delay5 0print.printer_Canon_MP640_series_Printer.print_paper_data1print.printer_Canon_MP640_series_Printer. print_paper_height -1.00print.printer_Canon_MP640_series_Printer.print_paper_name
print.printer_Canon_MP640_series_Printer.print_paper_size_type0print.printer_Canon_MP640_series_Prin ter.print_paper_size_unit1print.printer_Canon_MP640_series_Printer.print_paper_width -1.00print.printer_Canon_MP640_series_Printer.print_resolution600print.printer_Canon_MP640_series_Pri nter.print_reversedfalseprint.printer_Canon_MP640_series_Printer.print_scaling 1.00print.printer_Canon_MP640_series_Printer.print_shrink_to_fittrueprint.printer_Canon_MP640_series _Printer.print_to_filefalseprint.printer_Canon_MP640_series_Printer.print_unwriteable_margin_bottom0 print.printer_Canon_MP640_series_Printer.print_unwriteable_margin_left0print.printer_Canon_MP640_ser ies_Printer.print_unwriteable_margin_right0print.printer_Canon_MP640_series_Printer.print_unwriteabl e_margin_top0print.printer_Nitro_PDF_Creator_(Pro_9).print_bgcolorfalseprint.printer_Nitro_PDF_Creat or_(Pro_9).print_bgimagesfalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_duplex-437918235print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_bottom0print.printer_Nitro_PDF_Creator_( Pro_9).print_edge_left0print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_right0print.printer_Nitro_ PDF_Creator_(Pro_9).print_edge_top0print.printer_Nitro_PDF_Creator_(Pro_9).print_evenpagestrueprint. printer_Nitro_PDF_Creator_(Pro_9).print_footercenter
print.printer_Nitro_PDF_Creator_(Pro_9).print_footerleft&PTprint.printer_Nitro_PDF_Creator_(Pro_9).p rint_footerright&Dprint.printer_Nitro_PDF_Creator_(Pro_9).print_headercenter
print.printer_Nitro_PDF_Creator_(Pro_9).print_headerleft&Tprint.printer_Nitro_PDF_Creator_(Pro_9).pr int_headerright&Uprint.printer_Nitro_PDF_Creator_(Pro_9).print_in_colortrueprint.printer_Nitro_PDF_C reator_(Pro_9).print_margin_bottom0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_margin_left0.5pri nt.printer_Nitro_PDF_Creator_(Pro_9).print_margin_right0.5print.printer_Nitro_PDF_Creator_(Pro_9).pr int_margin_top0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_oddpagestrueprint.printer_Nitro_PDF_C reator_(Pro_9).print_orientation0print.printer_Nitro_PDF_Creator_(Pro_9).print_page_delay50print.pri nter_Nitro_PDF_Creator_(Pro_9).print_paper_data1print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_ height 11.00print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_name
print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_size_type0print.printer_Nitro_PDF_Creator_(Pro_9 ).print_paper_size_unit0print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_width 8.50print.printer_Nitro_PDF_Creator_(Pro_9).print_resolution-437918235print.printer_Nitro_PDF_Creator_(Pro_9).print_reversedfalseprint.printer_Nitro_PDF_Creator_ (Pro_9).print_scaling 1.00print.printer_Nitro_PDF_Creator_(Pro_9).print_shrink_to_fittrueprint.printer_Nitro_PDF_Creator_( Pro_9).print_to_filefalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_bottom0pri nt.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_left0print.printer_Nitro_PDF_Creator_( Pro_9).print_unwriteable_margin_right0print.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_marg in_top0privacy.sanitize.migrateClearSavedPwdsOnExittrueprivacy.sanitize.migrateFx3Prefstrueservices. sync.declinedEngines
services.sync.engine.prefs.modifiedfalseservices.sync.lastPing1462706579services.sync.lastSyncSun May 08 2016 19:55:33 GMT-0400 (Eastern Standard Time)services.sync.numClients2storage.vacuum.last.index1storage.vacuum.last.places.sqlite1461150827 user.js Preferences

Your profile folder contains a user.js file, which includes preferences that were not created by Firefox.
Important Locked Preferences

Name Value JavaScript

Incremental GC true Accessibility

Activated true Prevent Accessibility 0 Library Versions

Expected minimum versionVersion in useNSPR4.124.12NSS3.22.3 Basic ECC3.22.3 Basic ECCNSSSMIME3.22.3 Basic ECC3.22.3 Basic ECCNSSSSL3.22.3 Basic ECC3.22.3 Basic ECCNSSUTIL3.22.33.22.3 Experimental Features

Name ID Description Active End Date Homepage Branch

Help With Albireo Virus

Log requested