Solved Help With Albireo Virus

I recently got hit with the Albireo Virus that semi-hijacks any website that resembles a place to purchase something. It randomly places ads on the page. When you click on them or 'X' them out they redirect you to several pages. I have run my Spyhunter and other malware software and it doesnt notice anything. I followed all of the online websites on how to remove it however, my problem is that I cannot find anything related to program by name. By name, it isn't on the computer. My uninstaller, Microsoft's uninstall show nothing about this nuisance. I understand this is one of the toughest to eliminate but it is a pain. Any help would surely be welcome.

Did you try MBAM's Junkware Removal Tool?

https://www.malwarebytes.org/junkwareremovaltool/

Also try adwcleaner: AdwCleaner Download

Well gentlemen, I have tried both of your suggestions and still no removal. This is by far the worst virus I have ever contracted on a PC or laptop. Driving me nuts.

No detections by either suggestion? Which browser do you use?

Firefox and nothing else.

Well after removal it would appear that you must "refresh" Firefox.

State if any removal tools you used found and removed any detections.

Firefox and nothing else.

Not that I am aware of. The problem is that I can't locate it anywhere on the computer. I have not seen anything on any removal that remotely resembles it by name or other.

Bunga said:

Firefox and nothing else.

Click to expand...

Callender said:

State if any removal tools you used found and removed any detections.

Click to expand...

Also state which removal tools you have used.

Not that I am aware of. The problem is that I can't locate it anywhere on the computer. I have not seen anything on any removal that remotely resembles it by name or other.

Okay I'm not a malware removal expert but I figured that at least one of those suggested tools should have detected something/

That Albeiro virus would appear to be adware that is bundled with another program. You'd really need to be looking at recently installed programs rather than looking for a program named "Albeiro" or similar.

If no other help is offered by a malware removal expert I'd suggest:

Run a system scan with UVK and upload the log.


Download link for UVK: UVK - Ultra Virus Killer

Right click the desktop icon and choose "Run as administrator"

Go to "Scan and create log" and use the settings in the above screenshot. Upload the results.

On the "System Repair" tab you could also initiate the scans highliighted in the screenshot below and run them one at a time. Avoid the others.

Log requested

Here is the log you requested. Thanks and if you need anything further, please let me know.

Thanks. Nothing obvious shows up in your log!

Would you mind launching Firefox then type:

about:support

into the address bar and press enter. In the widow that opens choose "Copy Text To Clipboard"

Paste the results here. Maybe it will provide a clue. Thanks.

Screen reader users, click here to turn off Google Instant.
Donald
Happy Mother's Day!
About 108,000 results (0.79 seconds)
Did you mean: *about:support*
Search Results
about_ActiveDirectory_Filter - TechNet - Microsoft
https://technet.microsoft.com/.../hh531527(v=ws.10).a...
Microsoft TechNet
Oct 28, 2011 - TOPIC Active Directory Filter SHORT DESCRIPTION Describes the syntax and behavior of the search filter supported by the Active Directory module for Windows PowerShell. LONG DESCRIPTION Most get-AD* Active Directory module cmdlets use the Filter parameter to search for objects.
About Windows Containers - MSDN - Microsoft
https://msdn.microsoft.com/.../about/about...
Microsoft Developer Network
7 days ago - Learn about Windows containers. ... The natural agility of Containers supports modern app development patterns in large scale, virtualized and ...
What We Do - FinCEN
https://www.fincen.gov/about_fin...
Financial Crimes Enforcement Network
About FinCEN ... Issues and interprets regulations authorized by statute;; Supports and enforces compliance with those regulations;; Supports, coordinates, and ...
About_dhs Home Page - Minnesota Department of Human Services
502 - Web server received an invalid response while acting as a gateway or proxy server....
Mar 29, 2016 - What's new for: About DHS ... and county-specific costs and revenue shares for economic support, health and social service programs.
Cerner | About Cerner
Cerner | About Cerner
Cerner
Our technologies connect people and systems at more than 18,000 facilities worldwide, and our wide range of services support the clinical, financial and ...
About protocol links - MozillaZine Knowledge Base
kb.mozillazine.org/About_protocol_links
Nov 16, 2015 - Beginning with March 8th, 2008 trunk builds, it's now available on Firefox 3.0b5. about:sessionrestore; about:support — Starting in Firefox 3.6 ...
About The Open Web Application Security Project - OWASP
https://www.owasp.org/.../About_The_Open_Web_Application_...
OWASP
Feb 1, 2016 - OWASP is an international organization and the OWASP Foundation supports OWASP efforts around the world. OWASP is an open community ...
About NAMI
https://www.nami.org/Abo...
National Alliance for the Mentally Ill ‑ NAMI
Our toll-free NAMI HelpLine allows us to respond personally to hundreds of thousands of requests each year, providing free referral, information and support—a ...
I support lgbt+ (@i_.care_.about_.you) • Instagram photos and videos
https://www.instagram.com/i_.care_.about_.you/
If you read this promise to not hurt yourself. I hope I can make you smile. Comment: If I made you smile. - 3. My Pronouns- she/her.
WHO | About the WHO Global Malaria Programme
WHO | About the WHO Global Malaria Programme
World Health Organization
The Programme sets evidence-based norms, standards, policies and guidelines to support malaria-affected countries around the world. As one of its key ...
Searches related to *about_:support*
apple support
dell support
hp support
support lenovo
support sentence
support.snapchat.com/a/failed-login iphone
support math
child support
1
2

3

4

5

6

7

8

9

10

Next
Charter Township of Clinton, MI - From your Internet address - Use precise location
- Learn more
Help Send feedback Privacy Terms

Hope it's what you are searching for.

No that's not it! Type about:support in the address bar like this:



Then select copy text to clipboard:



Then reply here - just click CTRL+V to paste the results into your reply.

Hi Bunga,
Lookin at that log,
i can see an awful lot of iffy stuff,
Your running 2 AV's Webroot & AVG, get rid of 1.
The IP that everything is being routed via, MY AV SAYS GET ME OUTTA HERE. (torrent or TOR?)
Youve run multiple clean up programs
There are a number of unsigned drivers and browser helper objects

THIS lS by far, in my opinion, the biggest problem, looks like a rootkit
<Services> | zigipyro | File not found: | No description | Stopped - Boot | Hash error: File not found | Unsigned : No publisher

You will need the assistance of a qualified Malware expert.

Roy

.

Hey Roy:

<Services> | zigipyro | File not found: | No description | Stopped - Boot | Hash error: File not found | Unsigned : No publisher

File not found: UVK could not parse the file. It may not exist. Plus it's stopped.

Two unsigned drivers from - CPUZ and Trend are nothing suspicious and removal will not fix the problem.

I do really appreciate your help though!

@Bunga.

If you like you can run this script:


- save the attached file to your desktop and rename it with the file extension .uvk

(Change .txt to .uvk)

Run UVK and from the welcome screen choose "Run Scripts" > "Import Commands From File"

Browse to the file saved on your desktop and import it and run it.

Cheers.

Application Basics

Name Firefox Version 46.0.1 Build ID 20160502172042 Update History Show Update History Update Channel release User Agent Mozilla/5.0 (Windows NT 6.1; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0 Profile Folder Show Folder Enabled Plugins aboutlugins Build Configuration about:buildconfig Memory Use about:memory Registered Service Workers about:serviceworkers Multiprocess Windows 0/3 (Disabled) Safe Mode false Profiles aboutrofiles Crash Reports for the Last 3 Days

Report ID Submitted All Crash Reports
This application has not been configured to display crash reports.
Extensions

Name Version Enabled ID Adblock Plus2.7.3true{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}Adblock Plus Pop-up Addon0.9.2.1-signed.1-signedtrueadblockpopups@jessehakanen.netCopy Plain Text [email protected]fox [email protected] [email protected]ti-process staged [email protected]@getpocket.comWebroot Filtering [email protected]root Password Manager3.2.40true{8ac62a8b-8b3f-43ba-9b1a-90c299b9dfda}Customizations for Adblock [email protected]ment Hiding Helper for Adblock [email protected] Graphics

Adapter DescriptionIntel(R) HD Graphics 4400Adapter Driversigdumdim64 igd10iumd64 igd10iumd64 igdumdim32 igd10iumd32 igd10iumd32Adapter RAMUnknownAsynchronous Pan/ZoomnoneDevice ID0x041eDirect2D EnabledtrueDirectWrite Enabledtrue (6.2.9200.16571)Driver Date1-29-2014Driver Version10.18.10.3412GPU #2 ActivefalseGPU Accelerated Windows3/3 Direct3D 11 (OMTC)Subsys ID367d17aaSupports Hardware H264 DecodingYesVendor ID0x8086WebGL RendererGoogle Inc. -- ANGLE (Intel(R) HD Graphics 4400 Direct3D11 vs_5_0 ps_5_0)windowLayerManagerRemotetrue AzureCanvasBackenddirect2d 1.1AzureContentBackenddirect2d 1.1AzureFallbackCanvasBackendcairoAzureSkiaAccelerated0 Important Modified Preferences

Name Value accessibility.loadedInLastSessiontruebrowser.cache.disk.capacity358400browser.cache.disk.filesystem_reported1browser.cache.disk.hashstats_reported1browser.cache.disk.smart_size.first_runfalsebrowser.cache.disk.smart_size.use_old_maxfalsebrowser.cache.frecency_experiment4browser.download.importedFromSqlitetruebrowser.places.smartBookmarksVersion7browser.sessionstore.upgradeBackup.latestBuildID20160502172042browser.startup.homepagewww.bbc.co.ukbrowser.startup.homepage_override.buildID20160502172042browser.startup.homepage_override.mstone46.0.1browser.tabs.loadInBackgroundfalsebrowser.urlbar.userMadeSearchSuggestionsChoicetruedom.apps.reset-permissionstruedom.mozApps.usedtrueextensions.lastAppVersion46.0.1gfx.crash-guard.d3d11layers.appVersion46.0.1gfx.crash-guard.d3d11layers.deviceID0x041egfx.crash-guard.d3d11layers.driverVersion10.18.10.3412gfx.crash-guard.d3d11layers.feature-d2dtruegfx.crash-guard.d3d11layers.feature-d3d11truegfx.crash-guard.glcontext.gfx.driver-init.direct3d11-angletruegfx.crash-guard.glcontext.gfx.driver-init.webgl-angletruegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-d3d11falsegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-force-warpfalsegfx.crash-guard.glcontext.gfx.driver-init.webgl-angle-try-d3d11truegfx.crash-guard.status.d3d11layers2gfx.crash-guard.status.d3d9video2gfx.crash-guard.status.glcontext2gfx.direct3d.last_used_feature_level_idx0media.gmp-eme-adobe.abix86-msvc-x64media.gmp-eme-adobe.lastUpdate1461853686media.gmp-eme-adobe.version17media.gmp-gmpopenh264.abix86-msvc-x64media.gmp-gmpopenh264.lastUpdate1461146555media.gmp-gmpopenh264.version1.5.3media.gmp-manager.buildID20160502172042media.gmp-manager.lastCheck1462731746media.hardware-video-decoding.failedfalsenetwork.cookie.prefsMigratedtruenetwork.predictor.cleaned-uptrueplaces.database.lastMaintenance1462480001places.history.expiration.transient_current_max_pages104858plugin.disable_full_page_plugin_for_typesapplication/pdfplugin.importedStatetrueplugin.state.npnitromozilla2plugin.state.npspwrap2print.printer_Canon_MP640_series_Printer.print_bgcolorfalseprint.printer_Canon_MP640_series_Printer.print_bgimagesfalseprint.printer_Canon_MP640_series_Printer.print_duplex-437918235print.printer_Canon_MP640_series_Printer.print_edge_bottom0print.printer_Canon_MP640_series_Printer.print_edge_left0print.printer_Canon_MP640_series_Printer.print_edge_right0print.printer_Canon_MP640_series_Printer.print_edge_top0print.printer_Canon_MP640_series_Printer.print_evenpagestrueprint.printer_Canon_MP640_series_Printer.print_footercenter
print.printer_Canon_MP640_series_Printer.print_footerleft&PTprint.printer_Canon_MP640_series_Printer.print_footerright&Dprint.printer_Canon_MP640_series_Printer.print_headercenter
print.printer_Canon_MP640_series_Printer.print_headerleft&Tprint.printer_Canon_MP640_series_Printer.print_headerright&Uprint.printer_Canon_MP640_series_Printer.print_in_colortrueprint.printer_Canon_MP640_series_Printer.print_margin_bottom0.5print.printer_Canon_MP640_series_Printer.print_margin_left0.5print.printer_Canon_MP640_series_Printer.print_margin_right0.5print.printer_Canon_MP640_series_Printer.print_margin_top0.5print.printer_Canon_MP640_series_Printer.print_oddpagestrueprint.printer_Canon_MP640_series_Printer.print_orientation0print.printer_Canon_MP640_series_Printer.print_page_delay50print.printer_Canon_MP640_series_Printer.print_paper_data1print.printer_Canon_MP640_series_Printer.print_paper_height -1.00print.printer_Canon_MP640_series_Printer.print_paper_name
print.printer_Canon_MP640_series_Printer.print_paper_size_type0print.printer_Canon_MP640_series_Printer.print_paper_size_unit1print.printer_Canon_MP640_series_Printer.print_paper_width -1.00print.printer_Canon_MP640_series_Printer.print_resolution600print.printer_Canon_MP640_series_Printer.print_reversedfalseprint.printer_Canon_MP640_series_Printer.print_scaling 1.00print.printer_Canon_MP640_series_Printer.print_shrink_to_fittrueprint.printer_Canon_MP640_series_Printer.print_to_filefalseprint.printer_Canon_MP640_series_Printer.print_unwriteable_margin_bottom0print.printer_Canon_MP640_series_Printer.print_unwriteable_margin_left0print.printer_Canon_MP640_series_Printer.print_unwriteable_margin_right0print.printer_Canon_MP640_series_Printer.print_unwriteable_margin_top0print.printer_Nitro_PDF_Creator_(Pro_9).print_bgcolorfalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_bgimagesfalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_duplex-437918235print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_bottom0print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_left0print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_right0print.printer_Nitro_PDF_Creator_(Pro_9).print_edge_top0print.printer_Nitro_PDF_Creator_(Pro_9).print_evenpagestrueprint.printer_Nitro_PDF_Creator_(Pro_9).print_footercenter
print.printer_Nitro_PDF_Creator_(Pro_9).print_footerleft&PTprint.printer_Nitro_PDF_Creator_(Pro_9).print_footerright&Dprint.printer_Nitro_PDF_Creator_(Pro_9).print_headercenter
print.printer_Nitro_PDF_Creator_(Pro_9).print_headerleft&Tprint.printer_Nitro_PDF_Creator_(Pro_9).print_headerright&Uprint.printer_Nitro_PDF_Creator_(Pro_9).print_in_colortrueprint.printer_Nitro_PDF_Creator_(Pro_9).print_margin_bottom0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_margin_left0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_margin_right0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_margin_top0.5print.printer_Nitro_PDF_Creator_(Pro_9).print_oddpagestrueprint.printer_Nitro_PDF_Creator_(Pro_9).print_orientation0print.printer_Nitro_PDF_Creator_(Pro_9).print_page_delay50print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_data1print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_height 11.00print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_name
print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_size_type0print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_size_unit0print.printer_Nitro_PDF_Creator_(Pro_9).print_paper_width 8.50print.printer_Nitro_PDF_Creator_(Pro_9).print_resolution-437918235print.printer_Nitro_PDF_Creator_(Pro_9).print_reversedfalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_scaling 1.00print.printer_Nitro_PDF_Creator_(Pro_9).print_shrink_to_fittrueprint.printer_Nitro_PDF_Creator_(Pro_9).print_to_filefalseprint.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_bottom0print.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_left0print.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_right0print.printer_Nitro_PDF_Creator_(Pro_9).print_unwriteable_margin_top0privacy.sanitize.migrateClearSavedPwdsOnExittrueprivacy.sanitize.migrateFx3Prefstrueservices.sync.declinedEngines
services.sync.engine.prefs.modifiedfalseservices.sync.lastPing1462706579services.sync.lastSyncSun May 08 2016 19:55:33 GMT-0400 (Eastern Standard Time)services.sync.numClients2storage.vacuum.last.index1storage.vacuum.last.places.sqlite1461150827 user.js Preferences

Your profile folder contains a user.js file, which includes preferences that were not created by Firefox.
Important Locked Preferences

Name Value JavaScript

Incremental GC true Accessibility

Activated true Prevent Accessibility 0 Library Versions


Expected minimum versionVersion in useNSPR4.124.12NSS3.22.3 Basic ECC3.22.3 Basic ECCNSSSMIME3.22.3 Basic ECC3.22.3 Basic ECCNSSSSL3.22.3 Basic ECC3.22.3 Basic ECCNSSUTIL3.22.33.22.3 Experimental Features

Name ID Description Active End Date Homepage Branch