I need help with some internet connectivity.

Nodnella said:

I can download to XP, have jump stick, how do I get the download to the jump stick?

Just highlight the downloaded file, right click, select COPY, and then open a File Explorer window to your jump drive, place your cursor in the box, right-click and select PASTE.

Do the same thing to get it on your W10 machine.

Word of warning here: If your W10 system is infected, you run the risk of infecting your XP system by using the jump drive back and forth. So, download everything you need to the XP system all at once. Copy it all over to the jump drive. Plug it into your W10 machine and copy it all over to your desktop, then remove the jump drive from the system. Once we know what is going on with your W10 machine, we'll know if there's something that can migrate to the jump drive.

I have all three downloads, going to attempt to save to Jump stick.

While away, xp froze up, had problems copying programs, success at last, now running your sequence on win 10.

So far: ran rkill, ran adwcleaner and fixed

Nodnella said:

I have all three downloads, going to attempt to save to Jump stick.

While away, xp froze up, had problems copying programs, success at last, now running your sequence on win 10.

Okay, but I think there are actually 4 downloads:
RKILL
ADWCleaner
JRT
Malwarebytes Antimalware (I added this one in a later post)

Nodnella said:

So far: ran rkill, ran adwcleaner and fixed

Please post the logs. I have a few minutes before leaving.

Sorry for absence! Family emergency took me out of town.

I do not know how to post the logs for you but the win 10 said it has a copy of them (some where). Tell me how to copy for you and I will do so.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 10 Home x64
Ran by Don (Administrator) on Tue 04/18/2017 at 16:42:04.94
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~








File System: 0








Registry: 0










~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 04/18/2017 at 16:48:19.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Rkill 2.8.4 by Lawrence Abrams (Grinler)
BleepingComputer.com - News, Reviews, and Technical Support
Copyright 2008-2017 BleepingComputer.com
More Information about Rkill can be found at this link:
RKill - What it does and What it Doesnt - A brief introduction to the program - Anti-Virus, Anti-Malware, and Privacy Software


Program started at: 04/18/2017 04:38:51 PM in x64 mode.
Windows Version: Windows 10 Home


Checking for Windows services to stop:


* No malware services found to stop.


Checking for processes to terminate:


* No malware processes found to kill.


Checking Registry for malware related settings:


* No issues found in the Registry.


Resetting .EXE, .COM, & .BAT associations in the Windows Registry.


Performing miscellaneous checks:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.3 (04.10.2017)
Operating System: Windows 10 Home x64
Ran by Don (Administrator) on Tue 04/18/2017 at 16:42:04.94
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~








File System: 0








Registry: 0










~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 04/18/2017 at 16:48:19.47
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~






# AdwCleaner v6.045 - Logfile created 18/04/2017 at 16:32:51
# Updated on 28/03/2017 by Malwarebytes
# Database : 2017-04-18.1 [Server]
# Operating System : Windows 10 Home (X64)
# Username : Don - DON-KAREN-PC
# Running from : E:\adwcleaner_6.045 (1).exe
# Mode: Clean
# Support : Malwarebytes | Customer Support & Help Center






***** [ Services ] *****


[-] Service deleted: vToolbarUpdater40.3.7
[-] Service deleted: WtuSystemSupport
[-] Service deleted: EsgScanner




***** [ Folders ] *****


[-] Folder deleted: C:\WINDOWS\Installer\{75881A1F-A02E-4D88-BCFA-34D86752A0C3}
[-] Folder deleted: C:\Users\Don\AppData\Local\avg web tuneup
[-] Folder deleted: C:\Users\Don\AppData\LocalLow\HPAppData
[-] Folder deleted: C:\Users\Don\AppData\Roaming\ParetoLogic
[-] Folder deleted: C:\Users\Don\AppData\Roaming\ConsumerSoft
[#] Folder deleted on reboot: C:\Users\Don\AppData\Roaming\PARETOLOGIC
[-] Folder deleted: C:\Users\Karen\AppData\Local\avg web tuneup
[-] Folder deleted: C:\Program Files\slimservice
[-] Folder deleted: C:\Program Files\avg web tuneup
[#] Folder deleted on reboot: C:\Program Files\SlimService
[-] Folder deleted: C:\Program Files\Common Files\AVG Secure Search
[-] Folder deleted: C:\ProgramData\ParetoLogic
[-] Folder deleted: C:\ProgramData\avg web tuneup
[-] Folder deleted: C:\ProgramData\SlimWare Utilities, Inc
[#] Folder deleted on reboot: C:\ProgramData\PARETOLOGIC
[#] Folder deleted on reboot: C:\ProgramData\Application Data\ParetoLogic
[#] Folder deleted on reboot: C:\ProgramData\Application Data\avg web tuneup
[#] Folder deleted on reboot: C:\ProgramData\Application Data\SlimWare Utilities, Inc
[#] Folder deleted on reboot: C:\ProgramData\Application Data\PARETOLOGIC
[-] Folder deleted: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DriverAssist
[-] Folder deleted: C:\Program Files (x86)\avg web tuneup
[-] Folder deleted: C:\Program Files (x86)\ConsumerSoft
[-] Folder deleted: C:\Program Files (x86)\Common Files\AVG Secure Search
[-] Folder deleted: C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec
[-] Folder deleted: C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec
[-] Folder deleted: C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\madakpajlmcpaodhfbekojajlhbdklol
[-] Folder deleted: C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Extensions\mallpejgeafdahhflmliiahjdpgbegpk




***** [ Files ] *****


[-] File deleted: C:\WINDOWS\SysNative\roboot64.exe
[-] File deleted: C:\WINDOWS\SysNative\sasnative64.exe
[-] File deleted: C:\WINDOWS\SysNative\drivers\EsgScanner.sys
[-] File deleted: C:\Users\Karen\AppData\Roaming\Mozilla\Firefox\Profiles\1log7824.default\searchplugins\web-search.xml
[-] File deleted: C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_couponxplorer.dl.tb.ask.com_0.localstorage-journal
[-] File deleted: C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.shopathome.com_0.localstorage-journal




***** [ DLL ] *****






***** [ WMI ] *****






***** [ Shortcuts ] *****






***** [ Scheduled Tasks ] *****






***** [ Registry ] *****


[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{75881A1F-A02E-4D88-BCFA-34D86752A0C3}
[#] Key deleted on reboot: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{75881A1F-A02E-4D88-BCFA-34D86752A0C3}_is1
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi.1
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[-] Key deleted: HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[-] Key deleted: HKLM\SOFTWARE\Classes\SecureShell.WINZIPSSSecureShellExt
[-] Key deleted: HKLM\SOFTWARE\Classes\SecureShell.WINZIPSSSecureShellExt.1
[-] Key deleted: HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj
[-] Key deleted: HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.GenericWnd.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.NativeApi.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\SecureShell.WINZIPSSSecureShellExt
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\SecureShell.WINZIPSSSecureShellExt.1
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\WtuServer.WtuServerObj.1
[-] Key deleted: HKLM\SOFTWARE\Classes\AppID\{1BD47D21-01F4-4538-9290-39FD569A0F24}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKLM\SOFTWARE\Classes\CLSID\{CA3A5461-96B5-46DD-9341-5350D3C94615}
[-] Key deleted: HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{4BC8AD89-AC5F-4DBD-A38F-C355C7DD33D7}
[-] Key deleted: HKLM\SOFTWARE\Classes\TypeLib\{A5FF3EB5-BF62-4D59-84DF-DC518E46FCB3}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\Bitberry
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\Bitberry Software
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\ParetoLogic
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\SlimWare Utilities Inc
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\UpdaterEX
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\ConsumerSoft
[-] Key deleted: HKU\S-1-5-21-2804474112-3264133505-1310706265-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Extractor Packages
[#] Key deleted on reboot: HKCU\Software\Bitberry
[#] Key deleted on reboot: HKCU\Software\Bitberry Software
[#] Key deleted on reboot: HKCU\Software\ParetoLogic
[#] Key deleted on reboot: HKCU\Software\SlimWare Utilities Inc
[#] Key deleted on reboot: HKCU\Software\UpdaterEX
[#] Key deleted on reboot: HKCU\Software\ConsumerSoft
[-] Key deleted: HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
[-] Key deleted: HKLM\SOFTWARE\ParetoLogic
[-] Key deleted: HKLM\SOFTWARE\SlimWare Utilities Inc
[-] Key deleted: HKLM\SOFTWARE\AVG Tuneup
[#] Key deleted on reboot: HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Extractor Packages
[-] Key deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EE171732-BEB4-4576-887D-CB62727F01CA}
[#] Key deleted on reboot: [x64] HKCU\Software\Bitberry
[#] Key deleted on reboot: [x64] HKCU\Software\Bitberry Software
[#] Key deleted on reboot: [x64] HKCU\Software\ParetoLogic
[#] Key deleted on reboot: [x64] HKCU\Software\SlimWare Utilities Inc
[#] Key deleted on reboot: [x64] HKCU\Software\UpdaterEX
[#] Key deleted on reboot: [x64] HKCU\Software\ConsumerSoft
[-] Key deleted: [x64] HKLM\SOFTWARE\SLIMWARE UTILITIES, INC.
[-] Key deleted: [x64] HKLM\SOFTWARE\DriverAssist
[#] Key deleted on reboot: [x64] HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Zip Extractor Packages
[-] Key deleted: HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69
[#] Key deleted on reboot: [x64] HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF69
[-] Key deleted: [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\50D2BAFD096C90345A82B25A790BDF 69
[-] Value deleted: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\NativeMessagingHosts\avgsh
[-] Key deleted: HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin
[-] Key deleted: HKLM\SOFTWARE\Google\Chrome\Extensions\edmgmpmklgfbohogafcfobonnkogchec




***** [ Web browsers ] *****


[-] Firefox preferences cleaned: "browser.newtab.url" - "hxxp://isearch.shopathome.com/?user_id={ff34f38c-85f1-49f1-ad17-6cbaa907b71a}"
[-] Firefox preferences cleaned: "browser.search.defaultenginename" - "Web Search"
[-] Firefox preferences cleaned: "browser.search.defaultenginename.US" - "Web Search"
[-] Firefox preferences cleaned: "browser.search.selectedEngine" - "Web Search"
[-] Firefox preferences cleaned: "extensions.toolbar@shopathome.com.dsp-about-tabs-original" - "about:newtab"
[-] Firefox preferences cleaned: "extensions.toolbar@shopathome.com.dsp-current" - "Web Search"
[-] Firefox preferences cleaned: "extensions.toolbar@shopathome.com.dsp-original" - "Yahoo"
[-] Firefox preferences cleaned: "extensions.toolbar@shopathome.com.guid" - "{ff34f38c-85f1-49f1-ad17-6cbaa907b71a}"
[-] Firefox preferences cleaned: "extensions.toolbar@shopathome.com.installdate" - "2015-04-22"
[-] [C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Don\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: edmgmpmklgfbohogafcfobonnkogchec
[-] [C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: aol.com
[-] [C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default\Web data] [Search Provider] Deleted: ask.com
[-] [C:\Users\Karen\AppData\Local\Google\Chrome\User Data\Default] [extension] Deleted: edmgmpmklgfbohogafcfobonnkogchec




*************************


:: "Tracing" keys deleted
:: Winsock settings cleared


*************************


C:\AdwCleaner\AdwCleaner[C0].txt - [10512 Bytes] - [18/04/2017 16:32:51]
C:\AdwCleaner\AdwCleaner[R0].txt - [14517 Bytes] - [27/08/2014 15:11:59]
C:\AdwCleaner\AdwCleaner[S0].txt - [13705 Bytes] - [27/08/2014 15:12:58]
C:\AdwCleaner\AdwCleaner[S1].txt - [10729 Bytes] - [18/04/2017 16:31:43]


########## EOF - C:\AdwCleaner\AdwCleaner[C0].txt - [10808 Bytes] ##########


Malwarebytes
Malwarebytes | Free Cyber Security & Anti-Malware Software


-Log Details-
Scan Date: 4/21/17
Scan Time: 1:20 AM
Logfile: Malwarebytes Antimalware.txt
Administrator: Yes


-Software Information-
Version: 3.0.6.1469
Components Version: 1.0.103
Update Package Version: 1.0.1772
License: Trial


-System Information-
OS: Windows 10
CPU: x64
File System: NTFS
User: Don-Karen-PC\Don


-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 529937
Time Elapsed: 9 min, 37 sec


-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled


-Scan Details-
Process: 0
(No malicious items detected)


Module: 0
(No malicious items detected)


Registry Key: 0
(No malicious items detected)


Registry Value: 0
(No malicious items detected)


Registry Data: 0
(No malicious items detected)


Data Stream: 0
(No malicious items detected)


Folder: 0
(No malicious items detected)


File: 0
(No malicious items detected)


Physical Sector: 0
(No malicious items detected)




(end)

Hi and thanks for those logs. You've got a lot going on there; I will just highlight some of the problems I'm seeing.

1. Malwarebytes was run without ROOTKIT scan enabled:

Please open Malwarebytes, select Custom Scan>Configure Scan>select Drive C, and then check the box for Rootkits (as well as the others). We need to determine if any Rootkits exist on the system.

2. In the ADWCleaner scan:

[-] File deleted: C:\WINDOWS\SysNative\roboot64.exe
This indicates RegClean Pro exists on the system.

The Malwarebytes research team has determined that RegClean Pro is a fake registry cleaner. These so-called "registry cleaners" use intentional false positives to convince users that their systems have problems. Then they try to sell you their software, claiming it will remove these problems. More information can be found on our Malwarebytes Unpacked blog.

[-] File deleted: C:\WINDOWS\SysNative\sasnative64.exe
This is a possible Rootkit.

[-] File deleted: C:\WINDOWS\SysNative\drivers\EsgScanner.sys
This indicates SpyHunter exists on the system. This program is not recommended; not at all, not ever.

[-] Service deleted: WtuSystemSupport
This is from AVG Web Tuneup.

[-] Service Deleted: vToolbarUpdater40.3.7
This is from AVG Secure Search (spyware).

3. There are lots of problem profile extensions and search hijackers indicated in your browsers.
ADWCleaner has deleted quite a bit of problems. I wonder if your internet connectivity has improved at all at this time?


At this point, I'd like to see an inventory of all programs installed on the system. Do you have Ccleaner installed? If so, please provide a list for me:




All toolbars, safe search programs, PC & Registry Cleaners, coupon printers, PC Health programs, etc. need to be uninstalled.

If you don't have Ccleaner installed, it's okay, I'd like you to download and run MiniToolBox, and check the items shown in RED below:




MiniToolBox Download

Please post the log when finished.

EDIT:
FYI: I'm not seeing anything major (viruses or malware), but a lot of problems, and after I see this log, I may have you reset all your browsers (instructions to follow).

FYI: some info on FreeFileViewer by Bitberry:
Free File Viewer 2012 by Bitberry Software - Should I Remove It?

More information: with the downloaded upgrade to Malwarebytes, the "custom" scan became an option! However, when I tapped "configure" WIN 10 tried to connect to internet and was unable. Meantime Malwarebytes began its normal scan with no added configuration.

Log removed after use to protect release of private information

I do not have, or at least could not find, free file viewer on my computer; did you see it somewhere or were you just helping me with a warning?

Thanks. It will take me a bit to go through this.
Remnants of FreeFileViewer were found in the scans, that's why I mentioned it. It's a case where you download/install a free program and it tries to install all other kinds of junk, that's all,