Click on Do a System Scan and Save a LogFile
This will automatically open NotePad
Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy
REPLY to this thread, and PASTE the results here
Message Edited by ky331 on 04-18-200608:38 AM
Windows 10 Pro (64-bit), Panda DOME 18.7.4, MBAM3 Pro, Windows Firewall, OpenDNS Family Shield, SpywareBlaster, MVPS HOSTS file, MBAE Premium, MCShield, WinPatrol PLUS, SAS (on-demand scanner), Zemana AntiLogger Free, Microsoft EDGE, Firefox, Pale Moon, uBlock Origin, CryptoPrevent.
[I believe computer-users who sandbox (Sandboxie) are acting prudently.]
I think that's a yahoo tool bar install program. Try running Ccleaner in Safe Mode:
Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see
the PC maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login or you won't find
the programs you put on the desktop.
OK we are getting there. Just the one line left:
O20 - AppInit_DLLs: mad.dll
We are going to try unlocker on it.
Get it and install it.
Then Right click on Start and select Explore. Then in the new window find the Views icon (bottom right of the two toolbars at the top. Looks like a little window with a down arrow. Press it and select Details. Then select Tools, Folder Options, check Use Windows Classic Folders, Apply then View, check Show Hidden Files and Folders, and uncheck the two that start with Hide. (ignore the warning) then say Apply. Then press Like Current Folder. OK.
Now locate the Windows\System32 folder (My Computer=> Local Disk C: => Windows =>System32 and click once on it. In the right pane will be a stupid message from Windows saying you don't need to see these files but if you insist click here (or words to that effect). When you click the link an alphabetical list of folders and files should appear. Scroll down until you find mad.dll and rightclick on it and select Unlocker then use unlocker to unlock and delete the file.
If it appears to have worked, run a new HJT scan only and check the entry if it still shows and Fix Checked then reboot and make a new HJT log and post it.
Message Edited by RKinner on 04-19-200609:58 AM