here is what smartscab by cis shows
comodo says some files couldnt be removed and shoes all 15 again on next scan
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\andromedical.com*
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com\www*
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com\www
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com*
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\okulta.com*
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\andromedical.com\www*
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\andromedical.com\www
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\andromedical.com*
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com\www*
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com\www
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com*
Rootkit.HiddenValue[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\okulta.com*
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mp3musicdirect.com
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\andromedical.com
Rootkit.HiddenKey[at]0 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\okulta.com