Strange registry keys

Comodo Internet Security - CIS Install / Setup / Configuration Help - CIS
#1

Hello

I get some additionnal and temporary registry keys beginning by RK_ Are they related to Comodo ?

#2

Hi jeromex,
They don’t belong to any Comodo product as far as I know.
I have four Comodo programs on my systems, but I do not have those entries.

Do you have anything installed from RK Softwares (Miracle Accounting)?

Thanks.

#3

Non I have not some application from it but I used RogueKiller regularly, I posted on their forum too and also on Sandboxie forum. Google brings nothing and this is the most disturbing

#4

Can you post a screenshot of what’s ‘inside’ those key’s? (clicking the [nobbc][x][/nobbc] open).
It seems remotely close to a tool I use to mount ‘offline’ registry files.

#5

I had not the idea to make a back up of these keys though I could inspect them without any problems, in what I saw they seem to be a sort of partial copy of the right keys, that is all I had the idea to do : http://i.imgur.com/lVB0r2t.jpg

and I used Sandboxie 4.12 at that period but it is not clearly related with it, reproduction tests does not work
The only thing I did with sandboxie was opening Internet Explorer 8 to have a visual control on the status of my ethernet modem
I use Erunt sometimes but for 8 years I never noticed anything like that
I had problems of Windows activation too during that period but it is OK now

#6

If the key’s still exist you can use Regscanner from nirsoft.net to see what time/date they where created.
That might give a hint to what happened more on your system around that time.

Once you have the create date, you can scan your registry on that specific date, and maybe use Alternative to Windows Search For Files + Duplicates Search to scan your disk for that date.
That way you can maybe find a related software that was installed/used around the same time.

Last you could run a 2nd opinion scanner like HitmanPro, which has a good remnant scanner for leftovers of infections www.surfright.nl

#7

Thanks, it can be useful.

I had the answer on Roguekiller’s forum and they say it is Roguekiller’s legit keys

Yesterday after or during a scan with it, I had noticed some files in Temp directory with the RK in their names, so I am not very surprised.

#8

Thanks for the feedback.