Originally Posted by
Zlix
and here is hijackthis log after reboot (i didn't know that hijackthis overwrite logs so i don't have log before rebooting)
Actually, it doesn't, but you posted the log that was needed anyway

.
==
Can you please do the following.
===============
Can you disable
Windows Defender as it may interfere with the removal process. Please leave it disabled until your PC has been given the all clear.
- Open Windows Defender
- Click Tools
- Click General Settings
- Scroll down to Real Time Protection Options
- Uncheck Turn on Real Time Protection (recommended)
- After you uncheck this, click on the Save button
- Close Windows Defender
===============
Scan with
HijackThis and then place a check next to all the following, if present:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - Startup: AutorunsDisabled
O4 - Global Startup: AutorunsDisabled
O9 - Extra button: (no name) - AutorunsDisabled - (no file)
Now, close
all instances of Internet Explorer and any other windows you have open except
HiJackThis, click "
Fix checked".
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.