Kevin, in your instructions Step 3 precedes Step 2. I assumed it was a typo and did 3 first.
The OTL files were over capacity, I had to attach them.
Here are the next set of logs:
RogueKiller V6.2.2 [12/31/2011] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback:
http://www.geekstogo.com/forum/files/file/413-roguekiller/Blog:
http://tigzyrk.blogspot.comOperating System: Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User: ibn [Admin rights]
Mode: Scan -- Date : 01/08/2012 14:55:13
¤¤¤ Bad processes: 0 ¤¤¤
¤¤¤ Registry Entries: 6 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
[HJ] HKCU\[...]\ClassicStartMenu : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
[HJ] HKCU\[...]\NewStartPanel : {645FF040-5081-101B-9F08-00AA002F954E} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver: [NOT LOADED] ¤¤¤
¤¤¤ Infection : ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost
::1 localhost
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: +++++
--- User ---
[MBR] 8aed8e2a5efb8ec6efb681066600ca24
[BSP] f9411680eb20257ebec59c1df8564283 : Windows 7 MBR Code
Partition table:
0 - [XXXXXX] FAT16 [HIDDEN!] Offset (sectors): 63 | Size: 41 Mo
1 - [ACTIVE] NTFS [VISIBLE] Offset (sectors): 81920 | Size: 15728 Mo
2 - [XXXXXX] NTFS [VISIBLE] Offset (sectors): 30801920 | Size: 304301 Mo
User = LL1 ... OK!
User = LL2 ... OK!
+++++ PhysicalDrive1: +++++
--- User ---
[MBR] a01d0af9fd801c08dba6a1398b6e1032
[BSP] df4f83c1f72e36823a12b0dfc7617313 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT16 [VISIBLE] Offset (sectors): 249 | Size: 2031 Mo
User = LL1 ... OK!
Error reading LL2 MBR!
Finished : << RKreport[2].txt >>
RKreport[1].txt ; RKreport[2].txt
----------
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-08 14:59:05
-----------------------------
14:59:05.773 OS Version: Windows x64 6.1.7601 Service Pack 1
14:59:05.773 Number of processors: 2 586 0x170A
14:59:05.773 ComputerName: MERCURYIII UserName: ibn
14:59:07.271 Initialize success
14:59:07.411 AVAST engine defs: 12010800
14:59:42.714 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
14:59:42.714 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
14:59:42.730 Disk 0 MBR read successfully
14:59:42.730 Disk 0 MBR scan
14:59:42.730 Disk 0 Windows 7 default MBR code
14:59:42.745 Disk 0 Partition 1 00 DE Dell Utility Dell 8.0 39 MB offset 63
14:59:42.745 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 15000 MB offset 81920
14:59:42.777 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 290204 MB offset 30801920
14:59:42.777 Service scanning
14:59:44.851 Modules scanning
14:59:44.851 Disk 0 trace - called modules:
14:59:44.898 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
14:59:44.898 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa800445e060]
14:59:44.914 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004102050]
14:59:45.741 AVAST engine scan C:\Windows
14:59:48.861 AVAST engine scan C:\Windows\system32
15:01:26.955 AVAST engine scan C:\Windows\system32\drivers
15:01:45.786 AVAST engine scan C:\Users\ibn
15:07:20.547 Disk 0 MBR has been saved successfully to "C:\Users\ibn\Desktop\MBR.dat"
15:07:20.562 The log file has been saved successfully to "C:\Users\ibn\Desktop\aswMBR log.txt"
-----------------------
OTL files were over capacity see attachedd
