The log from combofix i do not have it, that if that log is located inside the folder of combofix (if it is saved some other place, tell me and i’ll provide it).

i deleted combofix yesterday after i had run it. after reboot combofix was in some kind of loop, opening and closing one DOS window without end, after 5 minutes force ended it and deleted combofix. today after more thinking it could be the fact that my Windows XP automatically logs in with a limited acces account. i ran combo initially as an admin account but at restart maybe he ran as the limited one, therefor the loop.

i attach the log from roguekiller and OTL after repair and quick scan.

at this point, the links from my programs and quicklunch are still gone and i don’t believe is possible to get them back. i tried with GetDataBack NTFS, searched them but they are corrupt. it is my fault as i deleted immediately after being infected all my temp files.

thanks alot for all your help

edit: as we speak the aswMBR is running and again in poped up the red flag:

15:29:56.953 Disk 0 trace - called modules:
15:29:56.968 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x86bfb3a8]<<
15:29:56.968 1 nt!IofCallDriver → \Device\Harddisk0\DR0[0x86fd7ab8]
15:29:56.968 3 CLASSPNP.SYS[f755cfd7] → nt!IofCallDriver → \Device\00000089[0x86fd8f18]
15:29:56.968 5 ACPI.sys[f73cc620] → nt!IofCallDriver → \Device\Ide\IdeDeviceP1T0L0-e[0x86f5e940]
15:29:56.968 \Driver\atapi[0x86fcdc00] → IRP_MJ_CREATE → 0x86bfb3a8
15:29:57.234 AVAST engine scan C:\WINDOWS
15:30:08.187 AVAST engine scan C:\WINDOWS\system32