Please don't cry. I know that this must be very frustrating for you, but your computer will recover if you're patient.
I don't use windows explorer, but it is on my pc. Was the dormant IE the vehicle the bug used to initially stay in my PC?
Explorer.exe is the program that provides the graphical user interface in Windows. It is the desktop, the start menu, the tooltips, and of course the file browser. It is a different program entirely than the Internet Explorer web browser (iexplore.exe). It is the "look and feel" of Windows. You can load a different look and feel (Stardock's "Object Desktop" for example), though few people do. IE almost surely wasn't the source of the trouble. My guess is, you inadvertently ran a little program attached to that bogus Facebook email which added the command to launch the trojan to the (existing) command in the Windows registry that starts the shell. Dr Guy is right, though - the HTML rendering engine that IE is built on is also used by the file browser (aka Windows Explorer) and most 3d-party apps that use HTML to draw their user interfaces, so you can't get rid of it.
Is there a way to boot up in this linux live cd (or similar) for times when I am accessing the web? My thought is that if so many of there bugs target Window, and IE, then I should use an OS that the bug can't make its changes in?
Sure. I don't think the AVG LiveCD will be very convenient for everyday use, but there are lots of alternatives. You can download a small distribution like Puppy (130MB; http://puppylinux.org/) or DSL (50MB; http://www.damnsmalllinux.org/) to get you back to work until you can sort out your Windows issues, or Ubuntu (700MB; http://www.ubuntu.com/) if the size of the download doesn't deter you.
I know that much of that must have sounded very confusing. (Because it IS very confusing.) I was hoping that yrag will continue to help you and can fill in the details; s/he seemed to understand what had happened, and my purpose was just to delay you from doing something perfectly awful like completely erasing your HDD before yrag or someone at bleepingcomputer could get you sorted out. The problem yrag was having was that s/he couldn't figure out how the Trojan was starting, and s/he couldn't find the process it was running in and so couldn't try to stop it. (At which point Avira would probably be able to clean up the mess - don't you just love its little umbrella?)
Malware as "noisy" as this one isn't likely to be very sophisticated, so I suggested twiddling a registry entry that the trojan might not be monitoring as a way to start Windows without starting the trojan, too. You should understand clearly what changes you're going to make to the registry before you do it, because you'll bork the OS if it can't find the shell. (Reversibly, though, once you've got your AVG rescue CD in hand.)
Using the lingo of document [3], the trojan has edited key2 so that the trojan is started immediately after the shell (desktop et al.) has started. Instead of one command:
Explorer.exe
the OS runs two commands
Explorer.exe
rundll32.exe ttux.qqo uudigo
The first command starts the shell, the second command starts the trojan. Avira tried to delete that second command for you
[NOTE] The registration entry <HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell> was removed successfully.
but evidently the trojan replaced it again. Key2 is the default command to start the shell. If there is a Key3 for a particular user, the OS will use the command in Key3 to start the shell instead of the (infected) command in Key2. Usually there IS no Key3, so there's a chance that the trojan isn't monitoring it. If you create Key3 for a user account and set it to run explorer.exe, the OS will skip Key2 and use Key3 instead - the shell will start when that user logs in, but the trojan won't. Now when you run Avira, what Avira wants to delete will get deleted.
If it turns out that the trojan is monitoring the default Key3 location, you could change Key1 to point to a different location for Key3, set that non-standard Key3 location to "explorer.exe", and hope that the trojan wasn't smart enough to follow Key1 to the new Key3 location. Let's see what happens with Key3 first, though.
If you can run regedit (start > Run > regedit.exe), look for these three keys and report back if there is something fishy about Key2 or Key3. (Like, Key3 is defined and exactly like infected Key2, or maybe Key2 doesn't appear to have a hitchhiker anymore.) When you feel brave enough, add Key3, restart your computer, and run regedit again to see if the trojan changed Key3. If not, run Avira again and celebrate. (Just a little though - there could be other nasties under the hood yet.)
Visual aids: http://s1006.photobucket.com/albums/af184/expertwitness/Windows%20shell%20keys/
