BleepingComputer.com: IE not working, Malwarebytes not updating

Hello, and I hope you can help.
A week or so ago I got Internet Security 2010. I followed instructions here used rkill and malwarebytes and got rid of it. However searches were being redirected to random places in both IE and firefox. Nothing was found by malwarebytes, Symantec or Adaware.
Yesterday I got someother scareware similar to IS 2010 and removed it using the same methods. But now I have other problems. Malwarebytes won't update, IE 7 won't update, I couldn't post to this forum on the infected laptop. I also had the problem that hibernation wasn't working but chkdsk seems to have fixed that.

The error when I can't update malwarebytes is Error code 732(12029,0)

It is a laptop running XP professional.
Here are my Malwarebytes logs.

thanks!
Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/25/2010 11:49:03 AM
mbam-log-2010-01-25 (11-49-03).txt

Scan type: Quick Scan
Objects scanned: 122554
Time elapsed: 9 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.11

1/24/2010 12:06:19 PM
mbam-log-2010-01-24 (12-06-19).txt

Scan type: Full Scan (C:\|)
Objects scanned: 273243
Time elapsed: 1 hour(s), 17 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Hi, first if you have rebooted the PC you will need to get a new copy of RKill and run again,then try MBAM.

RKill....

Please download Rkill by Grinler and save it to your desktop.

Link 2
Link 3
Link 4

• Double-click on the Rkill desktop icon to run the tool.
  
• If using Vista, right-click on it and Run As Administrator.
  
• A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  
• If not, delete the file, then download and use the one provided in Link 2.
  
• If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  
• If the tool does not run from any of the links provided, please let me know.

You will need to run the application again if rebooting the computer occurs along the way.

Manually Downloading Updates:
Manually download them from HERE and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.


Next run ATF and SAS: If you cannot access Safe Mode,run in normal ,but let me know.

Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

From your regular user account..
Download Attribune's ATF Cleaner and then SUPERAntiSpyware , Free Home Version. Save both to desktop ..
DO NOT run yet.
Open SUPER from icon and install and Update it
Under Scanner Options make sure the following are checked (leave all others unchecked):
Close browsers before scanning.
Scan for tracking cookies.
Terminate memory threats before quarantining.
Click the "Close" button to leave the control center screen and exit the program. DO NOT run yet.

Now reboot into Safe Mode: How to enter safe mode(XP)
Using the F8 Method
Restart your computer.
When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
Select the option for Safe Mode using the arrow keys.
Then press enter on your keyboard to boot into Safe Mode.

Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

NOW Scan with SUPER
Open from the desktop icon or the program Files list
On the left, make sure you check C:\Fixed Drive.
Perform a Complete scan. After scan,Verify they are all checked.
Click OK on the summary screen to quarantine all found items.
If asked if you want to reboot, click "Yes" and reboot normally.

To retrieve the removal information after reboot, launch SUPERAntispyware again.
Click Preferences, then click the Statistics/Logs tab.
Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
If there are several logs, click the current dated log and press View log.
A text file will open in your default text editor.
Please copy and paste the Scan Log results in your next reply.
Click Close to exit the program.


Please ask any needed questions,post 2 logs and Let us know how the PC is running now.

Thanks! I am working on it. Will take a while to run all the scans.

Well Mbam is about 1/2 to 1 hour and SAS will be 1 + depending on many things.

Okay, I did something wrong the first time. I didn't run malwarebytes first. I ran the ATF cleaner without a problem. SuperAntispyware didn't find anything.
The log:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/25/2010 at 02:48 PM

Application Version : 4.33.1000

Core Rules Database Version : 4446
Trace Rules Database Version: 1978

Scan type : Complete Scan
Total Scan Time : 01:12:55

Memory items scanned : 623
Memory threats detected : 0
Registry items scanned : 5944
Registry threats detected : 0
File items scanned : 135361
File threats detected : 0


So I started over. I redownloaded rkill and did it more than once. But when I update mbam manually it seems to work, but then when I try to run the program I get the following error.
Error Code: 730 (0, 0)
I tried uninstalling it, redownloading it and running it, it works until I try the updating. I don't have another computer right now to try the other method of updating. I can try that later at home. Any other thoughts?
Thanks.

I forgot, I was unable to boot into safe mode. When I tried just now, the computer gave me a list of .sys files, then a blue screen and immediately rebooted itself. It did let me reboot using last known good config.

Ok, we'll try a few things, first
SUPERAntiSypware has a built in "Repairs" feature to fix policy restrictions and certain Windows settings which are sometimes targeted by malware infection. To use this feature, launch SUPERAntiSypware.

• Click the Repairs tab.
  
• Click on (highlight) "Repair broken SafeBoot key" and then click the Repair button.
  
• You may be asked to reboot your computer for the changes to take effect.

Now if that works run DRWeb in safe mode. Again if not ,run in normal.( This is long also.)
Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download Dr.Web CureIt and save it to your desktop. DO NOT perform a scan yet.
alternate download link
Note: The file will be randomly named (i.e. 5mkuvc4z.exe).

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on the randomly named file to open the program and click Start. (There is no need to update if you just downloaded the most current version
  
• Read the Virus check by DrWeb scanner prompt and click Ok where asked to Start scan now? Allow the setup.exe to load if asked by any of your security programs.
  
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
  
• If prompted to dowload the Full version Free Trial, ignore and click the X to close the window.
  
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All. (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• After the Express Scan is finished, put a check next to Complete scan to scan all local disks and removable media.
  
• In the top menu, click Settings > Change settings, and uncheck "Heuristic analysis" under the "Scanning" tab, then click Apply, Ok.
  
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
  
• Please be patient as this scan could take a long time to complete.
  
• When the scan has finished, a message will be displayed at the bottom indicating if any viruses were found.
  
• Click Select All, then choose Cure > Move incurable.
  
• In the top menu, click file and choose save report list.
  
• Save the DrWeb.csv report to your desktop.
  
• Exit Dr.Web Cureit when done.
  
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
  
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

MBAM 732 error
1. Uninstall Malwarebytes' Anti-Malware using Add/Remove programs in the control panel.
2. Restart your computer (very important).
3. Download and run this utility. Mbam clean
4. It will ask to restart your computer (please allow it to).
5. After the computer restarts, install the latest version from here. http://www.malwarebytes.org/mbam-download.php
Note: You will need to reactivate the program using the license you were sent.
Note: If using Free version, ignore the part about putting in your license key and activating.
Launch the program and set the Protection and Registration.
Then go to the UPDATE tab if not done during installation and check for updates.
Restart the computer again and verify that MBAM is in the task tray and run a Quick Scan and post that log.

I did the SAS repair, but was still not able to boot into safemode. I got the same list of .sys files and a blue screen and it immediately rebooted.
I downloaded the DrWeb from the alternate site, was unable to run it as it said it was expired. I ran the update and then it worked. It found 3 things, the logs are below. The first site for DrWeb gave me a http not found 404 error.

I did the uninstall, reboot, clean, reboot, and reinstall of Malwarebytes. However, it still did not update. I got the same error as before Error code 732(12029,0). I ran a quick scan. Log is below.
Thanks.

4076ba25-25d36aba\myf/y/AppletX.class;C:\Documents and Settings\SOMUser\Application Data\Sun\Java\Deployment\cache\6.0\37\4076ba25-25d36aba;Exploit.CVE2008.5353;;
4076ba25-25d36aba\myf/y/LohanuF.class;C:\Documents and Settings\SOMUser\Application Data\Sun\Java\Deployment\cache\6.0\37\4076ba25-25d36aba;Exploit.CVE2008.5353;;
4076ba25-25d36aba;C:\Documents and Settings\SOMUser\Application Data\Sun\Java\Deployment\cache\6.0\37;Archive contains infected objects;Moved.;
Informs 2009 Expenses.xlsx\xl/sharedStrings.xml;C:\Documents and Settings\SOMUser\My Documents\ISOM\Informs 2009 Expenses.xlsx;Modification of BAT.Bug.1295;;
Informs 2009 Expenses.xlsx;C:\Documents and Settings\SOMUser\My Documents\ISOM;Archive contains infected objects;Moved.;





Malwarebytes' Anti-Malware 1.44
Database version: 3510
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/26/2010 11:35:58 AM
mbam-log-2010-01-26 (11-35-58).txt

Scan type: Quick Scan
Objects scanned: 121349
Time elapsed: 6 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I have been able to update malwarebytes manually by moving rules.ref from a clean pc. I still can't connect thru Internet explorer but firefox works. I am still being redirected to random sites when searching. Here are the latest logs from Dr Web and Malwarebytes. Please advise what to do next as my problems are still there. Thanks.

Process in memory: C:\Program Files\Mozilla Firefox\firefox.exe:2616;;BackDoor.Tdss.565;Eradicated.;


Malwarebytes' Anti-Malware 1.44
Database version: 3643
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

1/27/2010 3:16:09 AM
mbam-log-2010-01-27 (03-16-09).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 271173
Time elapsed: 1 hour(s), 9 minute(s), 29 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Let's see about rootkits and if there is something still blocking IE.

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Check
  
• Push the Start button.
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

Please download mbr.exe and save it to the root directory, usually C:\ <- (Important!).

• Go to Start > Run and type: cmd.exe
  
• press Ok.
  
• At the command prompt type: c:\mbr.exe >>"C:\mbr.log"
  
• press Enter.
  
• The process is automatic...a black DOS window will open and quickly disappear. This is normal.
  
• A log file named mbr.log will be created and saved to the root of the system drive (usually C:\).
  
• Copy and paste the results of the mbr.log in your next reply.

If you have a problem using the command prompt, you can just double-click on mbr.exe to run the tool.

Thanks for the answer.

No luck with the ESET scan. Since I don't have IE working, I followed the directions for other browsers. But after I click agree and start, it says it can't connect and is the proxy configured. There shouldn't need to be one? I'm at home on wireless.

I ran MBR (by double clicking in the c:\ ). Here is the log.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 61 !
copy of MBR has been found in sector 62 !


So I have been reading and if I have a rootkit I need to reformat. How can we tell? Also I am getting lots of popups as well as no IE and the updating issues and the redirects. I still can't boot into safemode. Also, If I click on diagnose connection problem in IE window, it says "Windows cannot connect to the Internet using HTTP, HTTPS, or FTP. This is probably caused by the firewall settings on this computer. Check the firewall settings for HTTP port (80) HTTPS port (443) and FTP port (21)."

Thanks!

OK try turning off the Firewall and see if you can connect. If so Get off quick.

See if this fixes your Net issues .

Go to Start ... Run and type in cmd
A dos Window will appear.
Type in the dos window: netsh winsock reset
Click on the enter key.

Reboot your system to complete the process.


We Need to check for Rootkits with RootRepeal

• Download RootRepeal from the following location and save it to your desktop.
  • Direct Download (Recommended)
    • Primary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
      
    • Secondary Mirror
    
    
  • Zip Mirrors (Recommended if you have a slower connection or if the Direct Download mirror is down)
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
    
    
  • Rar Mirrors - Only if you know what a RAR is and can extract it.
    
    • Primary Mirror
      
      
    • Secondary Mirror
      
      
    • Secondary Mirror
  
  
• Extract RootRepeal.exe from the archive (If you did not use the "Direct Download" mirror).
  
• Open on your desktop.
  
• Click the tab.
  
• Click the button.
  
• Check all seven boxes:
  
• Push Ok
  
• Check the box for your main system drive (Usually C:), and press Ok.
  
• Allow RootRepeal to run a scan of your system. This may take some time.
  
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

Your decision as to what action to take should be made by reading and asking yourself the questions presented in "When Should I Format, How Should I Reinstall?" In some instances an infection may have caused so much damage to your system that it cannot be completely cleaned or repaired. Wiping your drive, reformatting, and performing a clean install of the OS or doing a factory restore removes everything and is the safest action but I cannot make that decision for you.

Reformatting a hard disk deletes all data. If you decide to reformat, you can back up all your important documents, data files and photos. The safest practice is not to backup any autorun.ini or .exe files because they may be infected. Some types of malware may disguise itself by adding and hiding its extension to the existing extension of files so be sure you take a close look at the full name. After reformatting, as a precaution, make sure you scan these files with your anti-virus prior to copying them back to your hard drive.

Hi,

Turning off the firewall made no difference for running IE.

The "netsh winsock reset" didn't work either.

Here is the root repeal report. Thanks.


ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/01/28 10:01
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys
Address: 0x991C9000 Size: 819200 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x983F4000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

SSDT
-------------------
#: 012 Function Name: NtAlertResumeThread
Status: Hooked by "<unknown>" at address 0x89d21eb8

#: 013 Function Name: NtAlertThread
Status: Hooked by "<unknown>" at address 0x89e55380

#: 017 Function Name: NtAllocateVirtualMemory
Status: Hooked by "<unknown>" at address 0x89fdca88

#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299bbc

#: 031 Function Name: NtConnectPort
Status: Hooked by "<unknown>" at address 0x89f6ddd8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299a78

#: 043 Function Name: NtCreateMutant
Status: Hooked by "<unknown>" at address 0x8a018770

#: 053 Function Name: NtCreateThread
Status: Hooked by "<unknown>" at address 0x8a0c9e98

#: 063 Function Name: NtDeleteKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x9929a02c

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299f56

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x9929964e

#: 083 Function Name: NtFreeVirtualMemory
Status: Hooked by "<unknown>" at address 0x89c2edb8

#: 089 Function Name: NtImpersonateAnonymousToken
Status: Hooked by "<unknown>" at address 0x89d21c88

#: 091 Function Name: NtImpersonateThread
Status: Hooked by "<unknown>" at address 0x89d21cf8

#: 108 Function Name: NtMapViewOfSection
Status: Hooked by "<unknown>" at address 0x89f6e5c0

#: 114 Function Name: NtOpenEvent
Status: Hooked by "<unknown>" at address 0x89d21e48

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299b52

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x9929958e

#: 123 Function Name: NtOpenProcessToken
Status: Hooked by "<unknown>" at address 0x89e55460

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x992995f2

#: 129 Function Name: NtOpenThreadToken
Status: Hooked by "<unknown>" at address 0x8aafac88

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299c72

#: 192 Function Name: NtRenameKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x9929a0fa

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299c32

#: 206 Function Name: NtResumeThread
Status: Hooked by "<unknown>" at address 0x89d32b18

#: 213 Function Name: NtSetContextThread
Status: Hooked by "<unknown>" at address 0x89fecc70

#: 228 Function Name: NtSetInformationProcess
Status: Hooked by "<unknown>" at address 0x8a0171e0

#: 229 Function Name: NtSetInformationThread
Status: Hooked by "<unknown>" at address 0x8a0be5e8

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0x99299db2

#: 253 Function Name: NtSuspendProcess
Status: Hooked by "<unknown>" at address 0x89d21dd8

#: 254 Function Name: NtSuspendThread
Status: Hooked by "<unknown>" at address 0x89e474b0

#: 257 Function Name: NtTerminateProcess
Status: Hooked by "C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys" at address 0x993d70b0

#: 258 Function Name: NtTerminateThread
Status: Hooked by "<unknown>" at address 0x8a02e008

#: 267 Function Name: NtUnmapViewOfSection
Status: Hooked by "<unknown>" at address 0x8a046b18

#: 277 Function Name: NtWriteVirtualMemory
Status: Hooked by "<unknown>" at address 0x8a035fc0

==EOF==

Hi, Was IE 7 an upgrade from 6?

Toward the connection isssue..

Try this--open control, internet options, connections tab, lan settings, uncheck the box next to "use proxy...."
<><><>
Go Start > Run > type: "cmd" In the window that appears type: "ipconfig /flushdns". Close the command box.

Go Start > Control Panel > Network Connections. Right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and and choose Properties. Double-click on the Internet Protocol (TCP/IP) item. Select the radio button that says "Obtain DNS servers automatically". Reboot. Warning: Some Internet Service Providers need specific DNS settings. You need to make sure that you know if such DNS settings are required before you make this change.

><><>><

LSP-Fix
Repairs Winsock 2 settings, caused by buggy or improperly-removed Internet software, that result in loss of Internet access
LSP-Fix Home Page
Using LSP-Fix to remove Spyware & Hijackers

OMG that is embarrassing. Yes, unclicking the proxy box worked. So now IE is back. And I am able to update MBAM and I ran ESET. Here is the log. It found one thing. But I still get redirects in the search engines. Did the root repeal tell us anything? I unfortuately have no idea what these logs mean.

Thanks!

C:\Documents and Settings\SOMUser\DoctorWeb\Quarantine\4076ba25-25d36aba a variant of Java/TrojanDownloader.Agent.NAD trojan deleted - quarantined