Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cannot change Proxy Settings after virus removal


  • Please log in to reply
18 replies to this topic

#1 Tlerew

Tlerew

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 09:49 AM

Hello everyone;

I removed a virus (SearchProtect) from my niece's computer and everything seems okay now except that the computer cannot connect to the internet. It says "Cannot Connect to the proxy server". She does not use a proxy server, and when I go into Internet Tools, Connections, Lan Settings, etc. and have it detect the setting automatically it immediately reverts back to "Use a proxy server".

 

I also removed a trial version of McAfee that had expired on her computer. Either the virus or McAfee wont allow me to change the proxy server settings in internet explorer to "Automatically Detect".

 

I am assuming this is a registry setting that needs changed or perhaps something in the Group Policy but I do not know where to look or what to do.

 

The PC is running Windows 8.1 and IE10. IE10 is the only browser on the PC.

 

Can someone please help.


Edited by hamluis, 10 June 2014 - 09:55 AM.
Moved from MRL to Am I Infected - Hamluis.


BC AdBot (Login to Remove)

 


m

#2 McSheHe

McSheHe

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 10:09 AM

Have you run anything on the machine such as Malwarebytes? RogueKiller is another useful tool that will pick up registry keys that need to be replaced/removed



#3 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 10:14 AM

Yes, I ran MalwareBytes, AdwCleaner, CCLeaner, and ComboFix on the PC. The computer seems clean except I cannot change that one setting.



#4 McSheHe

McSheHe

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 10:17 AM

Try downloading and running RogueKiller. It will most likely pick up a few "PUM Proxy" registry keys that it will replace

 

http://www.adlice.com/softwares/roguekiller/



#5 JohnC_21

JohnC_21

  • Members
  • 21,683 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 10:30 AM

In the search box type regedit Right click Run as Administrator.

 

Make sure the Dword is set to zero at the following keys.

 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

 

ProxyEnable"=dword:00000000

 

MigrateProxy"=dword:00000000

 

If Proxy Enable and MigrateProxy becomes a Dword at 1 after a reboot, malware may be resetting the registry somehow.

 



#6 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 12:13 PM

It does not change back to a 1, but when I go into Internet Options, LAN Settings, and change it to "Automatically Detect Settings", if I get out and back in it changes back to a Proxy Server.



#7 JohnC_21

JohnC_21

  • Members
  • 21,683 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 12:24 PM

See if resetting IE helps. Just in case I would backup your favorites. Also, any add-ons would have to reinstalled.

 

http://support.microsoft.com/kb/923737

 

Edit: When it defaults back to a Proxy Server does it give an address?


Edited by JohnC_21, 10 June 2014 - 12:25 PM.


#8 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 12:27 PM

I have reset IE10 four times now. That does nothing.


The address it reverts back to is 127.0.0.1 Port 8800



#9 McSheHe

McSheHe

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 12:28 PM

Have you run RogueKiller yet? I just resolved this exact issue on a customer's machine with RK



#10 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 12:51 PM

RogueKiller found those registry entries and deleted/changed them, but I still cannot change the Lan Settings in Internet Options. Once I change them to Automatically Detect, it reverts right back to "Use A Proxy Server"



#11 McSheHe

McSheHe

  • Members
  • 42 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 12:57 PM

Bring out the charms menu with Windows+C > Settings > Change PC Settings > Network > Proxy. See if those settings are setup correctly



#12 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 01:10 PM

Right now I am running the McAfee Removal Tool. I see that even though I uninstalled the trial version of McAfee from this PC, I still had McAfee services running in the background. I read some post somewhere that certain Anti-Virus programs can cause this issue as well.



#13 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 01:29 PM

McAfee removal tool removes all of the running services in the back ground. I re-ran Rogue killer and it found those same registry entries and changed them, restarted, and they are back again.



#14 JohnC_21

JohnC_21

  • Members
  • 21,683 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:01:41 AM

Posted 10 June 2014 - 01:49 PM

It's interesting that RougeKiller didn't fix it. Are you are running the standard Windows firewall?

 

Download and run Rkill. Let it finish terminating any processes. Do not boot but run Malwarebytes and do a scan. Then run Hitman Pro again. If the problem is not fixed, I would post in the Malware Removal Forum and let the experts fix the problem.

 

http://www.bleepingcomputer.com/download/rkill/



#15 Tlerew

Tlerew
  • Topic Starter

  • Members
  • 19 posts
  • OFFLINE
  •  
  • Local time:02:41 AM

Posted 10 June 2014 - 02:04 PM

Yes, now I am. It was running McAfee Firewall until I uninstalled it. I actually tried turning off Windows Firewall as well to see if I could connect to the internet, before I realized that the Proxy Server settings keep reverting back. I just re-ran MWB and RK and still no luck.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users