Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I sat down at my computer this morning and could not access any web sites using Firefox. FF was telling me that "Firefox is configured to use a proxy server that is refusing connections." So I check my settings and sure enough, it's set to "Use System Proxy Settings." Thinking this was suspicious, I checked IE, and sure enough it's set up to use a proxy. But just like FF I couldn't actually browse to any sites until I set to option to "No Proxy".

Now I don't use a proxy and never have before. So I'm not sure how these settings "magically" appeared. I imagine they can be set through a registry entry. Does it seem likely that I have a virus or some sort of malware? I am running Win7 64-bit and for AV I'm using MS Security Essentials. I ran Malwarebyte's Anti-Malware but no problems were detected. Are there any known legitimate programs that will change the proxy settings without warning?

share|improve this question
    
Maybe somebody else did it. –  systemovich Jul 29 '10 at 14:14
    
@Geoffrey - Seems unlikely, but not outside the realm of possibility. I will try to look for evidence of remote access. –  BrianB Jul 29 '10 at 16:05

4 Answers 4

up vote 1 down vote accepted

I have had this happen a couple of times in the last month or two and I have seen or heard of it happening to co-workers recently. In all of these cases it was due to malware. You may want to run a second tool in addition to MalwareBytes. The two times it happened to me none of my tools detected the problem. I ran MSConfig and there was a new process set to run during the startup.

You could also use Process Explorer from MS to see the location of all running processes:

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

You will need to go to View->Select Columns and make sure Image Path is selected in order to see the location of each running process. Anything running from temporary locations would be suspicious. I usually sort the view by image path...makes it quicker to see problem locations. Any suspicious files could be uploaded to VirusTotal.com.

share|improve this answer
    
Nothing suspicious in MSConfig or Process Explorer -- but Spybot found 81 problems... –  BrianB Jul 30 '10 at 23:03

Fiddler could be the cause. I debug my Silverlight application calls via Fiddler and have realised that launching Fiddler does automatically check the "Use a proxy server for LAN" checkbox. Uncheck the box and do not re-launch Fiddler, and all is well (though at times Fiddler does not track the traffic from that browser instance).

share|improve this answer
    
this totally worked for me. my machine's battery died while running fiddler. Since I didn't properly exit from it, it hosed my settings. Damn, I never would have figured that out. I just ran fiddler again, then went to File > Stop Capturing (first option). now my browsers work again. yay! –  viggity Dec 12 '13 at 3:11

When the malware installs, it plants a proxy program on your system, then configures firefox to use the proxy 127.0.0.1 (localhost) on some weird port (this is of course the port on which the proxy program is taking requests.) When you google something, your request goes through the proxy program and then to the internet. The proxy program searches your request and then sometimes returns relevant ads when you click the link. Some malware proxies are also commanded to block anti malware searches and websites. I a doozy once, so i went to malwarebytes site, but it wouldn't go through. Anyway.. that's how it works. After the malware is removed, the server refuses connections, so you will just need to configure it to use 'no proxy'.

Malwarebyte's ftw!

share|improve this answer

I wouldn't bother with a problem like this, unless it's recurrent. If you set it to no proxy and your browser will stay that way in the future, there is no reason to investigate further. Maybe it was a Windows update or browser update installed recently which messed up some settings.
If the problem persists and the settings reverts to use a proxy, than you may have a malware, but your setup looks secure enough.

share|improve this answer
1  
Could this have anything to do with using Fiddler web debugger? I was using it quite a bit yesterday, but I didn't notice any browsing issues until this morning. –  BrianB Jul 29 '10 at 13:07
    
Sorry, I know nothing about Fiddler ... –  Patkos Csaba Jul 29 '10 at 18:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.