2

I am running IE8 & Firefox 3.0.12 on an XP SP3 PC at work. I think some program is overwriting my proxy settings. How do I figure out what that program is?
I set the proxy settings to :

proxy.domain.com port 8080

This will be overwritten at some later stage to :

localhost 8888

This problem is particularly bad for Firefox. Every time I open it the settings have been changed.

3 Answers 3

2

That sounds like malware behavior. Try to figure out how long it takes for the settings to be overwritten. Once you know how big the window is for it to change. Then you know how long it should take to happen again. Run process explorer and then kill processes that look suspicious until the behavior stops. When it stops, you likely have enough information to proceed.

I would pay especially close attention to "rundll" and "svchost" processes as these are methods which are especially convenient to hide malware on your system.

Get Process Explorer Here

2

It turns out it is Fiddler that is overriding my settings. When it runs, the proxy settings are changed to use it, on port 8888. When it stops, then proxy settings are returned to normal. I must have crashed it a couple of times, leaving the settings pointing to the non-existant Fiddler proxy.

1

You can also try WinPatrol. You can set up alerts for any time a registry change is made.

Spybot S&D's real-time monitor also monitors registry changes.

I hope this helps.

1
  • I tried WinPatrol, but it didn't seem to mind when Fiddler changed the proxy settings. Maybe I didn't configure it correctly.
    – Anthony K
    Aug 20, 2009 at 0:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .