I sat down at my computer this morning and could not access any web sites using Firefox. FF was telling me that "Firefox is configured to use a proxy server that is refusing connections." So I check my settings and sure enough, it's set to "Use System Proxy Settings." Thinking this was suspicious, I checked IE, and sure enough it's set up to use a proxy. But just like FF I couldn't actually browse to any sites until I set to option to "No Proxy".

Now I don't use a proxy and never have before. So I'm not sure how these settings "magically" appeared. I imagine they can be set through a registry entry. Does it seem likely that I have a virus or some sort of malware? I am running Win7 64-bit and for AV I'm using MS Security Essentials. I ran Malwarebyte's Anti-Malware but no problems were detected. Are there any known legitimate programs that will change the proxy settings without warning?

  • Maybe somebody else did it.
    – Geoffrey
    Jul 29, 2010 at 14:14
  • @Geoffrey - Seems unlikely, but not outside the realm of possibility. I will try to look for evidence of remote access.
    – BrianB
    Jul 29, 2010 at 16:05

5 Answers 5


Fiddler could be the cause. I debug my Silverlight application calls via Fiddler and have realised that launching Fiddler does automatically check the "Use a proxy server for LAN" checkbox. Uncheck the box and do not re-launch Fiddler, and all is well (though at times Fiddler does not track the traffic from that browser instance).

  • this totally worked for me. my machine's battery died while running fiddler. Since I didn't properly exit from it, it hosed my settings. Damn, I never would have figured that out. I just ran fiddler again, then went to File > Stop Capturing (first option). now my browsers work again. yay!
    – viggity
    Dec 12, 2013 at 3:11

I have had this happen a couple of times in the last month or two and I have seen or heard of it happening to co-workers recently. In all of these cases it was due to malware. You may want to run a second tool in addition to MalwareBytes. The two times it happened to me none of my tools detected the problem. I ran MSConfig and there was a new process set to run during the startup.

You could also use Process Explorer from MS to see the location of all running processes:


You will need to go to View->Select Columns and make sure Image Path is selected in order to see the location of each running process. Anything running from temporary locations would be suspicious. I usually sort the view by image path...makes it quicker to see problem locations. Any suspicious files could be uploaded to VirusTotal.com.

  • Nothing suspicious in MSConfig or Process Explorer -- but Spybot found 81 problems...
    – BrianB
    Jul 30, 2010 at 23:03

When the malware installs, it plants a proxy program on your system, then configures firefox to use the proxy (localhost) on some weird port (this is of course the port on which the proxy program is taking requests.) When you google something, your request goes through the proxy program and then to the internet. The proxy program searches your request and then sometimes returns relevant ads when you click the link. Some malware proxies are also commanded to block anti malware searches and websites. I a doozy once, so i went to malwarebytes site, but it wouldn't go through. Anyway.. that's how it works. After the malware is removed, the server refuses connections, so you will just need to configure it to use 'no proxy'.

Malwarebyte's ftw!


I wouldn't bother with a problem like this, unless it's recurrent. If you set it to no proxy and your browser will stay that way in the future, there is no reason to investigate further. Maybe it was a Windows update or browser update installed recently which messed up some settings.
If the problem persists and the settings reverts to use a proxy, than you may have a malware, but your setup looks secure enough.

  • 1
    Could this have anything to do with using Fiddler web debugger? I was using it quite a bit yesterday, but I didn't notice any browsing issues until this morning.
    – BrianB
    Jul 29, 2010 at 13:07
  • Sorry, I know nothing about Fiddler ... Jul 29, 2010 at 18:32

Fiddler2 ... I had it running and doing some Web debugging ... then REBOOTED my PC and clicked FORCE ... so my PROXY setting remained how Fiddler2 left it ... routing all traffic through Fidder2 (which was not running after reboot).

Solution: Start Fiddler2 again .. then do normal EXIT and PROXY restored to normal.

Thanks for the tips !!

  • This is more suitable for a comment than a true answer. Please refrain from this until your reputation allows you to post comments, thank you. Jun 27, 2015 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.