After opening IE, within 15 minutes, this registry setting is added.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
“ProxyServer”=“http=127.0.0.1:1083;https=127.0.0.1:1083;”
“ProxyOverride”=“<-loopback>”
IE becomes unusable after this.
A full scan with Avast finds nothing.
Does anyone know what is causing the problem and how to resolve it?
attach (not copy and paste) OTL diagnostic log. http://forum.avast.com/index.php?topic=53253.0
Here is the report from ADWCleaner.
*** BUMP ***
The user is still having problems. Sometimes it takes as much as two hours for the Registry key to change, but inevitably it gets
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
“ProxyServer”=“http=127.0.0.1:1083;https=127.0.0.1:1083;”
“ProxyOverride”=“<-loopback>”
back.
Does anyone have an idea what to try next?
Hi to determine the nature of the problem I will require the OTL log
Here is the OTL log
Did you install this programme PRC - [2013/11/06 13:59:09 | 002,737,664 | ---- | M] () – C:[b]Xtune[/b]\PT\XpPtOPC.exe ? As my reading suggests that this programme is used to conference tasks in a large organisation and will set the necessary proxies
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:OTL
IE - HKU\S-1-5-21-1801674531-1004336348-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKU\S-1-5-21-1801674531-1004336348-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <-loopback>
IE - HKU\S-1-5-21-1801674531-1004336348-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:1083;https=127.0.0.1:1083;
O3 - HKU\S-1-5-21-1801674531-1004336348-839522115-1003\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
O3 - HKU\S-1-5-21-1801674531-1004336348-839522115-1046\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Here is the log file.
BTW, our company is the creator of XpPtOPC.exe. I can confirm this is not the source of the problem as it would exist on hundreds of systems all over the world.
[The forum does not allow uploading zip files, so I renamed log.zip to log.txt. The log file itself was too large to upload.]
OK could you now reboot the computer one more time… Check the proxy setting and then run a fresh OTL scan ensuring all users is selected
From the user: Before the second reboot the “proxy” settings appeared in the registry. I did not delete them. They were still there when I ran the scan. I’ve deleted them now.
Do you experience the same problem in Firefox ?
Could you download and then run shortcut cleaner from here http://www.bleepingcomputer.com/download/shortcut-cleaner/
On completion a log will produced please post that
No, Firefox does not exhibit the problem.
Ta … So it is narrowed down to an IE problem only
Please download MiniToolBox, save it to your desktop and run it.
https://dl.dropbox.com/u/73555776/minitoolbox.JPG
Checkmark the following checkboxes:
[]Flush DNS
[]Report IE Proxy Settings
[]Reset IE Proxy Settings
[]Report FF Proxy Settings
[]Reset FF Proxy Settings
[]List content of Hosts
[]List IP configuration
[]List Winsock Entries
[]List last 10 Event Viewer log
[]List Installed Programs
[]List Devices
[]List Users, Partitions and Memory size.
[*]List Minidump Files
Click Go and post the result (Result.txt). A copy of Result.txt will be saved in the same directory the tool is run.
Note: When using “Reset FF Proxy Settings” option Firefox should be closed.
Here are the results.
Additional information from the user:
After running this tool, Firefox will not now connect to the Internet. Firefox, in addition to IE, now sets the proxy settings in the registry.
What has this tool done?
Firefox had the same proxy settings… Are you on a network that requires a proxy setting to access it ?
No. The network requires no proxy.
Right now both browsers cannot get to any site.
Is there anything else to try?
Run this small OTL fix to flush and reset dns/winsock
Warning This fix is only relevant for this system and no other, using on another computer may cause problems
Be advised that when the fix commences it will shut down all running processes and you may lose the desktop and icons, they will return on reboot
Run OTL
[*]Under the Custom Scans/Fixes box at the bottom, paste in the following
https://dl.dropbox.com/u/73555776/OTL_Fix.GIF
:Commands
[CREATERESTOREPOINT]
:Files
ipconfig /flushdns /c
ipconfig /release /c
ipconfig /renew /c
netsh winsock reset /c
netsh advfirewall reset /c
:Commands
[resethosts]
[emptytemp]
[Reboot]
[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.
Here’s the log