IE Proxy Server isn't Responding

ProMod117 · February 28, 2016

I rarely use IE. I attempted to last night and it wouldn't connect. Comes up with Check your proxy settings 127.0.0.1:8080 screen. It can not repair itself. My settings are correct in the Connections page. I have tried everything I could find as far as disabling Proxy settings in IE. Nothing has worked. Everything else is suggesting a hi-jack. Firefox works fine and I haven't noticed anything else goofy.

Some assistance would be greatly appreciated.

Thanks

kevinf80 · February 28, 2016

Hello and welcome to Malwarebytes,

Please be aware the following P2P/Piracy Warning is a standard opening reply made here at Malwarebytes, we make no accusations but do make you aware of Forum Protocol....

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Anyone other than the original starter of this thread please DO NOT follow the instructions and advice posted as replies here, my help and advice is NOT related to your system and will probably cause more harm than good...

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits". <---- Very Important
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Please use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download AdwCleaner by Xplode onto your Desktop.

Double click on Adwcleaner.exe to run the tool.
Click on the Scan in the Actions box
Please wait fot the scan to finish..
When "Waiting for action.Please uncheck elements you want to keep" shows in top line..
Click on the Cleaning box.
Next click OK on the "Closing Programs" pop up box.
Click OK on the Information box & again OK to allow the necessary reboot
After restart the AdwCleaner(C*)-Notepad log will appear, please copy/paste it in your next reply. Where * is the number relative to list of scans completed...

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
(Windows 8/10 users will be prompted about Windows SmartScreen protection - click More information and Run.)
Make sure Addition.txt is checkmarked under "Optional scans"
Press Scan button to run the tool....
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The tool will also make a log named (Addition.txt) Please attach those logs to your reply.

Let me see those logs in your next reply...

Thank you,

Kevin...

ProMod117 · February 28, 2016

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/28/2016
Scan Time: 3:40 PM
Logfile:
Administrator: Yes

Version: 2.2.0.1024
Malware Database: v2016.02.28.04
Rootkit Database: v2016.02.27.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Paul

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 335976
Time Elapsed: 4 min, 51 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Warn

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

ProMod117 · February 28, 2016

# AdwCleaner v5.037 - Logfile created 28/02/2016 at 15:51:59
# Updated 28/02/2016 by Xplode
# Database : 2016-02-28.2 [Local]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Paul - PAUL-HOME
# Running from : E:\Downloads\Virus detection\AdwCleaner.exe
# Option : Clean
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

[-] Folder Deleted : C:\Users\Paul\AppData\Local\Installer\Install_26608
[-] Folder Deleted : C:\Users\Paul\AppData\Local\Installer\Install_31915
[-] Folder Deleted : C:\Users\Public\Documents\Goobzo

***** [ Files ] *****

***** [ DLLs ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

[-] Task Deleted : Winupdate
[-] Task Deleted : EssentialUpdateMachine

***** [ Registry ] *****

[-] Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}
[-] Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}
[-] Key Deleted : HKCU\Software\Goobzo
[-] Key Deleted : HKLM\SOFTWARE\Goobzo
[-] Key Deleted : HKU\.DEFAULT\Software\Goobzo

***** [ Web browsers ] *****

*************************

:: "Tracing" keys removed
:: Winsock settings cleared

*************************

C:\AdwCleaner\AdwCleaner[C1].txt - [1285 bytes] - [28/02/2016 15:51:59]
C:\AdwCleaner\AdwCleaner[s1].txt - [1288 bytes] - [28/02/2016 15:48:35]

########## EOF - C:\AdwCleaner\AdwCleaner[C1].txt - [1431 bytes] ##########

AdwCleaner v5.037 - Logfile created 28/02/2016 at 15:48:35
# Updated 28/02/2016 by Xplode
# Database : 2016-02-28.2 [Local]
# Operating system : Windows 7 Professional Service Pack 1 (x64)
# Username : Paul - PAUL-HOME
# Running from : E:\Downloads\Virus detection\AdwCleaner.exe
# Option : Scan
# Support : http://toolslib.net/forum

***** [ Services ] *****

***** [ Folders ] *****

Folder Found : C:\Users\Paul\AppData\Local\Installer\Install_26608
Folder Found : C:\Users\Paul\AppData\Local\Installer\Install_31915
Folder Found : C:\Users\Public\Documents\Goobzo

***** [ Files ] *****

***** [ DLL ] *****

***** [ Shortcuts ] *****

***** [ Scheduled tasks ] *****

Task Found : Winupdate
Task Found : EssentialUpdateMachine

***** [ Registry ] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{82351441-9094-11D1-A24B-00A0C932C7DF}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{82351433-9094-11D1-A24B-00A0C932C7DF}
Key Found : HKCU\Software\Goobzo
Key Found : HKLM\SOFTWARE\Goobzo
Key Found : HKU\.DEFAULT\Software\Goobzo

***** [ Web browsers ] *****

*************************

C:\AdwCleaner\AdwCleaner[s1].txt - [1136 bytes] - [28/02/2016 15:48:35]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [1209 bytes] ##########

ProMod117 · February 28, 2016

Here are the Farbar logs.

FRST.txt

Addition.txt

kevinf80 · February 28, 2016

back shortly....

kevinf80 · February 28, 2016

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Please download
Post those logs, also let me know if there any remaining issues or concerns....

Thank you,

Kevin

Fixlist.txt

ProMod117 · February 29, 2016

Here is the fix log. After the reboot I had this error message; Working on the rest of the list.

ProMod117 · February 29, 2016

Fix result of Farbar Recovery Scan Tool (x64) Version:27-02-2016
Ran by Paul (2016-02-28 19:13:39) Run:1
Running from E:\Downloads\Virus detection
Loaded Profiles: Paul (Available Profiles: Paul)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
HKLM-x32\...\Winlogon: [shell] "C:\Program Files\Launcher4Kodi\Launcher4Kodi.exe" [ ] () <=== ATTENTION
HKU\S-1-5-21-4070642479-324977492-240404967-1000\...\Winlogon: [shell] C:\Windows\Explorer.exe [3231232 2016-01-22] (Microsoft Corporation) <==== ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
CHR HKU\S-1-5-21-4070642479-324977492-240404967-1000\SOFTWARE\Policies\Google: Restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
C:\Users\Paul\AppData\Local\Temp\cabex.dll
C:\Users\Paul\AppData\Local\Temp\setup.exe
C:\Users\Paul\AppData\Local\Temp\sqlite3.dll
C:\Users\Paul\AppData\Local\Temp\unelevate.exe
C:\Users\Paul\AppData\Local\Temp\_is8CC4.exe
AlternateDataStreams: C:\ProgramData\TEMP:56E2E879
Hosts:
RemoveProxy:
CMD: ipconfig /flushdns
EmptyTemp:
end

*****************

Restore point was successfully created.
Processes closed successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value restored successfully
HKU\S-1-5-21-4070642479-324977492-240404967-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value removed successfully
"HKLM\SOFTWARE\Policies\Google" => key removed successfully
"HKU\S-1-5-21-4070642479-324977492-240404967-1000\SOFTWARE\Policies\Google" => key removed successfully
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
C:\Users\Paul\AppData\Local\Temp\cabex.dll => moved successfully
C:\Users\Paul\AppData\Local\Temp\setup.exe => moved successfully
C:\Users\Paul\AppData\Local\Temp\sqlite3.dll => moved successfully
C:\Users\Paul\AppData\Local\Temp\unelevate.exe => moved successfully
C:\Users\Paul\AppData\Local\Temp\_is8CC4.exe => moved successfully
C:\ProgramData\TEMP => ":56E2E879" ADS removed successfully.
C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

========= RemoveProxy: =========

HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully
HKU\S-1-5-21-4070642479-324977492-240404967-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\DefaultConnectionSettings => value removed successfully
HKU\S-1-5-21-4070642479-324977492-240404967-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\\SavedLegacySettings => value removed successfully

========= End of RemoveProxy: =========

========= ipconfig /flushdns =========

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========= End of CMD: =========

EmptyTemp: => 1.6 GB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 19:13:52 ====

ProMod117 · February 29, 2016

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.3 (02.09.2016)
Operating System: Windows 7 Professional x64
Ran by Paul (Administrator) on Sun 02/28/2016 at 19:20:44.78
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

File System: 13

Successfully deleted: C:\Users\Paul\AppData\Local\installer (Folder)
Successfully deleted: C:\Windows\default.cfg (File)
Successfully deleted: C:\Windows\fiddlercore4.dll (File)
Successfully deleted: C:\Windows\system32\drivers\healusb.sys (File)
Successfully deleted: C:\Windows\system32\ysxja.exe (File)
Successfully deleted: C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AYMY1JG2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ3PMF8K (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0LECJWC (Temporary Internet Files Folder)
Successfully deleted: C:\Users\Paul\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOVSR8GS (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AYMY1JG2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZ3PMF8K (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T0LECJWC (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOVSR8GS (Temporary Internet Files Folder)

Registry: 0

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sun 02/28/2016 at 19:21:21.28
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ProMod117 · February 29, 2016

Cureit.log attached. Apparently my screenshot didn't post. It was something regarding Asus setup and indicated a log was missing. Error message has not shown up on subsequent reboots.

As of right now, according to IE, Proxy server still not responding. I do not have the proxt button selevted..

Check your proxy settings 127.0.0.1:8080.
Go to Tools > Internet Options > Connections. If you are on a LAN, click “LAN settings”.

Results of screen317's Security Check version 1.014 --- 12/23/15
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Microsoft Security Essentials
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 20.0.0.306
Mozilla Firefox (44.0.2)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbam.exe
Virus detection SecurityCheck.exe
Malwarebytes Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 45% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

cureit.log

ProMod117 · February 29, 2016

The message reappeared on the desk top.

AsusSetup

C:\Users\****\Appdata\Local\Temp\153756log.iniis lost

ProMod117 · February 29, 2016

And it reappears after a reboot.

kevinf80 · February 29, 2016

Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.
NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Can you open Internet Explorer > Tools > Internet Options > Connections > LAN

Are the settings listed like the following image?

Fixlist.txt

ProMod117 · February 29, 2016

Yes, that is how my LAN Settings is set. Totally baffled!

The Asus message is now removed.

Fix result of Farbar Recovery Scan Tool (x64) Version:27-02-2016
Ran by Paul (2016-02-29 06:42:12) Run:4
Running from E:\Downloads\Virus detection
Loaded Profiles: Paul (Available Profiles: Paul)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start
CreateRestorePoint:
CloseProcesses:
Task: {A12DD59A-7AB4-482F-85FB-2E1893D6A4E1} - System32\Tasks\ASUS\i-Setup153756 => C:\Windows\Chipset\AsusSetup.exe [2010-09-08] (ASUSTeK Computer Inc.)
EmptyTemp:
end

*****************

Restore point was successfully created.
Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{A12DD59A-7AB4-482F-85FB-2E1893D6A4E1}" => key removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A12DD59A-7AB4-482F-85FB-2E1893D6A4E1}" => key removed successfully
C:\Windows\System32\Tasks\ASUS\i-Setup153756 => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ASUS\i-Setup153756" => key removed successfully
EmptyTemp: => 577.9 MB temporary data Removed.

The system needed a reboot.

==== End of Fixlog 06:42:18 ====

ProMod117 · March 1, 2016

Any other thoughts on this?

ProMod117 · March 1, 2016

You're never going to believe this, but I unchecked Automatically Detect Settings and it is now working. I don't understand why or how. Every other machine I have works with that box checked. Something has definitely changed that because that field was grayed out prior top me finding the registry entry (before I contacted you) that alters that.

kevinf80 · March 1, 2016

Do you have any remaining issues or concerns. if none run the following to clean up:

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

If your security program alerts to Delfix either, accept the alert or turn your security off.

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

Remove disinfection tools
Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Read the following links to fully understand PC Security and Best Practices, you may find them useful....

Answers to Common Security Questions and best Practices

Do I need a Registry Cleaner?

Take care and surf safe

Kevin...

ProMod117 · March 2, 2016

Thanks, Kevin.

Were there any indications of a non-wanted presence?

Thanks again!!

Paul

kevinf80 · March 2, 2016

There was no definite infection, we do some general maintenace and clean up, specifically browser entries. There were services that had been altered, not sure if an attempted exploit or down to software such as Kodi. I know Kodi is not malicious or classed as illegal, however it does need 3rd party addons to actually work, i would be cautious when/if installing such etras.....

The ASUS error message was a remnant task, not sure why a chipset install set up Task should start up again. Maybe is an attempted exploit, not really sure.....

Regards,

Kevin

AdvancedSetup · March 7, 2016

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

IE Proxy Server isn't Responding

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information