SteveD Posted August 29, 2019 ID:1331840 Share Posted August 29, 2019 I have an issue where my Proxy settings keep getting turned on. I have tried deleting the entry in the registry and restarting, but no good. Malwarebytes shows no threats found. I ran the FRST tool. Attached is the frst.txt file and addition.txt file. Any help is appreciated Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1331851 Share Posted August 29, 2019 Hello StevD and welcome to Malwarebytes, Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes Anti-Malware. On the Settings tab > Protection Scroll to and make sure the following are selected:Scan for RootkitsScan within Archives Scroll further to Potential Threat Protection make sure the following are set as follows:Potentially Unwanted Programs (PUP`s) set as :- Always detect PUP`s (recommended)Potentially Unwanted Modifications (PUM`s) set as :- Alwaysdetect PUM`s (recommended) Click on the Scan make sure Threat Scan is selected, A Threat Scan will begin. When the scan is complete if anything is found make sure that the first checkbox at the top is checked (that will automatically check all detected items), then click on the Quarantine Selected Tab If asked to restart your computer to complete the removal, please do so When complete click on Export Summary after deletion (bottom-left corner) and select Copy to Clipboard. Wait for the prompt to restart the computer to appear, then click on Yes. After the restart once you are back at your desktop, open Malwarebytes once more to retrieve the log. To get the log from Malwarebytes do the following: Click on the Reports tab > from main interface. Double click on the Scan log which shows the Date and time of the scan just performed. Click Export > From export you have two options:Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your replyText file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply Use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply… Let me see those logs in your reply, also tell me if the Proxy issue is cleared.. Thank you, Kevin.. Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332001 Share Posted August 29, 2019 Hi Kevin, Thanks for the reply but there is no attachment for me to download. Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1332004 Share Posted August 29, 2019 OOOppps, apologies. Is attached now.... fixlist.txt Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332009 Share Posted August 29, 2019 That does not seem to have fixed it. I am running 32-bit Windows 10 if that makes a difference. Attached is the fixlog.txt. Malwarebytes again found nothing in the scan. Attached is that log as well. Thanks for your help so far. Fixlog.txt MBScan.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1332013 Share Posted August 29, 2019 Thanks for those logs, run FRST again please: Run FRST one more time, ensure all boxes are checkmarked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, when done post the new logs. "FRST.txt" and "Addition.txt" Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332017 Share Posted August 29, 2019 Please see the attached logs as requested Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1332024 Share Posted August 29, 2019 Addition.txt is not complete....? can you post again Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332025 Share Posted August 29, 2019 Please see updated logs, needed to re run FRST Addition.txt FRST.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1332034 Share Posted August 29, 2019 Thanks for new logs, can you copy the following folder to your desktop, then zip up and attach to your reply: C:\Program Files\SmartApp When did you install that program, what is it used for, do you trust it.. Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332036 Share Posted August 29, 2019 That is a legit program and was installed after this issue started. I attached it for you anyway. SmartApp.zip Link to post Share on other sites More sharing options...
kevinf80 Posted August 29, 2019 ID:1332040 Share Posted August 29, 2019 (edited) Run new frst fix please.. Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into. "Do not open that file when running FRST fix" NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Open FRST and press the Fix button just once and wait. The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Does the proxy return..? fixlist.txt Edited August 29, 2019 by kevinf80 Link to post Share on other sites More sharing options...
SteveD Posted August 29, 2019 Author ID:1332042 Share Posted August 29, 2019 Unfortunately the proxy still returns Fixlog.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 30, 2019 ID:1332045 Share Posted August 30, 2019 Run FRST one more time: Type or copy/paste the following in the edit box after "Search:". 64550 Click Search Registry button and post the log (Search.txt) it makes to your reply. Link to post Share on other sites More sharing options...
SteveD Posted August 30, 2019 Author ID:1332050 Share Posted August 30, 2019 Please see attached log SearchReg.txt Link to post Share on other sites More sharing options...
kevinf80 Posted August 30, 2019 ID:1332053 Share Posted August 30, 2019 Quick question Steve, are you certain smartapp was installed after this issue started, it does have the potential to set a proxy. The program does run at boot so seems very suspicious.. Quote SmartApp contains a proxy (Titanium.Web.Proxy.dll) which sets a system proxy. Thanks to @Fatdcuk for above reference.. Link to post Share on other sites More sharing options...
SteveD Posted August 30, 2019 Author ID:1332056 Share Posted August 30, 2019 Yes I am positive Link to post Share on other sites More sharing options...
Fatdcuk Posted August 30, 2019 ID:1332057 Share Posted August 30, 2019 (edited) 7 minutes ago, SteveD said: Yes I am positive Hi and sorry to intrude in your help session. It is quite possible SmartApp is protecting those proxy settings since it contains it own web proxy.. Are you in a position to uninstall SmartApp to verify this and then reinstall if you still wish to continue to use that software ? Edited August 30, 2019 by Fatdcuk Link to post Share on other sites More sharing options...
SteveD Posted August 30, 2019 Author ID:1332060 Share Posted August 30, 2019 As I appreciate both of your times, I uninstalled SmartApp and restarted my laptop and I can confirm the proxy issue has stopped. This is weird as I used the app previously on a different computer with no issues. Oh well, at least it is fixed now. Thank you for your time. Link to post Share on other sites More sharing options...
kevinf80 Posted August 30, 2019 ID:1332082 Share Posted August 30, 2019 Good morning SteveD, Good to hear your issue has finally cleared, continue to clean up: Right click on FRST here: C:\Users\Steve\Desktop\Downloads\FRST.exe and rename uninstall.exe when complete right click on uninstall.exe and select "Run as Administrator" If you do not see the .exe appended that is because file extensions are hidden, in that case just rename FRST to uninstall That action will remove FRST and all created files and folders... Next, Remove all System Restore Points: https://www.tenforums.com/tutorials/33593-delete-system-restore-points-windows-10-a.html#option2 Create clean fresh Restore Point: http://www.thewindowsclub.com/create-system-restore-point Run Windows Disk Clean Up Utility - https://neosmart.net/wiki/disk-cleanup/ From there you should be good to go... Next, Read the following links to fully understand PC Security and Best Practices, you may find them useful....Answers to Common Security Questions and best PracticesDo I need a Registry Cleaner? Take care and surf safe Kevin... Link to post Share on other sites More sharing options...
kevinf80 Posted August 31, 2019 ID:1332370 Share Posted August 31, 2019 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks Link to post Share on other sites More sharing options...
Recommended Posts