Firefox connection issue due to proxy settings

burnselk

Every time I use Firefox version 3.5.3 lately it seems I will eventually get the "unable to connect" (may not be exact message). Each time I must go into Firefox Tools ->Options->Network->Settings under "Advanced" and change the "Manual Proxy Configuration" radio button to the "No Proxy" radio button before Firefox will connect. Sometime later during the same browser session, this same problem will occur.....and again off and on. It's easy to reset but it has become very annoying.

What could be causing my Firefox Proxy to automatically change from "No Proxy" to "Manual Proxy Configuration"?

How do I remedy this issue?

Thanks

__________________
The "Senior" member is a reference to my age.

Seán

When the Firefox setting changes to use a Proxy, is there any IP address entered in the proxy field? If so, could you mention the one in the "HTTP Proxy" field.

To me, it seems like there is a dodgy running process on your PC that is changing this, as this setting should never automatically change.

burnselk

.

It's 127.0.0.1

What's a dodgy? But it does automatically change.......on it's own.

Thanks Sean.

__________________
The "Senior" member is a reference to my age.

Seán

127.0.0.1 is the loopback IP, i.e. points to your PC. This means that your Firefox's Internet connection is being routed through something running on your PC. If you did not put this IP in before, then it is quite likely an infection on your PC.

For 'dodgy' I meant unwanted software, e.g. malware. Sorry for the confusion.

If you got 30 minute to spare, could you run the scanner Malware Bytes (link)? The free version will be fine. This utility will do a scan to see if this culprit is an infection, in case it's something that got past your virus checker.

burnselk

I run MBAM most days without it finding anything at all....but will run it now for you.

I'll return when it finishes and report what it found. Thanks Sean....I'll be back shortly.

__________________
The "Senior" member is a reference to my age.

burnselk

I definitely did not put that IP in........such stuff is WAY over my head.

I simply do what you guys tell me to do.....when I can comprehend what you mean....as long as you guys have the patience to help me.

I really appreciate this site.....you guys have helped me loads.

__________________
The "Senior" member is a reference to my age.

burnselk

This was my scan 2 days ago.........

Malwarebytes' Anti-Malware 1.41
Database version: 2976
Windows 5.1.2600 Service Pack 3

10/17/2009 7:49:47 PM
mbam-log-2009-10-17 (19-49-47).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|)
Objects scanned: 291996
Time elapsed: 1 hour(s), 27 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

__________________
The "Senior" member is a reference to my age.

Seán

The only other scan I can think of worth running is ComboFix (link). This is one of the best I know of at uncovering rootkits, which is a type of infection that hides itself from the OS and in turn most AV products and malware scanners.

ComboFix is takes around 10 to 20 minutes to run and the PC should not be used until it completes its scan. When you start it, it will ask to install the recovery console (if not already present) and to disable any running AV until it completes its scan. This is needed just in case something goes wrong if it tries removing something. From my experience, I've never had anything go wrong with Combofix.

burnselk

Below is my MBAM full-scan today, Oct 19, 2009. As you see, no infections.

Should I run ComboFix? Can you help me with that too? If so, tell me what I need to do please.

Would it be better to run ComboFix in Safe Mode?

Malwarebytes' Anti-Malware 1.41
Database version: 2987
Windows 5.1.2600 Service Pack 3

10/19/2009 1:54:49 PM
mbam-log-2009-10-19 (13-54-49).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|)
Objects scanned: 292958
Time elapsed: 1 hour(s), 37 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

__________________
The "Senior" member is a reference to my age.

Seán

I would recommend running ComboFix, as it seems like a hidden process is involved, especially since something is still changing your Firefox setting and Malware Bytes didn't reveal anything.

This is a guide to using ComboFix here on BleepingComputer. You'll find the download link in the 2nd part "Using ComboFix":

ComboFix_Link.png

To summarise, this is basically what you'll need to do when you run ComboFix:

1. Disable your Antivirus
2. Click "Yes" to accept the disclaimer.
3. Click "Yes" to install the recovery console.
4. After this is installed, click "Yes" to continue the scan.
5. Give it 10 to 20 minutes to complete and don't use the PC during the scan.
6. If it finds any rootkit or malware it recognises, it will delete it automatically.
7. At the end of the scan, it may reboot the PC.
8. Once it completes, it will display a log.
9. Enable your Antivirus

burnselk

"The proxy server is refusing connections".

This is the exact wording when this happens.....it just now happened again.

__________________
The "Senior" member is a reference to my age.

burnselk

Sean, are you going to walk me through the ComboFix process? I understand I shouldn't do the Combofix thing unless someone is helping me. Is that correct?

I'd appreciate your continued help with this issue. Thank you.

__________________
The "Senior" member is a reference to my age.

Seán

What they mean in having someone available in case something goes wrong. I.e. this wouldn't be advisible for someone who lands on the Combofix page (e.g. from a search engine) and tries this without someone else's recommendation. In this case, you've a discussion here and can post here for help should anything go wrong.

If you don't have access to the Internet through another PC in case this goes wrong, then I would recommend avoiding Combofix for now.

Another test you can try before running Combofix is to try running Firefox portable (link), which is a standalone version of Firefox, i.e. just extract to a folder (e.g. C:\Firefox) and run "FirefoxPortable" from there. This will rule out any add-ons and extensions in your main Firefox installation. If the proxy setting is not affected in Firefox Portable, then it's likely an extension/add-on causing the problem.

burnselk

You were right Sean, I'm using Firfox Portable now and it never gives me that connection/proxy setting issue.

__________________
The "Senior" member is a reference to my age.