Use a proxy server - auto on after disabling

[Rigo]

A regular customer called about a PC Repair utility now on his desktop, whether I installed it during my last service.
Sounds like a rogue to me, confirmed after remote logging.
Ran MBAM and Adwcleaner and indeed removed Outbyte\PC Repair.
By the way Chrome is saying that the connection is not secure, and I cannot get to my emails - says the customer.



Even though Edge or anything else needing access to the internet ever had any problem, seemed to affect only Chrome. Resetting settings to default, remove and re-installing it, cleaning up temp files and folders, etc didn't make any difference.
Checking around I end up finding that 'Use a proxy...' had been turned on.
Turn it off and Chrome no longer has a problem.
But them it turns back on by itself after a while, even without restarting the computer as far as I observe.
OS is Win10 Pro, would there be a setting in gpedit to maintain that on? Even though I've run Adwcleaner with the setting to reset rogue policy settings?


As everything else seems to be working perfectly a nuke n pave seems extreme

 

[Porthos]

Checking around I end up finding that 'Use a proxy...' had been turned on.
Turn it off and Chrome no longer has a problem.
But them it turns back on by itself after a while, even without restarting the computer as far as I observe.

You are still infected.

 

[nlinecomputers]

As everything else seems to be working perfectly a nuke n pave seems extreme

No it doesn't. You still have something lurking about. You can either waste time and try and find a solution and never be 100% certain that it is truly dead or you can kill it with fire and do a fresh start. Windows 10 can be setup in 20-30 on decent hardware and most people only have office and chrome as applications. FABS all the data and nuke it from orbit until it glows. (I.E. you do full backup and use disk wiping software to write zeros to every sector of the hard drive/SSD)

 

[Sky-Knight]

And if you want to continue tinkering here is the registry path to check : HKEY_CURRENT_USER\Software\Microsoft\ Windows\CurrentVersion\Internet Settings.

and this one: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings.

But I wouldn't bother with that until you've pulled the drive and scanned the entire filesystem with a solid metaav engine from another operating system. And if the platform is encrypted... oh well sucks to be you... we're back to nuking it from orbit. Which incidentally is the only known fix with a consistent time investment anyone can commoditize.

 

[YeOldeStonecat]

Not familiar with this one, but more and more scamware/snake-oil-ware/junkware is getting quite persistent in that they will set a scheduled task to ensure they're installed. If the scheduled task finds it's been removed from the system, it'll download/reinstall itself.