Help ... proxy server keeps appearing after deletion

[illusions]

Hi,

I am using windows xp sp3 on home computer

with d-link router dl-604

I have never enter the proxy server info however it keeps reappearing even after I have deleted it on

registry. I have google everywhere on the internet cannot seem able to find a solution.

proxy server 64.59.144.94 keeps resurrecting itself.

see attachment jpg

Please advice and thanks

My registry remove proxy.reg =======================

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"ProxyEnable"=dword:00000000

"ProxyOverride"=""

"ProxyServer"=""

"AutoConfigProxy"=-

“AutoConfigURL”=-

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"DefaultConnectionSettings"=hex:46,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

"SavedLegacySettings"=hex:46,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,00

[cluberti]

Might want to use process monitor with a filter on HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings, so you can see what process is overwriting your changes with it's own. At least you should see which .exe or .dll does it.

[illusions]

I found nothing using process monitor.

Out of fustration i delete the whole

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

Reboot the computer and it create a new

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]

"DefaultConnectionSettings"=hex:46,00,00,00,03,00,00,00,01,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,00,00,26,00,00,00,68,74,74,70,3a,2f,2f,70,\

72,6f,78,79,2e,76,63,2e,73,68,61,77,63,61,62,6c,65,2e,6e,65,74,2f,77,70,61,\

64,2e,64,61,74,00,ec,7c,1e,26,e1,c9,01,00,00,00,00,00,00,00,00,00,00,00,00,\

01,00,00,00,02,00,00,00,c0,a8,00,65,00,00,00,00,00,00,00,00,6f,00,6f,00,74,\

00,25,00,5c,00,54,00,45,00,4d,00,50,00,00,00,44,00,3b,00,2e,00,56,00,42,00,\

53,00,3b,00,2e,00,56,00,42,00,45,00,3b,00,2e,00,4a,00,53,00,3b,00,2e,00,4a,\

00,53,00,45,00,3b,00,2e,00,57,00,53,00,46,00,3b,00,2e,00,57,00,53,00,48,00,\

00,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,62,00,65,00,6d,\

00,00,00,00,00,00,00

"SavedLegacySettings"=hex:46,00,00,00,0a,00,00,00,01,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00,00,26,00,00,00,68,74,74,70,3a,2f,2f,70,72,6f,\

78,79,2e,76,63,2e,73,68,61,77,63,61,62,6c,65,2e,6e,65,74,2f,77,70,61,64,2e,\

64,61,74,00,ec,7c,1e,26,e1,c9,01,00,00,00,00,00,00,00,00,00,00,00,00,01,00,\

00,00,02,00,00,00,c0,a8,00,65,00,00,00,00,00,00,00,00,6f,00,6f,00,74,00,25,\

00,5c,00,54,00,45,00,4d,00,50,00,00,00,44,00,3b,00,2e,00,56,00,42,00,53,00,\

3b,00,2e,00,56,00,42,00,45,00,3b,00,2e,00,4a,00,53,00,3b,00,2e,00,4a,00,53,\

00,45,00,3b,00,2e,00,57,00,53,00,46,00,3b,00,2e,00,57,00,53,00,48,00,00,00,\

79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,57,00,62,00,65,00,6d,00,00,\

00,00,00,00,00

refer to proxy2 image

In DefaultConnectionSettings and SavedLegacySettings

has the

http://proxy.vc.shawcable.net/wpad.dat

so i download the wpad.dat

look something like this using a note pad to read it.

==================================

function FindProxyForURL(url, host)

{

if (

shExpMatch(url, "https://*") ||

shExpMatch(url, "news://*") ||

shExpMatch(url, "snews://*") ||

shExpMatch(url, "ftp://*@*") ||

shExpMatch(url, "http://localhost/*") ||

shExpMatch(url, "http://localhost:*/*") || shExpMatch(url, "*.shaw.ca/*") ||

shExpMatch(url, "http://10.*") ||

shExpMatch(url, "http://172.16.*") ||

shExpMatch(url, "http://192.168.*") ||

shExpMatch(url, "http://*.youtube.com/*") ||

shExpMatch(url, "http://*.google.com/*") ||

shExpMatch(url, "http://*.facebook.com/*") ||

shExpMatch(url, "http://*.myspace.com/*") ||

shExpMatch(url, "http://*.myspacecdn.com/*") ||

shExpMatch(url, "http://*.dailymotion.com/*") ||

shExpMatch(url, "http://*.megarotic.com/*") ||

shExpMatch(url, "http://*.apple.com/*") ||

shExpMatch(url, "http://*.xvideos.com/*") ||

shExpMatch(url, "http://*.megavideo.com/*") ||

shExpMatch(url, "http://*.veoh.com/*") ||

shExpMatch(url, "http://*.imeem.com/*") ||

shExpMatch(url, "http://*.rapidshare.com/*") ||

shExpMatch(url, "http://*.google.ca/*") ||

shExpMatch(url, "http://*.msn.com/*") ||

shExpMatch(url, "http://*.live.com/*") ||

shExpMatch(url, "http://*.llnwd.net/*") ||

0

)

{

return("DIRECT");

}

var hash = 0;

hash = (host.length % 2);

if (hash == 0)

{

return("PROXY 64.59.144.94:8080; PROXY 64.59.144.95:8080; DIRECT");

}

else

{

return("PROXY 64.59.144.95:8080; PROXY 64.59.144.94:8080; DIRECT");

}

}

=====================

What is wpad.dat ... where is it located?

Please advice.

[illusions]

This also appear on the registry

http://64.59.144.94/wpad.dat

Edited May 31, 2009 by illusions

[cluberti]

If a device on your network, or your ISP, has a wpad configured (sounds like it may be in your ISP's DHCP configuring it to where IE is downloading it), then it will be downloaded by IE and applied even if you delete it the next time the cache timeout for it expires or IE is closed and re-opened. You need to contact the ISP (which looks like Shaw Cable) to see why they are pushing down a proxy PAC file to your machine. Note that if you go into IE's connection settings and make sure NONE of those options are checked, technically it should never check for a PAC file again, unless you've got other software on the machine that resets the setting, of course. Otherwise, use a non-IE browser if it's really that much of a problem.