127.0.0.1:8080 Proxy server keeps resetting

Hi

UPDATE:

When posting this I noticed in the instructions on the website below that RKILL was suppose to shut down when the scan was completed and I think I might have been shutting it to fast in earlier attempts and this time I let it run while I was writing the below post and by time I finished I noticed the program had in fact this time run the course and popped up with the log.

So I am going through this whole procedure again now that step one is completed to see if this in fact works this time around. If not I will update the post here.

Original post:

The other day I went to play a game that I have been playing long time and could not get logged in and while I was trying to find a solution I came across a post mentioning something on Proxy settings so I double checked something I had experienced in the past and found that this seemed to be the issue.

I went into Windows 10 settings network and internet and then proxy and low and behold I saw in the Manual proxy setup area that it was turned on and again and int he boxes were the following

Address: http=127.0.0.1:8080;https=127.0.0.1:8080
Port: Blank No Entry
Comment box below says: <-loopback>
Don't use the proxery server for local (intranet) adresses is UNCHECKED

So I thought OK I know how to handle this and I dug up the page I had used in the past that had detailed instructions to get rid of this and followed them again.

https://www.bleepingcomputer.com/vir...0.1-8080-proxy

In the past this procedure worked and got rid of the proxy setting along with this I also used Malware Bytes and between the two the system was cleaned.

This time though I am not able to get rid of this and it is always resetting back.

I have gone into the registry and deleted all references to http=127.0.0.1:8080;https=127.0.0.1:8080 and <-loopback> (typically between 2 and 8 occurrences) but every time I restart my system they return again back into the registry.

Some of the scanners say there was no threat found and others report back anywhere from 1-8 occurrences and I clean it from those programs and it returns back systems clean and safe but next start up their back again.

Any ideas how to clean this off my system short of a system restore?

Thanks
Dave

Download CurPorts (CurrPorts: Monitoring TCP/IP network connections on Windows) and see what process is listening on local port 8080.

PolarNettles said:

Download CurPorts (CurrPorts: Monitoring TCP/IP network connections on Windows) and see what process is listening on local port 8080.

I'll do that following these scans as I know the procedure worked the last time to get rid of this stupid thing so am hoping now that I let RKILL do it's job fully that perhaps now it will remove it fully unlike earlier attempts.

Are you running any antivirus as that often used a proxy so it can scan incoming files and it will reinstate if it's removed the 8080 port is normally for webpages

There is a bunch of unknowns listening in on that port 8080

Samuria said:

Are you running any antivirus as that often used a proxy so it can scan incoming files and it will reinstate if it's removed the 8080 port is normally for webpages

Run webroot which came with my system from Bestbuy. Always running in background and even it found nothing when I used it to scan.

The other programs

Zamana
ADWCLEANER
Hitman Pro
Malware Bytes

Do tend to find things proxy related and indicate it has been cleaned following the procedure but then on next start up the 127.0.0.1:8080 just returns.

From looking at pages on this it seems to be some sort of malware that forces ads and such and I think that is what is happening as I do run Ad Blocker ultiumate for Firefox (never use IE except to test a website layout or something when working on websites otherwise IE stays closed) and it was working fine until the past weekend when I started to notice ads being displayed rather then blocked.

There are tasks reloading this read this there are ways to remove it Proxy change virus/hack https=127.0.0.1:8080 - Virus, Trojan, Spyware, and Malware Removal Help

Samuria said:

There are tasks reloading this read this there are ways to remove it Proxy change virus/hack https=127.0.0.1:8080 - Virus, Trojan, Spyware, and Malware Removal Help

OK thanks will read through it this evening as heading out right after a call and the post looks lengthy