LAN settings interfering with Windows app store

I was having an issue where the Windows app store refused to launch and it would throw the following error:



After a little research I found something that said the LAN settings in IE have been set to use a proxy server and it looks like so:



I have no idea why this setting would be in place. After unchecking the box the Windows app store begins to work again. However, whenever the PC is rebooted the settings go back to the way they were. Why doesn't it maintain the setting change, why does it have this setting in the first place, and is there any way to get it to remember this setting? This is the only PC in the house (out of 4 total) that does this. The distinction that PC holds is that it is the only PC hardwired into the router while the others use wi-fi. However, I unplugged it from the router and it did not seem to make a lick of difference. After rebooting it, it still put the setting back to using that proxy server.

So my main question is how do I get it to maintain the setting to not use the proxy server?

All help is greatly appreciated.

Thanks!:)

Agreed, could be an infection, not uncommon. Usually the only setting most consumers need is the first item on that panel about Automatically detect.................., called DHCP [Dynamic Host Configuration Protocol] and is what the ISP subscribed to needs. The ISP could require a Static IP but they will tell the consumer that.

Another reason is Anti Virus Software as this often uses a proxy so it can scan all traffic. In a browser enter 127.0.0.1:8003 does anything show? The proxy is running local on the pc

Please download and save FRST 64bit or FRST 32 bit to your Desktop.

http://download.bleepingcomputer.com/farbar/FRST.exe
http://download.bleepingcomputer.com/farbar/FRST64.exe

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Samuria said:

Another reason is Anti Virus Software as this often uses a proxy so it can scan all traffic. In a browser enter 127.0.0.1:8003 does anything show? The proxy is running local on the pc

Please download and save FRST 64bit or FRST 32 bit to your Desktop.

http://download.bleepingcomputer.com/farbar/FRST.exe
http://download.bleepingcomputer.com/farbar/FRST64.exe

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Make sure that Addition option is checked.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

Here you go! Yeah, I tried to go to the 127 with that specific port and got nada. The only antivirus I got running on this PC is Windows defender. I am about in run a scan with Hitman and perhaps malware bytes as well. Let know what ya see.

Thanks!

Hey guys, thanks for the suggestion that it could be malware. I am running a scan with hitman and malware bytes. I never used the MS malicious removal tool. I guess I will give it a shot and run that one as well. Will let you know if this fixes it.

Thanks!

Noticed something weird when I ran a scan. It picked up that it was running the proxy setting:




Is it recognizing that there is something amiss about this?

Ran a netstat command and saw this:

TCP 127.0.0.1:8003 Oxxxxx-xxxxxp:0 LISTENING
[winsrcsrv.exe]

So even after running, MS malicious softare removal tool, hitman, and Roguekiller both of which hitman and roguekiller said they recognize the proxy server threat on multiple finds and stated it would remove it, and yet it's still there. Whoa, this one is a doozy. What do you guys think of Zoek by Smeenk? Should I give that a shot?