Browser Hijack? Proxy config keeps resetting itself

treefella · Post by **treefella** » May 7th, 2006, 2:18 am

Every time I restart Firefox the proxy configuration changes from 'direct connection to the internet' to 'manual proxy configuration' with settings IP:193.252.213.100 Port:3128 which really slows things down. Has my browser been hijacked?

dickvl · Post by **dickvl** » May 7th, 2006, 3:00 am

Check if you have any settings in user.js
If so then remove them.
about:config -> network.proxy.type -> 0 (no proxy)

See e.g.:
http://forums.mozillazine.org/viewtopic.php?t=413373
http://forums.mozillazine.org/viewtopic.php?t=411427

treefella · Post by **treefella** » May 7th, 2006, 3:03 am

Brilliant! Thanks for that, no idea how the settings got there?

dickvl · Post by **dickvl** » May 7th, 2006, 4:13 am

No, but if you didn't do that yourself then check your computer for malware/spyware.
If your connection is changed to a proxy then that doesn't look good to me.

old FatJohn · Post by **old FatJohn** » May 7th, 2006, 5:07 am

Did a google search on the IP and it was included in many open proxy listings but you could also see that it was the sender IP in many spam mails to web forums. Not good.

treefella · Post by **treefella** » May 7th, 2006, 8:11 am

Done a scan for Trojans and that's clear, now scanning with Pest Patrol and will follow that with Ad-Aware and Spybot. Will report any findings!

treefella · Post by **treefella** » May 8th, 2006, 12:47 pm

Pest Patrol, Ad-Aware and Spybot all gave me the all clear but I think I have since found the reason. I have a utility called Hide IP Platinum which has an option in it to 'Change proxy'. I think if clicked this would reset the proxy server and then if Firefox crashed and I unloaded Hide IP Platinum before restarting firefox, it would leave the proxy changes in place! Thanks to all for your help.

Dawter · Post by **Dawter** » May 14th, 2006, 4:12 am

I am having the same problem but do not use Hide IP. I can't even find a user.js file. Can someone help me? Thanks

dickvl · Post by **dickvl** » May 14th, 2006, 4:30 am

The user.s file is only there if you created it yourself. It is not there by default.
Can you change other setting?
Check prefs.js in your Profile Folder if it is not readonly.
(it is not the one in C:\Program Files\Mozilla Firefox\defaults\profile\)

Dawter · Post by **Dawter** » May 14th, 2006, 4:31 am

thanks, I will look now

Dawter · Post by **Dawter** » May 14th, 2006, 4:35 am

I found the prefs.js file. Am I to open this file? If so, with what program? Thank you

dickvl · Post by **dickvl** » May 14th, 2006, 4:49 am

It is a text file.
Did you check the properties: attributes of that file?

You can use Notepad to open prefs.js if necessary.
Look for these:
network.proxy.type -> 0 (no proxy)
(network.proxy.http -> address)
(network.proxy.http_port -> port)

You can change them in Tools > Options > General : Connection Settings
and check if the changes are saved in prefs.js after you close Fx.
If not then try to delete localstore.rdf or use the the -safe-mode option "Reset toolbars and controls"

Dawter · Post by **Dawter** » May 14th, 2006, 5:07 am

thanks! I'll try

Dawter · Post by **Dawter** » May 14th, 2006, 5:17 am

I reset the connection settings, closed Firefox and checked the prefs.js file but it reads the same. I deleted the localstore.rdf file also but no change in my connection. This is what is in the prefs.js file:
# Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

Dawter · Post by **Dawter** » May 14th, 2006, 5:21 am

I also used safe mode and reset the toolbars but the connection is still wrong.