Default proxy replaced by 127.0.0.1 on Windows network

[Rav-Singh]

Hello everyone!

 

Over the last two weeks we have more and more machines unable to connect to the internet in school via the proxy server. When checking the laptops\desktops in question, in Internet Options- Connections- LAN Settings the proxy server address box is grayed out however, the 'Use proxy server' box is checked and when clicking on advanced the HTTP and Secure server is set as 127.0.0.1 port 51139. Please see the attached doc for more info.

 

Can any one help?

 

Many Thanks

 

RavIE ERROR.docx

[JackCPickup]

Every time I've had this happen it's been down to malware.

 

Jack

[Rav-Singh]

Thanks for your reply JackcPickup, 3x machines had been down to Malware however, 8x machines had nothing in quarantine even after we ran the AV software.

[plexer]

You have impero or anything like that running?

 

Ben

[Rav-Singh]

Hello Plexer, we have a Classroom Management Solution installed (for the last couple of years) called AB Tutor but only running on some machines.

[Michael]

If you're a Birmingham school, chances are you're running Sophos and it doesn't always pick up malware. Try downloading/running Malwarebytes and see if this picks up anything.

 

Also - I presume you're deploying proxy settings either via GPO or GPP?

 

Port 51139 isn't reserved for anything, plus pointing to 127.0.0.1 it's not going anywhere fast. The BGfL firewall will be blocking any attempts using port 51139, so at least it's restricted to just your network.

 

If running Malwarebytes picks up nothing significant, I'd recommend you re-image the affected workstations.

[ZeroHour]

Hello Plexer, we have a Classroom Management Solution installed (for the last couple of years) called AB Tutor but only running on some machines.

 

ABTutor does/did have a browser management module to block web surfing, that could be the cause if the policy is applied.

[Pottsey]

Hello Plexer, we have a Classroom Management Solution installed (for the last couple of years) called AB Tutor but only running on some machines.

We have the same problem with AB Tutor when ever we turn on web logging. Remove the part of the log policy that records websites visited. Even the newest version has this bug. Considering how major the bug is and how long its been going on they don't seem very interested in fixing it.

 

EDIT: Its only a bug in Version 7. No problems here with Version 6.

Edited May 2, 2014 by Pottsey

[JackCPickup]

If you want to be sure re: malware...from 'Run' type iexplore "http://malwareexperts.com/rkill" let that download and run, it will detect and stop malicious services running.

 

Then run a Malwarebytes scan with an up-to-date database.

 

Jack

Edited May 2, 2014 by JackCPickup
I can't sentence

[Duke5A]

Run this at a command line:

 

netstat -o -a

 

Look for 127.0.0.1:51139, take note of the process ID number, and look it up in task manager. You should be able to identify what piece of software is doing this.

[victory2012]

We have the same problem with AB Tutor when ever we turn on web logging. Remove the part of the log policy that records websites visited. Even the newest version has this bug. Considering how major the bug is and how long its been going on they don't seem very interested in fixing it.

 

EDIT: Its only a bug in Version 7. No problems here with Version 6.

 

 

yep same here with v 7 reported it while it was still in beta ... and still not working!!

[Rav-Singh]

yep same here with v 7 reported it while it was still in beta ... and still not working!!

 

Hello everyone, big thank you to every one for replying, did speak to AB Tutor technical support and they said they are in the process of rectifying the well known proxy issue with version 7.3.0 (out tomorrow but on the web site already). I'm in the process of pushing it out at the moment will keep up updated on the progress, thanks again for your support chaps !

 

Rav

[Rav-Singh]

Sorry about the late reply, AB Tutor released 7.3.0 which generally fixes the issue however, on some machines (5-10 out of 400) it didn't, so completely uninstalled AB Tutor and deleted user profile (may not need to do this but I found some student profiles were saving error default proxy) installed version 7.3.0 and that seems to fix the issue. Big thanks for everyone for advice and guidance !!!!

 

Kind Regards

 

Rav Singh

Edited June 6, 2014 by Rav-Singh