Can't remove proxy in Internet Explorer after malware infection

While cleaning up a client computer I found an issue with Internet Explorer where the proxy seeting could not be changed with out it automatically reverting back to its original setting. This persistant issue seemed related to a typical group policy setting but this was not possible because the system was running Windows 7 Home. Many others on the Internet had reported the issue with only one resolution, editing the registry.

The registry changes didn't seem to be long lasting until I found an article by Philip Turner that provided some additional registry keys that I was missing in my search.

1. Open REGEDIT and browse to the following key: 
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
2. Change the "ProxyEnable" value from 1 to 0
3. Delete the entry "ProxyOverride"
4. Delete the entry "ProxyServer"
5. Browse to the key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings
6. Change "ProxyEnable" value from 1 to 0
7. Delete the entry "ProxyOverride"
8. Delete the entry "ProxyServer"
9. Browse to the key:
       HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NlaSvc\Parameters\Internet\ManualProxies
10.  Double click on the "Default" entry and deleted the entire contents so that it is blank.
11.  Browse to the key:
         HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\NlaSvc\Parameters\Internet\ManualProxies
12.  Double click the "Default" entry and deleted the entire contents so that it is blank.
13.  Browse to to the key:
         HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
14.  Delete the key "DefaultConnectionSettings"
15.  Delete the key "SavedLegacySettings"

NOTE: both of these keys had the proxy and loopback information embededed in their value data, which would not show up for a registry search for "127.0.0.1"

If you would prefer to use a registry file that has these changes already made, click the download and then go to where you saved the file and double cick to run it. We must notify everyone that modifying your registry could cause severe damage to the operation of your computer. Use these instructions or this file at your own risk.

In the case that I was working on, I also found that Symantec's Norton 360 Premium would cause these settings to become restored when the Firewall and Browser Protection settings were enabled. I am still investigating this issue. I don't typically recommend using this version of Norton Antivirus and recomend using just the basic version which doesn't cause this issue.

We hope that this information is helpful. Please let us know how this has helped you or if you have additional questions. As always Firestone Technical Resources, Inc. is here to help with your computer support issues - "Providing personal service for your impersonal technology."