Error message" WinNet registry change detected, verifying proxy keys intact..."

[Darby]

Will not capture traffic, I have uninstalled and reloaded with same error. I have used system restore and got it to work for a few days. Next windows update and I get error again. Can't restore back any further. Need help on this one to continue use 

[Darby]

I am on windows 7 premium home edition 

[Eric Lawrence]

Hi, Darby--  I'm not really sure what you're saying. Which version of IE are you using?

Where did you see the text of the message you call an "error message"?  Can you follow these steps https://groups.google.com/forum/#!topic/httpfiddler/SsZnGxdxklg and report your results?

Regards,
Eric Lawrence
Telerik

 

 

[Darby]

1. error message in yellow under the tool bar, saying to turn capture on, when you try to turn on, it goes off again and in the log it states the error message at the top of this thread.
2. when i hit the two links in the erics law, i get 2 lines of traffic each time, but the yellow alert message about capture being off and to click to enable is still there  will not enable
3. IE version : 9.0.8112.16421 internet explorer 9
4.fiddler version V2.4.9.4 the 64bt one
5. it ran fine until a windows update a week or so ago, originally i had to restore back a few days and it worked again, now i cant restore back any further and i cant get it to capture.
6. i have also tried uninstalling and reinstalling fiddler and its stillthe same

[Eric Lawrence]

Hi, Darby--

When Fiddler isn't running, inside IE's Tools > Internet Options > Connections > LAN Settings, what are the settings values you see?

The yellow bar indicates that some other application is changing your system proxy settings away from Fiddler. In order for Fiddler to work properly, you will likely have to find that application and disable it. The information I requested at the start of this message may help in that process.

Regards,
Eric Lawrence
Telerik

 

 

[Darby]

Under the Internet options, connections, LAN settings: only thing checked is proxy server: use a proxy server for your LAN (these settings will apply to dial-up or VPN connections) 

The address box and port are empty and frayed out like you can't enter anything in them 


The bypass proxy server for local address is unchecked

The automatic detect settings is unchecked

The use automatic configuration script is unchecked 

[Eric Lawrence]

> The address box and port are empty and frayed out like you can't enter anything in them 

If you click the Advanced button on that screen, what are the settings?

From the description you've provided, it suggests that some other program on your PC is changing your proxy settings. If this is a work PC or one that uses VPN or remote networking, it may be that program. If not, then this might be an unwanted piece of software that is injecting advertising or malicious content into your browser as you navigate.

Regards,
Eric Lawrence
Telerik

 

 

[Darby]

When advanced button is pressed it shows: 
HTTP: 127.x.x.1    : PORT 57887

The x's are numbers and not sure why this is here. Does not look familiar with this computer 

[Eric Lawrence]

If you visit http://127.0.0.1:57887 (assuming the x.x is 0.0) in your browser without Fiddler running, what do you see?

My guess is that you'll see something like "BrowserSafeguard Echo Page" which indicates that you probably have unwanted software on your PC, which you should remove using the Add/Remove Programs control panel.

Alternatively, you can see what process is running on port 57887 to find the culprit.

Regards,
Eric Lawrence
Telerik

 

 

[Darby]

When put the http://127.0.0.1:57887. Nothing happens then states Internet explorer cannot display page. How do I check the port 57887 as you had mentioned 

[Eric Lawrence]

You can use netstat -a -o from the command line to get the process id (PID) of the client that is listening on the target port. You can then type tasklist /fi "pid EQ ####" where #### is the process identifier. This will give you the executable name.

Regards,
Eric Lawrence
Telerik

 

 

[Darby]

From what I can tell its PID number 5400 which in task list states "netsession_win.exe" , again this all starting giving me issues after a windows upgrade. I don't use any " netsessions" program. So I'm not sure what to do next 

[Eric Lawrence]

The timing of your WindowsUpdate is almost certainly a coincidence. You can use your computer's "Find" feature to find the location of the "netsession_win.exe" file which may reveal what program it is a part of. You can then decide whether or not to uninstall that program.

http://www.hanselman.com/blog/CSIMyComputerWhatIsNetsessionwinexeFromAkamaiAndHowDidItGetOnMySystem.aspx

https://forums.malwarebytes.org/index.php?/topic/113111-uninstalling-akamai-netsession-winexe/ suggests that the executable in question may cause other performance problems.

Regards,
Eric Lawrence
Telerik