Almost every application suddenly prompting for proxy credentials

Topic

New Reply

Windows 10 22H2.
No updates or new application installs in the past week, no shady attachments opened or dastardly popups clicked. Windows Defender enabled.

System has been operating just fine but this afternoon I went and had a shower and when I came back there was a dialog on the screen saying “The server 172.234.198.180 is asking for your username and password.” When I cancelled this and went to google what it meant I got the dialog again. When I visited each tab in the browser I got the dialog again. After cancelling each of these dialogs the tabs’ contents were replaced with a variety of “error 407”, or “you do not appear to be online”, or “access denied”. When I went to Settings > Apps to check if some update or app had just been installed I got a similar dialog, this time saying “To access this service you need to log in to the https proxy server 172.234.198.180:3128”. Even itunes, trying to play a track off the local disk, showed the dialog three times before the track played.

Checking Settings > Network > Proxy I saw that the first option was set to “automatically detect settings”, nothing else was filled in on that page. In fact this is the identical config I have on all my other Windows machines, none of which are showing this problem.

Anyway, I can confirm that turning “automatically detect settings” off and rebooting solved my problem.

I then ran several malware scans: malwarebytes, kaspersky KVRT, ESET online scanner; none of them detected any infections.

I am left with several questions:

What might have triggered an apparently invisible change to the proxy settings?

Where does Windows store the address of the proxy server that it thinks you want to connect through (I searched for the 172.234.198.180 address in the registry and couldn’t find it)?

Might I still be at risk of something acquiring/storing/sending out my credentials? This is the machine I do my banking on, for example.

Is there any benefit at all in having the network proxy settings set to automatic detection? (In the meantime I have turned that setting off on all my other machines as well.)

Thanks for any helpful info you can offer

T

Reply | Quote

Replies

Any chance you’re using a VPN?

I’ve found that when many websites determine/believe you’re on a VPN, they try every conceivable way to trick you into leaving your protected VPN connection.

I usually delete all cookies and shut down/reboot.

Suppose flushing your DNS cache wouldn’t be a bad idea.
Also, I suggest unplugging your modem/router for a couple minutes, then plugging it back in.
Often, simple solutions solve these kind of issues.

If not, one of our community MVPs will need to offer solutions to more difficult persistent problems.

Reply | Quote

aquatarkus wrote:

…I went and had a shower and when I came back there was a dialog on the screen saying “The server 172.234.198.180 is asking for your username and password.”

Any chance that someone else had the opportunity to use the computer while you were in the shower, and who may have inadvertently clicked on something incorrectly while you were in the shower?

I believe that something (a program or an update for a program) may have had a configuration change that produced the message, even though the setting was unchanged from where it had previously been set. Looking at what @Sisyphus7x64 refers to above may provide an (or the) answer.

Reply | Quote

Leave all IP settings as auto-detect unless you are doing special things / know what you are doing. This is how internet connections work using DHCP.

The login request has been triggered by something and a reboot may clear it. If not, try logging in with rubbish credentials to see if it gives you more clues about the server.

cheers, Paul

Reply | Quote

There’s nobody here who could have run something while I was away; I work at home and my wife was out.

I have to modify my statement that there were no updates in the last week – now that everything is functioning without this proxy login blocking most of the features, when I sort the Apps & Features list by date I can see that sometime yesterday (can’t see a timestamp, only the date) the following items were updated:

Copilot version 1.0.4.0
Microsoft 365 (Office) version 18.2408.1212.0
Windows Package Manager Source (winget) V2 version 2024.8.30.625.29

According to the Windows Update history, the last update was installed on Aug 15. The above updates seem to have happened without appearing in the history.

cheers
T

 

Reply | Quote

172.234.198.180

This IP address belong to Linode LLC in Chicago, Illinois

Reply | Quote

Here is a Google search for Linode/Akamai. It is concerned with Cloud computing.

Reply | Quote