Proxy Settings Keep Turning Back On? Find What Is Writing Them

You switched the proxy off. Ten minutes later, or after the next restart, it is on again, pointing at the same address. Switching it off a second time does nothing lasting, because the toggle was never the problem. It is a window onto a stored value, and something on the machine has permission to store that value again whenever it likes. Until you find that something, you are in a loop.

The candidates fall into three groups, and they call for very different responses. A program you installed on purpose, such as a VPN, an ad blocker, or an antivirus web filter, keeps a proxy in place as part of how it works, and a broken uninstall leaves the setting orphaned. A policy or configuration profile, from an employer or a school, re-applies the setting by design. And unwanted software uses a proxy for the oldest reason there is: a proxy sees everything you send through it, so redirecting your traffic is a direct way to inject ads, swap search results, or read what you type into login pages. This guide is written to tell those three apart by evidence, not by guesswork, because the third case deserves more than a toggle.

Read the address before you clear it

The proxy address on the settings page is the single most useful piece of evidence you have, so write it down before you switch anything off. On Windows it sits under Settings, Network & internet, Proxy, in the Manual proxy setup box, and a second one may sit under Use setup script. On a Mac it is in System Settings, Network, your connection, Details, Proxies.

Two of these deserve a word. A public address is easy to check: paste it into our IP lookup and read who owns it and where it is. A hosting company in a country you have no connection to, on a machine where you never bought a proxy, is not a coincidence. A setup script is more subtle. A PAC file is a small program that returns a different proxy for different sites, so an attacker can send only your banking or shopping traffic through their server while everything else works normally and you notice nothing. If the script URL is not your employer's, treat the machine as compromised until the scan in the malware section below says otherwise.

Use the timing to narrow the writer

When the setting comes back tells you what kind of thing is writing it.

• Instantly, or within seconds of switching it off. A running process is watching the value, or a policy is enforcing it. If the toggle is greyed out or the page says some settings are managed by your organization, it is a policy.
• After a restart or sign-in. A startup program, a scheduled task, a service, or a logon script writes it once at boot.
• When a particular program opens. That program, or a helper it launches, is the writer. VPN clients and "secure browsing" tools do this on purpose.

Windows: find and stop the writer

1. Check for a policy first

A greyed-out proxy page means a policy value is present. Open Registry Editor (regedit) and look at these locations:

• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel, value Proxy. A value of 1 locks the proxy settings for your account. The same value can exist under HKEY_LOCAL_MACHINE.
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings. Values here apply the proxy for every user of the machine.
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome and HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge. Values named ProxyMode, ProxyServer, ProxyPacUrl, or ProxySettings force the browser's proxy regardless of what Windows says. Chrome shows the same values at chrome://policy.

On a personal computer none of these should exist. Right-click each key, choose Export to save a backup, then delete the proxy values and restart. On a computer owned by an employer or school, stop here: the policy is deliberate, and the person to talk to is the administrator.

2. Look at what runs at startup

Most writers are launched at sign-in. Open Task Manager and check the Startup apps tab for anything you do not recognise. Then open Task Scheduler (taskschd.msc) and read the Task Scheduler Library: a task with a random or generic name that runs at logon or repeats every few minutes is exactly what a proxy hijacker installs. Services (services.msc) is the third list; a leftover VPN or "network filter" service often lives here after the product itself is gone.

A faster way to see all three lists at once is Autoruns, a free tool from Microsoft Sysinternals. It shows every program that starts automatically, with its publisher and file path, and lets you untick an entry rather than delete it, so a mistake is reversible. Untick the suspect, restart, and see whether the proxy stays off.

3. Catch the writer in the act

If the lists do not make it obvious, stop guessing and watch the registry. The proxy setting lives at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings, in the values ProxyEnable, ProxyServer, and AutoConfigURL. Process Monitor, also from Sysinternals, records every write to it and names the process responsible.

1. Start Process Monitor and open the Filter dialog.
2. Add Operation is RegSetValue, then add Path contains ProxyEnable. Apply.
3. Switch the proxy off in Settings, and wait for it to come back.
4. Read the Process Name column on the new event. That is your writer, with its full path in the event details.

This method has no false positives. Whatever it names is the thing to remove.

4. Remove it properly

If the writer is a product you recognise, uninstall it from Settings, Apps, Installed apps, and use the vendor's own removal tool if one exists, because VPN clients and security suites routinely leave a service and a virtual network adapter behind. Then clear the proxy in all three places Windows keeps it, which how to turn off a proxy walks through: the Settings page, the Internet Options LAN settings, and the WinHTTP layer with netsh winhttp reset proxy.

If the writer is something you have never heard of, do not just uninstall it. Treat the next section as mandatory.

5. When the writer is malware

The signs that separate an intercepting proxy from a clumsy leftover: a remote address or unknown PAC script, scheduled tasks you did not create, changed browser home page or search engine, extensions you did not add, and above all a root certificate you did not install. A proxy cannot read HTTPS traffic unless the machine trusts a certificate the proxy holds, so hijackers install one. Open certmgr.msc, expand Trusted Root Certification Authorities, and look for an issuer that is not Microsoft, your operating system vendor, or a well-known authority. An unfamiliar root with a recent date is the strongest evidence you will find.

Then clean in this order:

1. Run a Microsoft Defender Offline scan. Open Settings, Privacy & security, Windows Security, Virus & threat protection, Scan options, and choose Microsoft Defender Offline scan. The machine restarts and scans before Windows loads, which is the point: software that hides while Windows is running cannot hide from this.
2. Run a second-opinion scanner. Malwarebytes and AdwCleaner are the two most widely used free options for adware and browser hijackers, and either can be removed afterwards.
3. Remove unknown extensions from every browser, then reset each browser's settings (Chrome: Settings, Reset settings) so that home page, search engine, and startup pages are restored.
4. Delete the unknown root certificate.
5. Clear the proxy in all three places, and confirm the writer has not returned with Process Monitor.
6. From a different device, change the passwords for anything you logged into while the proxy was active. A proxy with a trusted root certificate could read those logins. This step is unpleasant, and it is the reason to do the evidence gathering above rather than assume the best.

If the proxy still returns after all of that, Reset this PC with the keep-my-files option is the honest last resort. It removes every program, including the one you could not find.

macOS: find and stop the writer

macOS has its own set of writers, and the same order applies.

Profiles. Open System Settings, General, Device Management (Privacy & Security, Profiles on Ventura). A profile can set the proxy for the whole system and re-apply it every time the panel closes. Remove any profile you did not install. A managed work Mac will refuse, which tells you the writer is your employer.

Login and background items. System Settings, General, Login Items & Extensions lists what starts at login and, under Allow in the Background, what is permitted to run unattended. Unknown entries here correspond to launch agents, which live as small .plist files in ~/Library/LaunchAgents, /Library/LaunchAgents, and /Library/LaunchDaemons. Adware on the Mac has favoured a launch agent that re-applies a proxy at login for years, and removing the plist plus the program it points to ends it.

Safe Mode test. Start the Mac in Safe Mode (hold Shift during startup on Intel, or hold the power button and choose Safe Mode on Apple silicon). Login items and third-party agents do not run there. Turn the proxy off, restart normally, and check whether it came back. If the proxy stays off in Safe Mode and returns in normal mode, the writer is one of the items above.

The live state. Terminal shows the truth regardless of what the panel displays:

scutil --proxy
networksetup -getwebproxy Wi-Fi
networksetup -getautoproxyurl Wi-Fi

And the same tool can switch each protocol off, for the service you use (replace Wi-Fi with Ethernet if that is the active one):

networksetup -setwebproxystate Wi-Fi off
networksetup -setsecurewebproxystate Wi-Fi off
networksetup -setsocksfirewallproxystate Wi-Fi off
networksetup -setautoproxystate Wi-Fi off
networksetup -setproxyautodiscovery Wi-Fi off

Malware on the Mac. Check Keychain Access, System keychain, Certificates category, for a root certificate you do not recognise marked as trusted, and check each browser for unknown extensions. Malwarebytes for Mac is the standard second-opinion scanner. The password advice from the Windows section applies without change.

Phones

On an iPhone the writer is almost always a profile: Settings, General, VPN & Device Management. On Android, a per-network Wi-Fi proxy only returns if an app rewrites it, so look at Settings, Security, Device admin apps for anything you did not grant, and at Settings, Network & internet, VPN for an always-on VPN you no longer use. Our turn-off guide has the exact paths for both.

Confirm it stayed off

A day later, check three things. The proxy page still shows the setting off. The registry value ProxyEnable still reads 0x0 (run reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable), or scutil --proxy still shows every Enable as 0 on a Mac. And our IP lookup reports an address that belongs to your ISP as the one the web sees. If all three hold, the loop is broken.

A proxy you choose is a different thing

None of this is an argument against proxies. It is an argument against proxies you did not choose, pointing at servers you cannot see into. The proxy settings panel exists because there are good reasons to route traffic deliberately: reaching a site from another country, testing how a page looks from elsewhere, or keeping a scraper's requests off your home address. When that is the goal, the address should be one you picked from a source that tells you what it is. Our free proxy list shows the country, the type, and the last time each address answered a check, and are free proxies safe is the honest account of what a free public proxy can and cannot see, which is the same question this whole guide has been about from the other side.