PanicStation.org
UK USA
uk Technology & digital loss

What to do if…
your computer suddenly routes web traffic through a proxy you did not set

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy UK guide

Short answer

Disconnect from the internet before signing in anywhere else. If this is a work or school device, pause changes and contact the official IT route; otherwise, record and disable the unexpected proxy settings.

Do not do these things

  • Don’t keep browsing, or log into banking, email, work, or password-manager accounts while the proxy is active.
  • Don’t install “proxy remover” tools, browser extensions, or security apps from pop-ups, adverts, or unknown sites.
  • Don’t change settings on a work or school device if you are not authorised to do so.
  • Don’t factory reset the computer straight away if you may need screenshots, IT support, or a report.
  • Don’t assume it is definitely malware, but do treat it as suspicious until you know why it changed.

What to do now

  1. Disconnect the affected computer.
    Turn off Wi-Fi and unplug Ethernet. This stops more web traffic being sent through the proxy while you check what changed.

  2. If it is a work or school device, use the official IT route first.
    Tell them: “A proxy was enabled that I did not set.” Ask whether the device is managed and whether a proxy, PAC file, or setup script is expected.

  3. Record the proxy details before changing them.
    Take a photo or screenshot of any proxy server address, port, PAC file, setup script URL, or auto proxy discovery setting. Do this without signing in to other accounts on the affected computer.

  4. Check automatic proxy settings.
    Look for settings called Automatic proxy setup, Use setup script, configuration script, Auto proxy discovery, or PAC.

    • On Windows, this is usually in Settings > Network & internet > Proxy.
    • On Mac, this is usually in System Settings > Network > your connection > Details > Proxies.
      If something is enabled and you do not recognise it, turn it off unless the device is managed and IT has told you not to.

  5. Check the manual proxy setting.
    Look for a proxy server address and port that you did not set. If you do not recognise it, disable it, unless it is expected for a managed work or school device.

  6. Restart and check whether the proxy returns.
    If the proxy turns itself back on, disconnect again. Treat this as a sign that software, device management, malware, or another setting may be enforcing it.

  7. Secure your most important accounts from a different trusted device.
    Use a phone or another computer you trust, on a known network. Start with your email account, because it can reset other accounts. Change the password, turn on two-step verification if available, review recent sign-ins or devices, and sign out other sessions if the service offers that option. Then do the same for banking, your password manager, and accounts linked to money or recovery.

  8. Run security checks on the affected computer.
    Use built-in security tools or a reputable anti-malware tool downloaded only from the vendor’s official site. Install pending operating system and browser updates, then restart and check the proxy settings again.

  9. Report it if you suspect fraud or cybercrime.
    For England, Wales, or Northern Ireland, use Report Fraud. For Scotland, use Police Scotland. If a crime is happening now and there is immediate danger, call 999. If you are an organisation under a live cyber attack, use the urgent phone route listed by Report Fraud.

What can wait

  • You do not have to work out who changed the proxy right now.
  • You do not have to decide whether to factory reset the computer immediately.
  • You do not have to contact every online service today; prioritise email, money-related accounts, and account-recovery accounts.
  • You do not have to prove exactly what happened before taking basic protective steps.

Important reassurance

An unexpected proxy setting is alarming, but the first protective steps are small and practical: disconnect, record what you see, remove the unexpected setting if you are allowed to, secure key accounts from a trusted device, and check whether the setting returns.

Scope note

These are first steps only. If the proxy reappears, the device is managed, accounts show unfamiliar activity, or money or work systems may be affected, later decisions may need specialist IT support, your organisation’s security team, your bank, or a formal report.

Important note

This is general information, not legal, medical, financial, therapeutic, cybersecurity, technical, or other professional advice. If you are unsure whether the proxy is expected, especially on a work or school device, pause changes and use the official support route for that device.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us