Suspicious activity that Kaspersky doesn't notice [Moved]

[MartinMM]

Everytime I start my PC the proxy settings change automatically with the script enabled and the address http://127.0.0.1:86/ added.

This details are also updated on the registry and keeps resetting back to this 127. 0.0.1:86 after deleting them in the registry. My Kaspersky is running and have done a full scan but can detect any malware or virus on the computer. Anyone who has an idea of what's this?

[onix]

You won’t get any answers here, try asking on r/computerviruses or r/proxies you may find more answers there

[richbuff]

Welcome. If the issue is not readily resolvable, please contact Tech Support, link is located at top of this web page.

[Flood and Flood's wife]

Hello @MartinMM, 

Additional to @richbuff:

1. Is the software KAV or KES11? 
2. IF the Kaspersky software protection is paused & Kaspersky application exited, the machine powered OFF & on, do the settings change? 
3. Which “script” is enabled? 
4. What programs are enabled to start at Startup? 

Please let us know? 

Thank you🙏

Flood🐳+🐋

Resource: 

Read before you create a new topic! tutorial by @Danila T. 

[MartinMM]

Hello @Flood and Flood's wife

Thank you for your feedback. To answer your questions:

1.  It's KES 11
2. Kaspersky is not paused and working well without any issues
3. The Script is shown in the image below on windows Proxy settings:

4. 

   Programs enabled at startup are: Google Drive, Skype, OneDrive, CCleaner, Waves MaxxAudio and Realtek HD Audio manager

 

[Flood and Flood's wife]

Hello @MartinMM, 

Thank you👌

If there’s no answer from the Community, please raise a request with Kaspersky, via your Kaspersky Company account.

Thank you🙏

Flood🐳+🐋

[ak01]

you could start procmon (sysinternals)to see which process is doing that change

[MartinMM]

Thanks @Flood and Flood's wife  and @ak01  for your responses. I will raise it via the account as well as do more research on this