us Technology & digital loss

What to do if…
your computer suddenly routes web traffic through a proxy you did not set

Produced and maintained by PanicStation.org Published: 28 June 2026 Last reviewed: 17 July 2026 Editorial policy USA guide

Short answer

Disconnect from the internet, stop logging into accounts on that computer, and check whether the proxy was set by your workplace, school, or security software before you keep browsing.

Do not do these things

Don’t log into email, banking, work systems, or your password manager while the unknown proxy is active.
Don’t download “fix” tools from pop-ups, ads, or unfamiliar sites.
Don’t assume it is harmless; treat the connection as possibly unsafe until you have checked it.
Don’t factory reset immediately if you may need IT help or need to keep screenshots of what changed.

What to do now

Get to a safer pause and disconnect.
Turn off Wi-Fi and unplug Ethernet. If this happened on public Wi-Fi, do not rejoin that network yet.
If this is a work or school device, pause and contact the official helpdesk.
Say: “A proxy was enabled that I did not set.” Managed devices may use a proxy or PAC script on purpose, and IT can tell you whether it is expected.
Record the proxy details before changing them.
Take a screenshot or write down any proxy address, port, setup script, PAC file address, or “automatic proxy discovery” setting you do not recognize. Do not type passwords or recovery codes into the affected computer while doing this.
Turn off any unfamiliar automatic proxy setup or script.
Look for automatic proxy setup, configuration script, Use setup script, Auto proxy discovery, or PAC.
- On Windows, this is usually under Settings → Network & internet → Proxy.
- On Mac, this is usually under System Settings → Network → your connection → Details → Proxies.
  If the setting shows an address you do not recognize and the device is not managed by work or school, turn it off and save the change.
Turn off any manually set proxy server you did not set.
If you see an unfamiliar IP address, domain, or port under manual proxy settings, disable it and save the change.
Restart, then check whether the proxy came back.
If it turns back on after restart, disconnect again. This may be malware, unwanted remote management, a browser extension, or a device-management policy.
From a different trusted device, protect the accounts that unlock other accounts.
Use a phone or computer you trust. Change your email password first, turn on multi-factor authentication, review recent sign-ins or devices, and sign out other sessions if the service offers that option. Then check accounts tied to money, your password manager, and account recovery.
Scan and update the affected computer from official sources.
Use built-in security tools and reputable anti-malware software from an official source. Install operating-system and browser updates, restart, and scan again if the proxy reappears.
Report only if there was fraud, identity misuse, or suspected internet crime.
Use official reporting routes. IC3 is for internet crime complaints, ReportFraud is for scams and fraud reports, and IdentityTheft.gov is for identity-theft recovery steps.

What can wait

You do not have to identify the exact malware, attacker, or technical cause right now.
You do not need to contact every account provider at once; start with email, money-related accounts, and recovery accounts.
You do not have to wipe the computer today unless IT support, security scans, or repeated proxy changes point that way.
You do not need to decide whether to make a formal report unless money, identity details, work data, or accounts were affected.

Important reassurance

An unexpected proxy setting is unsettling, but the first steps are simple: pause browsing, remove the unfamiliar setting if it is not managed, protect key accounts from a trusted device, and scan. Taking it seriously does not mean you have to solve everything at once.

Scope note

These are first steps only. If the proxy reappears, the device is managed, accounts were accessed, money was lost, or work data may be involved, later decisions may need hands-on IT, cybersecurity, financial, or legal help.

Important note

This is general information, not professional cybersecurity, legal, financial, or technical support advice. If you believe a crime is actively in progress or someone is in immediate danger, contact local authorities.

Additional Resources

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us