Bug: Messing with Windows Proxy settings
Status: RESOLVED
Priority: --
Resolution: INCOMPLETE
Created: 2020-02-08 08:00:12+00:00
Resolved: 2021-04-04 21:36:37+00:00

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36

Steps to reproduce:

It's enough to have Thunderbird open and just wait an issue to happen. 

Environment:
Thunderbird proxy connection settings are "Use system proxy settings".
Using ordinary ethernet connection - no VPN is conencted!
Windows 10 v1909



Actual results:

Thunderbird.exe changes the proxy settings in the windows registry. After all system proxy settings based applications lose Internet acces (e.g. Chrome, Slack..).

Extract from Process Monitor:
07:48:25,4667323	thunderbird.exe	12468	RegQueryKey	HKCU	SUCCESS	Query: HandleTags, HandleTags: 0x0
07:48:25,4667467	thunderbird.exe	12468	RegOpenKey	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	Desired Access: Read
07:48:25,4667610	thunderbird.exe	12468	RegQueryValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	SUCCESS	Type: REG_DWORD, Length: 4, Data: 0
07:48:25,4667783	thunderbird.exe	12468	RegQueryValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer	NAME NOT FOUND	Length: 144
07:48:25,4667913	thunderbird.exe	12468	RegQueryValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	SUCCESS	Type: REG_SZ, Length: 16, Data: <local>
07:48:25,4668066	thunderbird.exe	12468	RegQueryValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL	NAME NOT FOUND	Length: 144
07:48:25,4668169	thunderbird.exe	12468	RegQueryValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect	NAME NOT FOUND	Length: 16
07:48:25,4668306	thunderbird.exe	12468	RegCloseKey	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	
07:48:25,4668490	thunderbird.exe	12468	RegQueryKey	HKCU	SUCCESS	Query: HandleTags, HandleTags: 0x0
07:48:25,4668603	thunderbird.exe	12468	RegCreateKey	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	Desired Access: Write, Disposition: REG_OPENED_EXISTING_KEY
07:48:25,4668816	thunderbird.exe	12468	RegSetValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	SUCCESS	Type: REG_DWORD, Length: 4, Data: 1
07:48:25,4669787	thunderbird.exe	12468	RegSetValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer	SUCCESS	Type: REG_SZ, Length: 32, Data: proxy.gov.si:80
07:48:25,4670373	thunderbird.exe	12468	RegSetValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	SUCCESS	Type: REG_SZ, Length: 52, Data: <local>;local; pusnik.xyz
07:48:25,4670926	thunderbird.exe	12468	RegDeleteValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoConfigURL	NAME NOT FOUND	
07:48:25,4671453	thunderbird.exe	12468	RegDeleteValue	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\AutoDetect	NAME NOT FOUND	
07:48:25,4671941	thunderbird.exe	12468	RegCloseKey	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SUCCESS	



Issue can be also detected with "Event Viewer" by setting custom filter with "by log  by Microsoft-Windows-WinHttp/ProxyConfigChanged".


Expected results:

Thunderbird.exe should not change system proxy settings!

Additional info:
* proxy.gov.si:80 was once set as a manual proxy on a VPN profile, which was deleted weeks ago!
* Before thunderbird set registry keys, there was a related read registry activity:
...
07:48:23,3214822	LocalBridge.exe	5516	RegQueryValue	\REGISTRY\WC\Silo9eeab5d6-23ba-d782-a907-9b9e38b84dafuser_sid\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	SUCCESS	Type: REG_DWORD, Length: 4, Data: 1
07:48:23,3214959	LocalBridge.exe	5516	RegQueryValue	\REGISTRY\WC\Silo9eeab5d6-23ba-d782-a907-9b9e38b84dafuser_sid\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer	SUCCESS	Type: REG_SZ, Length: 32, Data: proxy.gov.si:80
07:48:23,3214974	RuntimeBroker.exe	12388	RegQueryValue	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry	SUCCESS	Type: REG_DWORD, Length: 4, Data: 1
07:48:23,3215069	LocalBridge.exe	5516	RegQueryValue	\REGISTRY\WC\Silo9eeab5d6-23ba-d782-a907-9b9e38b84dafuser_sid\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride	SUCCESS	Type: REG_SZ, Length: 52, Data: <local>;local; pusnik.xyz
...
07:48:23,3299497	LocalBridge.exe	5516	RegQueryValue	\REGISTRY\WC\Silo9eeab5d6-23ba-d782-a907-9b9e38b84dafuser_sid\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer	SUCCESS	Type: REG_SZ, Length: 32, Data: proxy.gov.si:80
...
that traced to registry hive file :\ProgramData\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\S-1-5-21-3795996945-4286000277-1262582828-1002\SystemAppData\Helium\user.dat.

Even if the latter is a MS / OfficeHub issue (deleted VPN profile should be deleted along with all the settings) I thing thunderbird should be not meesing (setting) with system proxy setting.