Malware and/or Virus Preventing Internet Connection for All Applications

[wennettbilliams]

I recently bought a MacBook Pro 2017 and was using it fine for a while until I ran into a major problem that I can only guess is caused by malware. No matter whether I am connected via WiFi or Ethernet I am always met with a “You are not connected to the internet” error on every app. Even though it says I’m connected to my home network. Normally I would be able to troubleshoot this myself using malwarebytes or antivirus but with absolutely zero access to the internet, I am at a loss as to what I can do besides wipe my hard drive and reinstall MacOS. I really don’t want to do that as I have a few expensive applications on this computer that I need to keep and I don’t know how to keep them if I were to wipe the Mac. All programs that don’t require internet access to function are working 100% fine. I have not fiddled with any network settings and this smells an awful lot like malware or a virus to me. 

I have already grabbed files I want to save and copied to external hard drive but I really need to figure out how to backup my Final Cut Pro X and Logic Pro X.

Sorry if I haven’t given a lot of useful info, I am normally a PC user so I don’t know a lot about this computer yet.

Please help!

Thanks

Edited July 10, 2018 by wennettbilliams

[alvarnell]

Certainly doesn't sound like any Mac malware that I know of. It's possible your router has been hacked though. See Troubleshoot an infected or hacked router in https://support.malwarebytes.com/docs/DOC-1296

Just because you are connected by WiFi or Ethernet to your Router does not mean you can connect to the Internet. Could be a bad modem, or your connectivity to your ISP network or some problem that the ISP is having.

With WiFI turned on, hold the Option-key (sometimes called "Alt") down while you click on the WiFi menubar icon and select "Open Wireless Diagnostics...". That may give you some clues as to what's gone wrong.

Take a look at your modem and see if the lights indicate any problem.

Sometimes is as easy to fix as unplugging your modem for 30 seconds or so, plug it back in and wait for the lights to signal your connected.

You may need to contact your ISP.

[wennettbilliams]

On 7/10/2018 at 5:30 PM, alvarnell said:

Certainly doesn't sound like any Mac malware that I know of. It's possible your router has been hacked though. See Troubleshoot an infected or hacked router in https://support.malwarebytes.com/docs/DOC-1296

Just because you are connected by WiFi or Ethernet to your Router does not mean you can connect to the Internet. Could be a bad modem, or your connectivity to your ISP network or some problem that the ISP is having.

With WiFI turned on, hold the Option-key (sometimes called "Alt") down while you click on the WiFi menubar icon and select "Open Wireless Diagnostics...". That may give you some clues as to what's gone wrong.

Take a look at your modem and see if the lights indicate any problem.

Sometimes is as easy to fix as unplugging your modem for 30 seconds or so, plug it back in and wait for the lights to signal your connected.

You may need to contact your ISP.

I don’t believe it’s a problem with my modem or network due to the fact that this problem is happening solely on my computer and has affected no other devices for the extent of the time I have has this problem. Unless it’s possible that a problem with my modem could only be affecting this one device?

I have attached the diagnostics report that "Wireless Diagnostics" created, just in case that is of any help.

My router does not show any signs of not working properly from a physical side (no difference in lights on router from what I can tell) and my computer lets me "connect" to the network just fine on every device, it’s like something is somehow blocking my connection to the network locally.

I also would like to know if there is a way to install malwarebytes without having an internet connection as I have tried to do so before and was not able to.

Edited July 12, 2018 by treed
remove wireless diagnostics, for privacy reasons

[alvarnell]

31 minutes ago, wennettbilliams said:

I also would like to know if there is a way to install malwarebytes without having an internet connection as I have tried to do so before and was not able to.

I know it's not possible to update the database without Internet connectivity and I can see from examining the installer that it comes with an empty database, so there is no way to detect anything.

The Diagnostic should have given you some clues on what to check. Since other devices on your local network are working fine, then it must be something on your computer.

Did you check to see if your DNS settings have been changed? Look at "Troubleshoot Internet connectivity" in this document https://support.malwarebytes.com/docs/DOC-1065.

Edited July 10, 2018 by alvarnell

[treed]

I removed the diagnostics file from your post, since it may reveal personal information you don't want shared.

I see some signs in your diagnostics file that your computer was able to connect to an Apple server successfully, so it doesn't look like it's a universal issue. Is this only affecting a particular app?

What happens if you boot in safe mode?

http://support.apple.com/kb/HT1455

[wennettbilliams]

2 minutes ago, treed said:

I removed the diagnostics file from your post, since it may reveal personal information you don't want shared.

I see some signs in your diagnostics file that your computer was able to connect to an Apple server successfully, so it doesn't look like it's a universal issue. Is this only affecting a particular app?

What happens if you boot in safe mode?

http://support.apple.com/kb/HT1455

Well I have tried to open every app that I could and none of them think they have internet access. I have tried booting in safe mode several times, same problem. 

On 7/10/2018 at 6:26 PM, alvarnell said:

I know it's not possible to update the database without Internet connectivity and I can see from examining the installer that it comes with an empty database, so there is no way to detect anything.

The Diagnostic should have given you some clues on what to check. Since other devices on your local network are working fine, then it must be something on your computer.

Did you check to see if your DNS settings have been changed? Look at "Troubleshoot Internet connectivity" in this document https://support.malwarebytes.com/docs/DOC-1065.

I also tried the Network Diagnostics reccomendations aswell (resetting proxy settings and restarting router)and tried what the linked page reccomended, with no results.

[treed]

If you're having the same problem in safe mode, then whatever the cause of the problem is, it's not third-party software, including malware. It's a configuration issue somewhere, probably on your Mac, but I'm not sure what that might be.

Since the network connections done in the diagnostics were to raw IP addresses, that could mean that the problem is with your DNS settings, and the problem isn't with the network connection itself, but rather is with the ability to look up IP addresses for domain names. See:

https://support.apple.com/en-us/ht203244

[wennettbilliams]

Okay, thank you. I’m assuming since this problem has been determined not malware that I should seek help elsewhere if the problem persists after I do what you reccomended? Or will you or other still be able to help troubleshoot the problem on this board even though it’s not a malware issue?

[treed]

There has been malware that has been known to change network settings. It's not particularly common, but it has happened. So I'm definitely interested in continuing to follow what's going on, and we can still give advice regardless.

[caypirynja]

I have the same problem. My mac caught a virus in the last days and I used malwarebytes to get rid of this search.news tool bar-thing. (Forgot the name)

I let Malwarebyte run a test and it found 2 files which where put into quarantine. I deleted this 2 files. After that my internet connection was lost, but my wifi is still connected. Any app which uses internet doesn't work anymore (safari, chrome, app store ...)

Did you find a resolution for this particular problem?

[treed]

What were the files that were removed? Have you restarted your computer?

[Manny2]

I am having the same issue. 

 

Let me start off by saying, I believe I know where this started:  About 10 days ago I clicked on an “update Adobe flash player icon” in Facebook on my Mac.  I had run out of lives in the Candy Crush iPhone app, and I wasn’t thinking clearly...I just needed to play. I am very aware of how stupid this was; cyber victim blaming will not help me now. 

 

Fast forward to 4 days ago. My computer started redirecting every search to Yahoo instead of google. Then my internet shut down. I wasn’t really sure what to make of it. I did a little trouble shooting. At the time I wasn’t paying close enough attention to the issue to remember how I got it to work again, but I did. 

 

Yesterday my browser started re-directing me to Yahoo again. I did some research online, and downloaded Malwarebytes to try and locate the issue. There were several issues identified, and I deleted them. Again, I thought the issue had resolved. 

 

Today I was again redirected to Yahoo whenever I try to search for something in Safari. I quit Safari and tried to use Chrome. Chrome it did not work either. I switched Wi-Fi networks, and still could not connect to the Internet. I then connected my computer to the personal hotspot on my phone (all of these were troubleshooting techniques I’d used previously). The same problem was there: I could not connect to the Internet from anywhere on my computer, including messages, email, and AppStore. I was able to use the Wi-Fi network on my iPhone without any issues. I called Apple support. I talked to someone on the phone for over an hour.  We thought the problem was resolved, but then about two hours later it happened again. I called Apple support a second time; I had to be transferred to an administrator. We went through some new troubleshooting options, and I thought everything was fine. 

 

About two hours after the second call, the problem got significantly worse. I am now having to shut down my computer and restart in recovery mode every 15 to 20 minutes because my computer won’t use the internet. I am no longer being redirected to Yahoo. The computer just stops doing anything that requires the Internet after a random search from the search bar. Safari says that it cannot locate the website host; it does not say I am not connected to the Internet.  I have done numerous Malwarebytes scans, and am consistently told I am “clean”. All of my requests in other apps time out as well. 

 

I have gone through 2+ hours of troubleshooting this with Apple Support, so the standard, obvious explanations have been checked and eliminated as the cause. I am going to erase my mac and start over, because I don’t know what else to do. I am mostly just posting this so others can be aware that this is a real issue. I am sure any future readers (including myself) would appreciate any info on if/how to resolve this without having to go to extremes.

.  

[alvarnell]

There are a bunch of settings that can be modified by current malware that cannot be changed by running Malwarebytes, so you will need to check some more. It might help if you can tell us what files Malwarebytes found for you. You may have already done some of this while working with Apple, but can't be certain from your description of those calls.

From what you have said, I think we can safely say that the problem is not with your network, but limited to something still wrong with your Mac setup.

First I need you to read through this pinned posting at the top of the Forum carefully and check each and every item that you have not already done.

If that doesn't solve everything, then try logging in as a different user and see if the problem persists for that user. That will tell you whether it's isolated to your account or not.

Next, try a safe-boot (hold the Command and "S" keys down after rebooting after you hear the chime). That will tell you if it's something loading early in the boot or login process that is causing this.

As @treed mentioned earlier, there is evidence of malware changing your network settings and this has become more common recently. Go through all the tabs in System Preferences->Networks, with specific attention paid to the Proxie and DNS tabs.

[alvarnell]

Sorry, I posted the wrong instructions for a "Safe-boot". Hold the Shift key down until the apple log shows up after rebooting and hear the chime.

[dberriex]

Found a fix for this issue Manny2, on a mac, Open Network Preferences, click Advanced, click on the Proxies tab, make sure all the protocols are unchecked, that fixed the internet for me.

[hannaaargh]

On 11/27/2018 at 4:28 PM, dberriex said:

Found a fix for this issue Manny2, on a mac, Open Network Preferences, click Advanced, click on the Proxies tab, make sure all the protocols are unchecked, that fixed the internet for me.

Oh man, I wish I saw this before reinstalling my MacBook. I’m still waiting for the reinstallation to complete right now, but I’m not so sure the malware will be removed. I’m definitely gonna try this out if it’s still there.

[hannaaargh]

3 hours ago, hannaaargh said:

Oh man, I wish I saw this before reinstalling my MacBook. I’m still waiting for the reinstallation to complete right now, but I’m not so sure the malware will be removed. I’m definitely gonna try this out if it’s still there.

So, unchecking all the protocols didn’t work, but now I can use Safari, Chrome and the App Store although it keeps redirecting me to the Safe Finder Yahoo! Search page. System is much laggier than before and Malwarebytes still could not detect the malware. Reinstalling the OS X over WiFi didn’t work too because of a missing font list error. Now trying to create a bootable USB drive to reinstall the OS X. I’m at my wit’s end right now.

[alvarnell]

Quote

it keeps redirecting me to the Safe Finder Yahoo! Search page.

You'll probably have to follow the steps I referenced above to "nuke Chrome" to fix this: 

Note that where it refers to ~/Library this is the current user Library which is normally hidden in recent macOS versions, and to access it you will need to hold the Option (sometimes labeled Alt) key down and select "Library" from the Finder's Go menu.

[Manny2]

I wound up just wiping the Mac clean, reinstalling MacOS, and rebooting the computer - ie. starting COMPLETELY over. Deleting all my files, pictures, passwords, settings, etc. and restarting it as though I had just opened it for the first time. I did not restore my computer to an external hard drive back up, as I assumed this would just cause the issue to be reinstalled. I spent no less than 12 hours on the phone Apple Support trying to resolve this issue in every other way possible, and spoke to 4 different senior advisors. Several senior advisors recommended that I contact them back directly if the issue persisted, but since every senior advisor gave me different advice/feedback than the last one, I thought I would keep trying to find one who could address my specific issue. The last senior advisor I spoke to ultimately agreed (or relented) that this was the only way to ensure the problem was resolved. ***GOOD NEWS (depending on how you look at it)*** - once I started the Mac completely over and only restored files that were saved to the Cloud (rather than to an external hard drive), I have not had ONE issue. Everything has been perfect and even faster than before. I know it is a huge pain in the ass to wipe the computer clean and start over, but it was MUCH more efficient than restarting the computer in recovery mode every time I did a random google search and my internet froze up. I know this is a last resort, but I thought I would pass the information along in case it is helpful. Its probably not what you want to hear, but I borderline knew this was what I needed to do from the very beginning, but wound up just wasting a ton of time (close to a full working day of my life) trying to figure it out an "easier"way.. I kept trying to resist and work around having to do this, but ultimately (at least in my situation) the "solution" was inevitable, and if wiping clean and starting over was ultimately the only solution regardless, I wish I could have at least saved the time I spent trying to find another answer. It sucks, but Its not the end of the world, and it fixed my problem. I hope this helps someone. 

[Manny2]

On 11/27/2018 at 2:28 AM, dberriex said:

Found a fix for this issue Manny2, on a mac, Open Network Preferences, click Advanced, click on the Proxies tab, make sure all the protocols are unchecked, that fixed the internet for me.

I tried this, but unfortunately, it didn't work. the same think kept happening until I wiped the computer clean and started over. 

[hannaaargh]

3 minutes ago, Manny2 said:

I wound up just wiping the Mac clean, reinstalling MacOS, and rebooting the computer - ie. starting COMPLETELY over. Deleting all my files, pictures, passwords, settings, etc. and restarting it as though I had just opened it for the first time. I did not restore my computer to an external hard drive back up, as I assumed this would just cause the issue to be reinstalled. I spent no less than 12 hours on the phone Apple Support trying to resolve this issue in every other way possible, and spoke to 4 different senior advisors. Several senior advisors recommended that I contact them back directly if the issue persisted, but since every senior advisor gave me different advice/feedback than the last one, I thought I would keep trying to find one who could address my specific issue. The last senior advisor I spoke to ultimately agreed (or relented) that this was the only way to ensure the problem was resolved. ***GOOD NEWS (depending on how you look at it)*** - once I started the Mac completely over and only restored files that were saved to the Cloud (rather than to an external hard drive), I have not had ONE issue. Everything has been perfect and even faster than before. I know it is a huge pain in the ass to wipe the computer clean and start over, but it was MUCH more efficient than restarting the computer in recovery mode every time I did a random google search and my internet froze up. I know this is a last resort, but I thought I would pass the information along in case it is helpful. Its probably not what you want to hear, but I borderline knew this was what I needed to do from the very beginning, but wound up just wasting a ton of time (close to a full working day of my life) trying to figure it out an "easier"way.. I kept trying to resist and work around having to do this, but ultimately (at least in my situation) the "solution" was inevitable, and if wiping clean and starting over was ultimately the only solution regardless, I wish I could have at least saved the time I spent trying to find another answer. It sucks, but Its not the end of the world, and it fixed my problem. I hope this helps someone. 

Thank you for replying. Yes, I wiped my MacBook clean yesterday. It took a lot of tries because there was a list font error during the second stage of the reinstallation, and apparently this was the case for many people who are trying to reinstall or update to El Capitan (yes, I’m still using El Capitan because I have an old MacBook). I didn’t have anything important in my MacBook, so wiping it clean was not a big issue for me. From now on, I’m going to check and read everything before I install any software from the Internet!

[Manny2]

IMHO, good to just go ahead and bite the bullet and get it over with. Just so other users know, I was running the most current version of Mojave at the the time my issue stared. I am running macOS Mojave 10.14.1 and was at the time these issues occurred. So the issue is happening on Mac with current OS also

[LolaS]

On 10/31/2018 at 10:39 PM, Manny2 said:

I am having the same issue. 

 

Let me start off by saying, I believe I know where this started:  About 10 days ago I clicked on an “update Adobe flash player icon” in Facebook on my Mac.  I had run out of lives in the Candy Crush iPhone app, and I wasn’t thinking clearly...I just needed to play. I am very aware of how stupid this was; cyber victim blaming will not help me now. 

 

Fast forward to 4 days ago. My computer started redirecting every search to Yahoo instead of google. Then my internet shut down. I wasn’t really sure what to make of it. I did a little trouble shooting. At the time I wasn’t paying close enough attention to the issue to remember how I got it to work again, but I did. 

 

Yesterday my browser started re-directing me to Yahoo again. I did some research online, and downloaded Malwarebytes to try and locate the issue. There were several issues identified, and I deleted them. Again, I thought the issue had resolved. 

 

Today I was again redirected to Yahoo whenever I try to search for something in Safari. I quit Safari and tried to use Chrome. Chrome it did not work either. I switched Wi-Fi networks, and still could not connect to the Internet. I then connected my computer to the personal hotspot on my phone (all of these were troubleshooting techniques I’d used previously). The same problem was there: I could not connect to the Internet from anywhere on my computer, including messages, email, and AppStore. I was able to use the Wi-Fi network on my iPhone without any issues. I called Apple support. I talked to someone on the phone for over an hour.  We thought the problem was resolved, but then about two hours later it happened again. I called Apple support a second time; I had to be transferred to an administrator. We went through some new troubleshooting options, and I thought everything was fine. 

 

About two hours after the second call, the problem got significantly worse. I am now having to shut down my computer and restart in recovery mode every 15 to 20 minutes because my computer won’t use the internet. I am no longer being redirected to Yahoo. The computer just stops doing anything that requires the Internet after a random search from the search bar. Safari says that it cannot locate the website host; it does not say I am not connected to the Internet.  I have done numerous Malwarebytes scans, and am consistently told I am “clean”. All of my requests in other apps time out as well. 

 

I have gone through 2+ hours of troubleshooting this with Apple Support, so the standard, obvious explanations have been checked and eliminated as the cause. I am going to erase my mac and start over, because I don’t know what else to do. I am mostly just posting this so others can be aware that this is a real issue. I am sure any future readers (including myself) would appreciate any info on if/how to resolve this without having to go to extremes.

.  

I have been having this exact problem - same Accidental Flash install and Safari redirecting to Yahoo. And not internet access from this computer. Trying the Proxie fix- then will try the reboot. I will try anything before wiping this clean..

[natpaige724]

On 11/1/2018 at 12:39 AM, Manny2 said:

I am having the same issue. 

 

Let me start off by saying, I believe I know where this started:  About 10 days ago I clicked on an “update Adobe flash player icon” in Facebook on my Mac.  I had run out of lives in the Candy Crush iPhone app, and I wasn’t thinking clearly...I just needed to play. I am very aware of how stupid this was; cyber victim blaming will not help me now. 

 

Fast forward to 4 days ago. My computer started redirecting every search to Yahoo instead of google. Then my internet shut down. I wasn’t really sure what to make of it. I did a little trouble shooting. At the time I wasn’t paying close enough attention to the issue to remember how I got it to work again, but I did. 

 

Yesterday my browser started re-directing me to Yahoo again. I did some research online, and downloaded Malwarebytes to try and locate the issue. There were several issues identified, and I deleted them. Again, I thought the issue had resolved. 

 

Today I was again redirected to Yahoo whenever I try to search for something in Safari. I quit Safari and tried to use Chrome. Chrome it did not work either. I switched Wi-Fi networks, and still could not connect to the Internet. I then connected my computer to the personal hotspot on my phone (all of these were troubleshooting techniques I’d used previously). The same problem was there: I could not connect to the Internet from anywhere on my computer, including messages, email, and AppStore. I was able to use the Wi-Fi network on my iPhone without any issues. I called Apple support. I talked to someone on the phone for over an hour.  We thought the problem was resolved, but then about two hours later it happened again. I called Apple support a second time; I had to be transferred to an administrator. We went through some new troubleshooting options, and I thought everything was fine. 

 

About two hours after the second call, the problem got significantly worse. I am now having to shut down my computer and restart in recovery mode every 15 to 20 minutes because my computer won’t use the internet. I am no longer being redirected to Yahoo. The computer just stops doing anything that requires the Internet after a random search from the search bar. Safari says that it cannot locate the website host; it does not say I am not connected to the Internet.  I have done numerous Malwarebytes scans, and am consistently told I am “clean”. All of my requests in other apps time out as well. 

 

I have gone through 2+ hours of troubleshooting this with Apple Support, so the standard, obvious explanations have been checked and eliminated as the cause. I am going to erase my mac and start over, because I don’t know what else to do. I am mostly just posting this so others can be aware that this is a real issue. I am sure any future readers (including myself) would appreciate any info on if/how to resolve this without having to go to extremes.

.  

I too downloaded this fake flash plugin about a week ago that appeared to have downloaded a "Name Sync" app onto my Mac. I immediately deleted it and thought that might prevent further issues. This week I started having issues with the yahoo redirect in safari and yesterday lost connectivity to the internet. I followed the instructions to uncheck proxies and found that I had a "SOCKS" proxy checked. Once unchecked, I was able to access the internet and everything seems to have gone back to normal for now...

[sg92]

This issue is unfortunately not dead.  My Mac started doing this (being unable to connect to internet on verifiably good wifi networks).  Thank God I found this thread because I was going crazy trying to figure out what the issue is.  A few things mentioned above that I can confirm: 

• I also inadvertently clicked on a fake adobe flash download banner.  This seems to be the delivery mechanism.
• This malware is definitely changing the proxy settings - SOCKS proxy was checked on mine as well.  After a lot of research yesterday I changed the proxy settings and removed the "SOCKS" proxy, and everything started working fine again.  Unfortunately, the issue re-occurred today, and the SOCKS proxy was once again checked.  

So, changing the proxy settings works, but only temporarily.  If anyone has figured out how to stop it from re-setting the proxy settings, I'd really like to hear about it.  Clearly there are many of us out there with this issue...