Internet works in safe mode only

In general, when something only works in Safe Mode that means a third-party app is running in Normal Mode that is causing a problem. It doesn't have to be in log in items. The first culprits would be antivirus, VPN or firewall apps. It could be something else.

Download and run Etrecheck. Etrecheck is a diagnostic tool that was developed by one of the most respected users here in the ASC and recommended by Apple Support  to provide a snapshot of the system and help identify the more obvious culprits that can adversely affect a Mac's performance.

Copy the report

and use the Add Text button to include the report in your reply. How to use the Add Text Feature When Posting Large Amounts of Text, i.e. an Etrecheck Report

IMPORTANT:

Before running Etrecheck assign Full Disk Access to Etrecheck in the app's Privacy preference pane so that it can get additional information from the Console and log files for the report:

ALSO IMPORTANT:

Then we can examine the report and see if we can determine the root of the problem.

tanay97 wrote:

I installed Malwarebytes yesterday and scanned it but no malware detected.

That's unfortunate.

What steps to follow?

Proxies---- Yes 8 of them.

I wrote a little diagnostic program to help show what malware is installed. Download EtreCheckPro from https://www.etrecheck.com and run it. Create a new reply and use the "Notes" tool below to add your EtreCheck report. Using the link above, you can download EtreCheck from the Mac App Store or download EtreCheckPro directly. The Mac App Store version has not yet been updated, so download EtreCheckPro instead. All of EtreCheck's security and malware removal features are available for free.

If malware is installed, EtreCheck will help you remove it, although you may have to supply a password. If you aren’t comfortable with that, just post the EtreCheck report here and other helpers can tell you exactly what files need to be deleted and how to do so.

Disclaimer: EtreCheckPro is my own app. EtreCheckPro is free to use but has in-app purchases available. Downloading EtreCheckPro or using it could give me some form of compensation, financial or otherwise.

Dancin' Brook wrote:

I’d caution about using software being promoted here. If it were available from the App Store at least it would be scanned by Apple. I’m not saying it is bad but promoting an app here after being the only person suggesting malware seems a bit off, and perhaps even against forum guidelines.

EtreCheck is on the App Store. Here is the direct link: https://itunes.apple.com/app/etrecheck/id1423715984?ls=1&mt=12

But I just released an update yesterday. And since everyone at Apple is working from home, it may be some time before the update arrives in the store. One of the bug fixes in these new builds is to report these proxies as a major issue. Additionally, the Mac App Store version runs in the Mac App Store sandbox. One of the biggest impacts on this is with adware and malware removal. Sometimes it can still remove adware and malware, but sometimes I can only provide buttons to access the relevant files in the Finder, from whence the user can drag them to the trash. Alas, in some cases, this it NOT sufficient to remove adware and malware. EtreCheckPro doesn't have those Mac App Store limitations, so it can more easily remove adware and malware.

To be honest, this does sound like the malware proxy issue. It is becoming more and more popular. Normally, when I suspect malware is involved, I will post a link to Malwarebytes myself. I thoroughly despise adware and malware and don't want to deal with it. But it is a significant problem, so EtreCheck does what it can to help the user detect and remove it. I only suggested EtreCheck because the OP had already tried Malwarebytes and it didn't work.

And in any case, EtreCheck won't do any harm. I would be happy to provide any additional information or evidence. But I would ask that you start a new question or e-mail directly to avoid side-tracking the OP's problem.

And speaking of forum guidelines, since I included that link, I need another disclaimer...

Disclaimer: EtreCheck is my own app. EtreCheck is free to use but has in-app purchases available. Downloading EtreCheck or using it could give me some form of compensation, financial or otherwise.

Dancin' Brook wrote:

I've never have I had a problem solved by running Malware checkers. But someday maybe... I can also tell you never has Apple told me to run a Malware checker as a step in solving a problem, but then, one never knows.

EtreCheck is not a “malware checker”. As I mentioned above, I only added adware and malware checking because it became a serious issue and was one that EtreCheck was uniquely positioned to help solve. You can still find people who try to help with this without EtreCheck. Sometimes they recommend Malwarebytes (as I do!) but sometimes they try to talk the user through taking screenshots of various hidden directories and then telling them which files they need to delete. EtreCheck is designed to make this kind of debugging and diagnostics easier on an online forum like this one.

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

In fact, my participation in this forum has gone to virtually zero. It just so happens that it is the weekend and the world is shutdown for some reason.

I still doubt it's malware

If you have some other explanation for 8 proxies on a normal user’s machine, I’m sure we would all like to hear it. This is a very common behaviour of malware. (Normally I’m not one lump all adware into the “malware” bucket. But when something installs proxies to siphon off all internet traffic, I think that’s a little extreme to just call it “adware”.)

your software will no doubt find something wrong, and will probably ask you to pay for some of the reports.

EtreCheck reports are free. Any adware or malware removal features are free too.

EtreCheck might very well find something wrong. The hope is that the OP will post their (free) report here in the forums (for free) and get (free) advice from people who have being doing this for years.

Sure enough...but first, very interesting:

Before posting your EtreCheck report publicly, please remember: 

EtreCheck is frequently recommended on internet discussion forums [by who?] such as Apple Support Communities. Apple Support Communities, although hosted by Apple, Inc. is a public internet discussion forum like any other. The people providing technical support on Apple Support Communities are usually not Apple, Inc. employees. They are other Apple, Inc. customers like yourself.

People who post here in the forums can do so anonymously if they want. I never have, and I’ve regretted that on many occasions. Apple has developed a system where people can judge the trustworthiness of someone’s replies using a reputation system.

And here are some of the results:

"There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system." [And, so? That is always true, by default.1. ]

No. This is a new development that was just announced last year at Apple’s WWDC developer conference. Apple’s current design is based on a “gatekeeper”. This allows a signed installer or disk image to install unsigned software. Once you make it past the “gate”, you can do what you want. Apple is going to increase the level of security to require all software to have digital signatures. EtreCheck has been reporting unsigned software as suspicious for a few years now. I’m happy that Apple has finally gotten on board too.

This machine has kernel extensions that may not work in the future." [You don't need to run an app to know or report that. Every kernel extension will "not work in the future."1. ]

Most users of EtreCheck have no idea what kernel extensions are, or what software they have installed. This new warning is design to help people avoid a repeat of the 32-bit deprecation in Catalina. We have already started to see this new behaviour in 10.15.4.

It's possible, even likely, that Internet communications have been affected by an unprecedented amount of activity at times that weren't so affected before. You may be experiencing a manifestation of that. Peak activity periods have shifted. There hasn't been any overwhelming increase (data consumption is on the order of 10% greater than a year ago), but when it doesn't work... it doesn't work. You're not likely to get any warning signs.

It's also possible, quite certain in fact, that bad guys seeking to exploit others now have a lot of idle time on their hands. The usual phishing and related social exploits that existed since the dawn of civilization have increased in popularity. Additional exploits are certain to arise. So, even though it's unrelated to your present difficulties it's a good time to review your defenses.

"Basic Connectivity Failure" is what it says. The other "Review..." entry is always present.

Given the fact that you don't have the problem in "Safe Mode" EtreCheck is likely to provide additional information that you can act upon. Be sure to run it in normal mode (not "Safe Mode").

---

It's unfortunate this Discussion became derailed but that happens from time to time. It's wise to question people's motivation for recommending this or that product, but everyone's been above board in that regard. That is not always the case. There aren't any bad guys here, just a bit of information asymmetry that will vanish in the light of knowledge.

If you have reason to believe this Discussion has become distracted to the point it is no longer helpful to you though, just start another. No one will mind.

tanay97 wrote:

Whoever spread mess here with their so many levels and points and none could help me in solving MY issue on MY post....

I’m glad you got the problem sorted out. But I’m sorry your thread got hijacked like this. Normally this takes 5 minutes to resolve, not 2 days.

Here is the link to the answer.

I don’t recommend that people go digging around in hidden directories looking for files that might be adware. Most people are unable to distinguish adware and malware from legitimate software. I’ve seen people have to reinstall software, and sometimes even the operating system itself, after doing that. That’s the whole point of this forum - to get help from experts who the difference.

Here are a couple of other links that could have been...

socks proxy macOS localhost 8080 not unch… - Apple Community

SOCKS Proxy settings on Mac - Apple Community

If new is using, supporting and working on Apple products since before 1984, (i.e. Apple IIs), I'll take the compliment for being a newbie. Yes, I did and do tech support, and I've never have I had a problem solved by running Malware checkers. But someday maybe... I can also tell you never has Apple told me to run a Malware checker as a step in solving a problem, but then, one never knows.

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

I still doubt it's malware, but your software will no doubt find something wrong, and will probably ask you to pay for some of the reports. Let's try it and see:

Sure enough...but first, very interesting:

Before posting your EtreCheck report publicly, please remember: 

EtreCheck is frequently recommended on internet discussion forums [by who?] such as Apple Support Communities. Apple Support Communities, although hosted by Apple, Inc. is a public internet discussion forum like any other. The people providing technical support on Apple Support Communities are usually not Apple, Inc. employees. They are other Apple, Inc. customers like yourself.

And here are some of the results:

1. "There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system." [And, so? That is always true, by default.]
2. "This machine has kernel extensions that may not work in the future." [You don't need to run an app to know or report that. Every kernel extension will "not work in the future."]
3. Yep, runs 9 actual reports, some offer little to no useful information, and you have to pay for 5 of the 9. Not including the redundant summaries at the beginning and end.
4. Enough?

Never heard of EtreCheck. Glad to hear it's in the App Store though. That's at least safer. No malware found BTW. I'm tempted to do a clean system install and find out how many scary things will be reported.

It still feels like self-promotion here; "free" to get and run a report that will no doubt try to scare you into buying. Regardless, your app doesn't make the list on any of these 4 sites (first 4 I selected with a search) so you surely must be doing something right? Maybe be a bit more objective if you are going to help:

• MacWorld: Best antivirus for Mac: Get the best protection from viruses and malware
• TeschRadar: Best Mac antivirus software of 2020
• PC Mag: The Best Mac Antivirus Protection for 2020
• MacWorld UK: The best Mac antivirus of 2020

Alright. Now at the moment, what else steps I should follow to troubleshoot it except installing the OS again?

Installing the OS again will not remove any third-party system mods that are causing the problem. You must remove them yourself.

It sounds like malware. There has been a big spike recently due to everyone being home. Check your network settings while not in safe mode. Go to System Preferences > Network > Advanced > Proxies. Do you have a bunch of proxies? If so, that’s malware. You will need to remove the malware and then remove the proxies.

I’d caution about using software being promoted here. If it were available from the App Store at least it would be scanned by Apple. I’m not saying it is bad but promoting an app here after being the only person suggesting malware seems a bit off, and perhaps even against forum guidelines.

Dancin' Brook wrote:

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

Perhaps with your experience you could reply to the correct person. I am not the author of EtreCheck.