Internet works in safe mode only

I don't use either but one or the other probably still have components installed that could be causing the problem. You need to uninstall them according to the developers instructions then test.

I’d caution about using software being promoted here. If it were available from the App Store at least it would be scanned by Apple. I’m not saying it is bad but promoting an app here after being the only person suggesting malware seems a bit off, and perhaps even against forum guidelines.

If new is using, supporting and working on Apple products since before 1984, (i.e. Apple IIs), I'll take the compliment for being a newbie. Yes, I did and do tech support, and I've never have I had a problem solved by running Malware checkers. But someday maybe... I can also tell you never has Apple told me to run a Malware checker as a step in solving a problem, but then, one never knows.

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

I still doubt it's malware, but your software will no doubt find something wrong, and will probably ask you to pay for some of the reports. Let's try it and see:

Sure enough...but first, very interesting:

Before posting your EtreCheck report publicly, please remember: 

EtreCheck is frequently recommended on internet discussion forums [by who?] such as Apple Support Communities. Apple Support Communities, although hosted by Apple, Inc. is a public internet discussion forum like any other. The people providing technical support on Apple Support Communities are usually not Apple, Inc. employees. They are other Apple, Inc. customers like yourself.

And here are some of the results:

1. "There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system." [And, so? That is always true, by default.]
2. "This machine has kernel extensions that may not work in the future." [You don't need to run an app to know or report that. Every kernel extension will "not work in the future."]
3. Yep, runs 9 actual reports, some offer little to no useful information, and you have to pay for 5 of the 9. Not including the redundant summaries at the beginning and end.
4. Enough?

Never heard of EtreCheck. Glad to hear it's in the App Store though. That's at least safer. No malware found BTW. I'm tempted to do a clean system install and find out how many scary things will be reported.

It still feels like self-promotion here; "free" to get and run a report that will no doubt try to scare you into buying. Regardless, your app doesn't make the list on any of these 4 sites (first 4 I selected with a search) so you surely must be doing something right? Maybe be a bit more objective if you are going to help:

• MacWorld: Best antivirus for Mac: Get the best protection from viruses and malware
• TeschRadar: Best Mac antivirus software of 2020
• PC Mag: The Best Mac Antivirus Protection for 2020
• MacWorld UK: The best Mac antivirus of 2020

Dancin' Brook wrote:

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

Perhaps with your experience you could reply to the correct person. I am not the author of EtreCheck.

Dancin' Brook wrote:

I've never have I had a problem solved by running Malware checkers. But someday maybe... I can also tell you never has Apple told me to run a Malware checker as a step in solving a problem, but then, one never knows.

EtreCheck is not a “malware checker”. As I mentioned above, I only added adware and malware checking because it became a serious issue and was one that EtreCheck was uniquely positioned to help solve. You can still find people who try to help with this without EtreCheck. Sometimes they recommend Malwarebytes (as I do!) but sometimes they try to talk the user through taking screenshots of various hidden directories and then telling them which files they need to delete. EtreCheck is designed to make this kind of debugging and diagnostics easier on an online forum like this one.

Do you sit back and look for opportunities here to sell your software? You had nothing to offer except the scary "It sounds like malware." followed shortly by a "I wrote a little diagnostic program..." Hmmm?

In fact, my participation in this forum has gone to virtually zero. It just so happens that it is the weekend and the world is shutdown for some reason.

I still doubt it's malware

If you have some other explanation for 8 proxies on a normal user’s machine, I’m sure we would all like to hear it. This is a very common behaviour of malware. (Normally I’m not one lump all adware into the “malware” bucket. But when something installs proxies to siphon off all internet traffic, I think that’s a little extreme to just call it “adware”.)

your software will no doubt find something wrong, and will probably ask you to pay for some of the reports.

EtreCheck reports are free. Any adware or malware removal features are free too.

EtreCheck might very well find something wrong. The hope is that the OP will post their (free) report here in the forums (for free) and get (free) advice from people who have being doing this for years.

Sure enough...but first, very interesting:

Before posting your EtreCheck report publicly, please remember: 

EtreCheck is frequently recommended on internet discussion forums [by who?] such as Apple Support Communities. Apple Support Communities, although hosted by Apple, Inc. is a public internet discussion forum like any other. The people providing technical support on Apple Support Communities are usually not Apple, Inc. employees. They are other Apple, Inc. customers like yourself.

People who post here in the forums can do so anonymously if they want. I never have, and I’ve regretted that on many occasions. Apple has developed a system where people can judge the trustworthiness of someone’s replies using a reputation system.

And here are some of the results:

"There are unsigned software files installed. Apple has said that unsigned software will not run by default in a future version of the operating system." [And, so? That is always true, by default.1. ]

No. This is a new development that was just announced last year at Apple’s WWDC developer conference. Apple’s current design is based on a “gatekeeper”. This allows a signed installer or disk image to install unsigned software. Once you make it past the “gate”, you can do what you want. Apple is going to increase the level of security to require all software to have digital signatures. EtreCheck has been reporting unsigned software as suspicious for a few years now. I’m happy that Apple has finally gotten on board too.

This machine has kernel extensions that may not work in the future." [You don't need to run an app to know or report that. Every kernel extension will "not work in the future."1. ]

Most users of EtreCheck have no idea what kernel extensions are, or what software they have installed. This new warning is design to help people avoid a repeat of the 32-bit deprecation in Catalina. We have already started to see this new behaviour in 10.15.4.

You see? You made me go over the 5000 character limit...

Dancin' Brook wrote:

. Yep, runs 9 actual reports, some offer little to no useful information, and you have to pay for 5 of the 9. Not including the redundant summaries at the beginning and end.

No. There is only one report. You are looking at the pages of the user interface. The “redundant summary” at the end is the text report that would be posted here in the forums. This report is designed to produce a one-page summary of everything that a helper here in the forums might want to know about an OP’s machine.

The “start here” page, major issue page, minor issues pages, and the security page are all free. An earlier version of EtreCheck used colours in the text report to convey issues and had embedded link in the HTML content for removing adware. People misinterpreted those colours and didn’t recognize the links. The new interface is a significant improvement for these free features.

Those other 5 pages are part of the Power User package that is available as an in-app purchase. I discovered that people weren’t using EtreCheck only here in the forums. They were just running it on their own to better understand what was going on inside their machines. So I developed an enhanced user interface with significantly more supporting information, links to more information from Apple and other sources, and some pretty eye candy. EtreCheckPro has some additional features like a storage display and a one-of-a-kind analytics display.

It still feels like self-promotion here;

Obviously it is. I want the OP to use the app to get rid of that malware because Malwarebytes couldn’t do it. I specifically asked you to start your own new question about EtreCheck or to contact me directly with your questions. You are the one who chose to turn the OP’s question into an advertisement for EtreCheck, not me.

Regardless, your app doesn't make the list on any of these 4 sites (first 4 I selected with a search) so you surely must be doing something right? Maybe be a bit more objective if you are going to help:

Yes! Exactly! As I mentioned before (twice now), EtreCheck is not an antivirus tool. It is a tool to help people with diagnostics and debugging here in the forums. Adware and malware have become a serious issue, so EtreCheck provides adware and malware detection and removal features for free. But EtreCheck is most definitely not an antivirus tool and you will not find a single person in the “security industry” who says it is. I can absolutely guarantee that. What’s the difference, you ask? Well, that’s a topic that I’m not going to discuss while someone else is having all of their data uploaded to the internet.

tanay97 wrote:

Whoever spread mess here with their so many levels and points and none could help me in solving MY issue on MY post....

I’m glad you got the problem sorted out. But I’m sorry your thread got hijacked like this. Normally this takes 5 minutes to resolve, not 2 days.

Here is the link to the answer.

I don’t recommend that people go digging around in hidden directories looking for files that might be adware. Most people are unable to distinguish adware and malware from legitimate software. I’ve seen people have to reinstall software, and sometimes even the operating system itself, after doing that. That’s the whole point of this forum - to get help from experts who the difference.

Here are a couple of other links that could have been...

socks proxy macOS localhost 8080 not unch… - Apple Community

SOCKS Proxy settings on Mac - Apple Community

You're welcome. Post back with the result.