mit2sumit

Q: Can't open most of websites from browsers

Hi there,

 

I'm unsure what actually has happened, its all of sudden I'm restricted to open most websites from any browsing platform.

 

On Chrome, if I try to open "stackoverflow", it says:

This site can’t be reached

stackoverflow.com refused to connect.

ERR_CONNECTION_REFUSED

 

So does with Safari, it simply returns:

     Safari Can't Connect to the Server

 

However, It does load other websites like google's, apples and some other ones.

When I "ping" from terminal or boot in "safe mode", it runs perfectly there.

 

I did searched google for this issue, but none was helpful:

https://discussions.apple.com/thread/7238607?tstart=0

 

Also tried malwarebytes program to scan my mackbook, but it returned all good!

 

Please suggest where it gets broken, and what can be the fix to it.

 

I'm on Mackbook OSX EI Capitan

MacBook Air, iOS 9.2.1, null

Posted on Mar 18, 2016 12:06 AM

Close

Q: Can't open most of websites from browsers

  • All replies
  • Helpful answers

Page 1 Next
  • by thunderzzz,

    thunderzzz thunderzzz Mar 18, 2016 12:09 AM in response to mit2sumit
    Level 6 (8,379 points)
    Notebooks
    Mar 18, 2016 12:09 AM in response to mit2sumit

    Try to use other webbrowser.

    Try to reset Safari settings:

    1.Open Safari

    2. Click on Safari menu at the top(to the right from the Apple logo)

    3. Select preferences/privacy tab

    4. Click on Remove all website data

    5. Close Safari.

    Delete Safari cache files:

    1. Click on finder

    2. Look for GO menu at the top

    3. click on GO and hold down the option key. This will show user library folder.

    4. Click on Library and look for Caches folder

    5. In caches folder open com.apple.Safari folder

    6. Move to trash Cache.db file.

    This should solve the issue. If it will not help try to turn off Safari extentions

    1.Open Safari

    2. Click on Safari menu at the top(to the right from the Apple logo)

    3. Select preferences

    4. Find extentions tab

    5. Turn off all the extentions

    6. Relauch Safari


  • by mit2sumit,

    mit2sumit mit2sumit Mar 18, 2016 12:51 AM in response to thunderzzz
    Level 1 (1 points)
    Mar 18, 2016 12:51 AM in response to thunderzzz

    Thank you @thunderzzz for the prompt response

     

    In response to the solutions you provided,

    • First off, it is not the browser specific issue, that you mentioned here for Safari.
    • Moreover, I've already checked some basic steps like these, (I should have mentioned previously):
      1. Cleared cache and browser data from both chrome and safari.
      2. Checked for any malicious apps or extensions in browsers installed.
      3. Reset DNS to googles (8.8.8.8) and even set the proxies to default.
      4. Repaired Disk from the Disk Utility App on startup.

     

    None of above were helpful

     

    I'm just not in the state to reinstall my Macbook, and I needed this fixed urgently!

    Let me know, what I further need to debug with this issue.

     

    Thanks again!

  • by Linc Davis,

    Linc Davis Linc Davis Mar 18, 2016 5:51 AM in response to mit2sumit
    Level 10 (207,926 points)
    Applications
    Mar 18, 2016 5:51 AM in response to mit2sumit

    Please read this whole message before doing anything.

    This procedure is a diagnostic test. It’s unlikely to solve your problem. Don’t be disappointed when you find that nothing has changed after you complete it.

    The purpose of the test is to determine whether the problem is caused by third-party software that loads automatically at startup or login, by a peripheral device, by a font conflict, or by corruption of the file system or of certain system caches.

    Disconnect all wired peripherals except those needed for the test, and remove all aftermarket expansion cards, if applicable. Start up in safe mode and log in to the account with the problem.

    Note: If FileVault is enabled in OS X 10.9 or earlier, or if a firmware password is set, or if the startup volume is a software RAID, you can’t do this. Ask for further instructions.

    Safe mode is much slower to start up and run than normal, with limited graphics performance, and some things won’t work at all, including sound output and Wi-Fi on certain models. The next normal startup may also be somewhat slow.

    The login screen appears even if you usually login automatically. You must know your login password in order to log in. If you’ve forgotten the password, you will need to reset it before you begin.

    Test while in safe mode. Same problem?

    After testing, restart as usual (not in safe mode) and verify that you still have the problem. Post the results of the test.

  • by mit2sumit,

    mit2sumit mit2sumit Mar 18, 2016 6:55 AM in response to Linc Davis
    Level 1 (1 points)
    Mar 18, 2016 6:55 AM in response to Linc Davis

    Thank You @Linc Davis, for writing a descriptive and reasonable debugging steps.

     

    I read everything (twice) as you said, and if I'm correct, all you want me to see, if I'm having this issue in safe mode or not? Well, I've mentioned this above in the issue, that all links work fine, by making "ping" from terminal (while in normal startup), or while browsing from safe mode.

     

    Moreover, I'm facing this issue, since 30 hours now, and as I'm in middle of something, so I just can't reinstall Mac (which will take a lot of time considering my slow internet speed). And btw, since these 30 hours time, and even right now, I'm in the "safe mode" window (with screen blinking each time, due to less graphics support).

     

    Not to forget to mention, Yes, I've been checking the normal startup time-and-again to see, if the issue has been resolved, but it doesn't happen to work so. Earlier today, I even tried deleting all files from "/Library/Preferences/SystemConfiguration", (except com.apple.Boot.plist), and restarted with normal booting. It didn't worked there again!

     

    Btw, I saw you mentioned about third-party software, and this is something I'm also searching for to find and disable/remove. I searched through the /Library/Receipts/ folder for the installed plist from packages. But, all I see there is from "com.apple.pkg....".

     

    But, Yeah, I remember, I did downloaded (.pkg file and tried installing) a patch file for an antivirus program (Spyhunter) for one of my friend (running windows), and I guess, it is mostly likely the main culprit for the issue here.

     

    Then last night when the issue started, I searched through google and installed a anti-malware program to search for the bug, it scans & returns empty. (even in safe mode).

     

    After doing all basic fixes and to the level I knew, (as I'm completely new to Mac, and its my very first experience with Apple products including iPhone 6s, which I bought together in December), I had no other option than to write about the issue here in apple forum.

     

    Please let me know, if you needed any further information from me, and any debugging tests, I need to run to track and fix this issue.

    Thanks for being quick responsive, both of the time.

  • by Linc Davis,Solvedanswer

    Linc Davis Linc Davis Mar 18, 2016 6:58 AM in response to mit2sumit
    Level 10 (207,926 points)
    Applications
    Mar 18, 2016 6:58 AM in response to mit2sumit

    1. This procedure is a diagnostic test. It changes nothing, for better or worse, and therefore will not, in itself, solve the problem. But with the aid of the test results, the solution may take a few minutes, instead of hours or days.

    The test works on OS X 10.8 ("Mountain Lion") and later. I don't recommend running it on older versions of OS X. It will do no harm, but it won't do much good either.

    Don't be put off by the complexity of these instructions. The process is much less complicated than the description. You do harder tasks with the computer all the time.

    2. If you don't already have a current backup, please back up all data before doing anything else. The backup is necessary on general principle, not because of anything in the test procedure. Backup is always a must, and when you're having any kind of trouble with the computer, you may be at higher than usual risk of losing data, whether you follow these instructions or not.

    There are ways to back up a computer that isn't fully functional. Ask if you need guidance.

    3. Below are instructions to run a UNIX shell script, a type of program. As I wrote above, it changes nothing. It doesn't send or receive any data on the network. All it does is to generate a human-readable report on the state of the computer. That report goes nowhere unless you choose to share it. If you prefer, you can act on it yourself without disclosing the contents to me or anyone else.

    You should be wondering whether you can believe me, and whether it's safe to run a program at the behest of a stranger. In general, no, it's not safe and I don't encourage it.

    In this case, however, there are ways for you to decide whether the program is safe without having to trust me. First, you can read it. Unlike an application that you download and click to run, it's transparent, so anyone who understands the code can verify what it does.

    You may not be able to understand the script yourself. But variations of it have been posted on this website many times over a period of years. Any one of the millions of registered users could have read the script and raised the alarm if it was harmful. Then I would not be here now and you would not be reading this message. See, for example, this discussion.

    Nevertheless, if you can't satisfy yourself that these instructions are safe, don't follow them. Ask for other options.

    4. Here's a general summary of what you need to do, if you choose to proceed:

    ☞ Copy the text of a particular web page (not this one) to the Clipboard.

    ☞ Paste into the window of another application.

    ☞ Wait for the test to run. It usually takes a few minutes.

    ☞ Paste the results, which will have been copied automatically, back into a reply on this page.

    These are not specific instructions; just an overview. The details are in parts 7 and 8 of this comment. The sequence is: copy, paste, wait, paste again. You don't need to copy a second time.

    5. Try to test under conditions that reproduce the problem, as far as possible. For example, if the computer is intermittently slow, run the test during a slowdown.

    You may have started up in safe mode. If the system is now in safe mode and works well enough in normal mode to run the test, restart as usual before running it. If you can only test in safe mode, do that.

    6. If you have more than one user, and only one user is affected by the problem,, and the affected user is not an administrator, then please run the test twice: once while logged in as the affected user, and once as an administrator. The results may be different. The user that is created automatically on a new computer when you start it for the first time is an administrator. If you can't log in as an administrator, test as the affected user. Most personal Macs have only one user, and in that case this section doesn’t apply. Don't log in as root.

    7. Load this linked web page (on the website "Pastebin.") Press the key combination command-A to select all the text, then copy it to the Clipboard by pressing command-C.

    8. Launch the built-in Terminal application in any one of the following ways:

    ☞ Enter the first few letters of its name ("Terminal") into a Spotlight search. Select it in the results (it should be at the top.)

    ☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

    ☞ Open LaunchPad and start typing the name.

    Click anywhere in the Terminal window to activate it. Paste from the Clipboard into the window by pressing command-V, then press return. The text you pasted should vanish immediately.

    9. If you're logged in as an administrator, you'll be prompted for your login password. Nothing will be displayed when you type it. You will not see the usual dots in place of typed characters. Make sure caps lock is off. Type carefully and then press return. You may get a one-time warning to be careful. If you make three failed attempts to enter the password, the test will run anyway, but it will produce less information. If you don't know the password, or if you prefer not to enter it, just press return three times at the password prompt. Again, the script will still run.

    If the test is taking much longer than usual to run because the computer is very slow, you might be prompted for your password a second time. The authorization that you grant by entering it expires automatically after five minutes.

    If you're not logged in as an administrator, you won't be prompted for a password. The test will still run. It just won't do anything that requires administrator privileges.

    10. The test may take a few minutes to run, depending on how many files you have and the speed of the computer. A computer that's abnormally slow may take longer to run the test. While it's running, a series of lines will appear in the Terminal window like this:

        Test started
            Part 1 of 4 done at: … sec
            …
            Part 4 of 4 done at: … sec
        The test results are on the Clipboard.
        Please close this window.

    The intervals between parts won't be exactly equal, but they give a rough indication of progress.

    Wait for the final message "Please close this window" to appear—again, usually within a few minutes. If you don't see that message within about 30 minutes, the test probably won't complete in a reasonable time. In that case, press the key combination control-C or command-period to stop it. Then go to the next step. You'll have incomplete results, but still something.

    In order to get results, the test must either be allowed to complete or else manually stopped as above. If you close the Terminal window while the test is still running, the partial results won't be saved.

    11. When the test is complete, or if you stopped it manually, quit Terminal. The results will have been saved to the Clipboard automatically. They are not shown in the Terminal window. Please don't copy anything from there. All you have to do is start a reply to this comment and then paste by pressing command-V again.

    At the top of the results, there will be a line that begins with the words "Start time." If you don't see that, but instead see a mass of gibberish, you didn't wait for the "close this window" message. Please wait for it and try again.

    If any private information, such as your name or email address, appears in the results, anonymize it before posting. Usually that won't be necessary.

    12. When you post the results, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the software that runs this website. Please post the test results on Pastebin, then post a link here to the page you created.

    If you have an account on Pastebin, please don't select Private from the Paste Exposure menu on the page, because then no one but you will be able to see it.

    13. When you're done with the test, it's gone. There is nothing to uninstall or clean up.

    14. This is a public forum, and others may give you advice based on the results of the test. They speak for themselves, not for me. The test itself is harmless, but whatever else you do may not be. For others who choose to run it, I don't recommend that you post the test results on this website unless I asked you to.

    15. The linked UNIX shell script bears a notice of copyright. Readers of ASC may copy it for their own personal use. Neither the whole nor any part may be redistributed.

  • by mit2sumit,

    mit2sumit mit2sumit Mar 18, 2016 10:49 AM in response to Linc Davis
    Level 1 (1 points)
    Mar 18, 2016 10:49 AM in response to Linc Davis

    Thank you again @Linc,

    You made me speechless with your instructions. It was such a well written and convincing that no one ignores it without trying once!

     

    I've two results for you:

    Results on Safe Mode: https://docs.google.com/document/d/1mtc3B-VF0CEeJ2PhGSJZvv0mjsX9-Z6oXcbF_L3cg8g/ edit?usp=sharing

    On Normal load: https://docs.google.com/document/d/1C9uxrxqU4eZtsMes29aunBMH_DeZATKw4eRLfYAtYUY/ edit?usp=sharing

     

    Please check them and let me know, which of the files there is malicious and needs to be taken care.

    Will be waiting to hear from you, ASAP!

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Mar 19, 2016 4:00 AM in response to mit2sumit
    Level 10 (207,926 points)
    Applications
    Mar 19, 2016 4:00 AM in response to mit2sumit

    A

    You installed one or more variants of the "VSearch" trojan. Please inactivate them as follows. This procedure will leave a few small files behind, but they have no effect, and trying to remove them all would be a lot more trouble than it's worth.

    This malware has many variants. Anyone else finding this comment should not expect it to be applicable.

    Back up all data before proceeding.

    Triple-click anywhere in the line below on this page to select it:

    /Library/LaunchDaemons

    Right-click or control-click the line and select

              Services Open

    from the contextual menu.* A folder named "LaunchDaemons" should open.

    Inside that folder there are one or more items with a name that begins in one of the following ways:

              com.GalleriaUpd

              com.thoft

    Drag all such items to the Trash. You may be prompted for your administrator login password.

    Restart the computer and empty the Trash.

    B

    You also installed the "malwarebytes" product, which failed to remove the malware. I recommend that you remove it according to the developer's instructions, and never install any "anti-virus" or "anti-malware" software again. All such software is at best useless and can't be relied upon, as this experience shows. The only safety from malware attack lies in safe computing practices. Ask if you want more information.

  • by mit2sumit,

    mit2sumit mit2sumit Mar 18, 2016 10:31 PM in response to Linc Davis
    Level 1 (1 points)
    Mar 18, 2016 10:31 PM in response to Linc Davis

    This resolved my issue.

     

    I don't know how I should appreciate you for your solution, but as it is said: "Gratitude is the best Attitude", I'm really thankful to what and how you came up to solve my issue.

     

    For all other readers and to who faces such issues in future, I honestly believe that this solution can be helpful for you.

    Please try once!

     

    Thanks again @Linc Davis.

    Have a great time

  • by thomas_r.,

    thomas_r. thomas_r. Mar 19, 2016 3:34 AM in response to Linc Davis
    Level 7 (30,889 points)
    Mac OS X
    Mar 19, 2016 3:34 AM in response to Linc Davis

    Linc Davis wrote:

     

    You also installed the "malwarebytes" product, which failed to remove the malware.

     

    I would note that there are a number of entries in the log excerpts shown in those results that indicate that the system is not operating entirely correctly. Since I have examined the VSearch components shown and determined that they are already known to us and would, under normal circumstances, have been detected and removed by Malwarebytes Anti-Malware for Mac, I would guess that there is something further wrong with the system that prevented it from working properly. My advice would be to get the machine checked out by an Apple tech to identify any further sources of trouble. It would also be prudent to make sure the machine is thoroughly backed up.

     

    Thomas Reed

    Director of Mac Offerings, Malwarebytes

  • by mit2sumit,

    mit2sumit mit2sumit Mar 19, 2016 4:09 AM in response to thomas_r.
    Level 1 (1 points)
    Mar 19, 2016 4:09 AM in response to thomas_r.

    Thanks Thomas for the suggestion!

     

    • If you are saying, the malwarebytes didn't tracked the issue just because my system was not performing well on normal booting, then why has it failed to report errors while on safe mode? I run this free version in safe mode as well
    • Also, you suggested to get my machine checked out by an Apple tech; Well, I don't have any of Apple's support team nearby, and that's why, I came to this support forum

     

    I don't know the rest, but the issue has been resolved for now.

     

    Thanks all for quick response and fixes!

  • by Linc Davis,Helpful

    Linc Davis Linc Davis Mar 19, 2016 7:41 AM in response to mit2sumit
    Level 10 (207,926 points)
    Applications
    Mar 19, 2016 7:41 AM in response to mit2sumit

    There is no evidence here that anything else is wrong with the system. It doesn't need to be serviced, unless there is some other functional problem that you haven't mentioned.

  • by thomas_r.,

    thomas_r. thomas_r. Mar 20, 2016 2:50 AM in response to mit2sumit
    Level 7 (30,889 points)
    Mac OS X
    Mar 20, 2016 2:50 AM in response to mit2sumit

    Safe mode would only help if the problems were being caused by some other third-party software, which I would guess is not the case.

     

    Diagnosis by an Apple tech would be best, but if there are none near you, you could try an Apple authorized tech instead. Or you could try calling Apple and getting help over the phone, although that limits the diagnostic steps that will be possible.

  • by konouz,

    konouz konouz Mar 20, 2016 7:37 AM in response to Linc Davis
    Level 1 (0 points)
    Mar 20, 2016 7:37 AM in response to Linc Davis

    Hello there!

     

    i had the same problem since last week and i was so worried about it, and today i saw your'e solution and i was really thankful.

    Thank you so much .

     

    here's my result in normal mode:

    http://pastebin.com/wPhLHGHZ

    i hope that you can help with this

  • by Linc Davis,

    Linc Davis Linc Davis Mar 20, 2016 8:18 AM in response to Linc Davis
    Level 10 (207,926 points)
    Applications
    Mar 20, 2016 8:18 AM in response to Linc Davis

    This comment is for others who find this discussion. If the steps suggested below don't solve your problem, please start a new discussion to address it. You'll have as much chance as anyone else of getting a useful response.

    You may have installed one or more variants of the "VSearch" ad-injection malware. Please back up all data, then take the steps below to inactivate it.

    Don't use any kind of "anti-virus" or "anti-malware" product on a Mac. There is never a need for it, and relying on it for protection makes you more vulnerable to attack, not less.

    Malware is always changing to get around the defenses against it. This procedure works as of now, as far as I know. It may not work in the future. Anyone finding this comment a few days or more after it was posted should look for a more recent discussion, or start a new one.

    The VSearch malware tries to hide itself by varying the names of the files it installs. To remove it, you must first identify the naming pattern.

    1. Triple-click the line below on this page to select it, then copy the text to the Clipboard by pressing the key combination  command-C:

    /Library/LaunchDaemons

    In the Finder, select

              Go Go to Folder...

    from the menu bar and paste into the box that opens by pressing command-V. You may not see what you pasted because a line break is included. Press return.

    A folder named "LaunchDaemons" may open. If it does, press the key combination command-2 to select list view, if it's not already selected.

    There should be a column in the Finder window headed Date Modified. Click that heading twice to sort the contents by date with the newest at the top. Please don't skip this step. Files that belong to an instance of VSearch will have the same modification time to within about one minute, so they will be clustered together when you sort the folder this way, making them easy to identify.

    Look inside the folder for files with a name of any of these forms:

              com.something.daemon.plist

              com.something.helper.plist

              com.something.net-preferences.plist

    Here something is a meaningless, random string of characters, which can be different in each instance of VSearch. So far it has always been an alphanumeric string without punctuation, such as "disbalance" or "thunderbearer."

    You could have more than one copy of the malware, with different values of something.

    There may also be one or more files with a name of this form:

               com.somethingelseUpd.plist

    where somethingelse may be a different meaningless string than something. Again, there may be more than one such file, with different values of somethingelse.

    Here's a typical example of a VSearch infection:

              com.disbalance.net-preferences.plist

              com.thunderbearerUpd.plist

    You will have files with names similar, but probably not identical, to these.

    If you feel confident that you've identified the above files, drag just those files—nothing else—to the Trash. You may be prompted for your administrator login password. Close the Finder window.

    2. Open this folder as in Step 1:

    /Library/LaunchAgents

    Move to the Trash any files with a name of the form

              com.something.agent.plist

    where something is one of the strings you found in Step 1. There may not be any such files.

    3. If you moved anything to the Trash in Step 1 and/or Step 2, restart the computer and empty the Trash.

    Don't delete the "LaunchAgents" or "LaunchDaemons" folder, or anything else inside either one, unless you know you have some other kind of unwanted software besides VSearch. The folders are a normal part of OS X. The terms "agent' and "daemon" refer to a program that starts automatically. That's not inherently bad, but the mechanism is sometimes exploited by malware attackers.

    4. Reset the home page in each of your browsers, if it was changed. In Safari, first load the home page you want, then select

              Safari Preferences... General

    and click

              Set to Current Page

    The malware is now permanently inactivated, as long as you never reinstall it. A few small files will be left behind, but they have no effect, and trying to find them all is more trouble than it's worth.

    5. If you didn't find the files or you're not sure about the identification, post what you found.

    If in doubt, or if you have no backups, change nothing at all.

    6. The trouble may have started when you downloaded and ran an application called "MPlayerX." That's the name of a legitimate free movie player, but the name is also used fraudulently to distribute VSearch. If there is an item with that name in the Applications folder, delete it. I don't recommend that you install the genuine "MPlayerX," because it's hosted on the rogue "SourceForge" website and is bundled with other malware.

    This trojan is often found on illegal websites that traffic in pirated content such as movies. If you, or anyone else who uses the computer, visit such sites and follow prompts to install software, you can expect more of the same, and worse, to follow. Never install any software that you downloaded from a bittorrent, or that was downloaded by someone else from an unknown source.

    In the Security & Privacy pane of System Preferences, select the General tab. The radio button marked Anywhere  should not be selected. If it is, click the lock icon to unlock the settings, then select one of the other buttons. After that, don't ignore a warning that you are about to run or install an application from an unknown developer.

    Then, still in System Preferences, open the App Store or Software Update pane and check the box marked

              Install system data files and security updates (OS X 10.10 or later)

    or

              Download updates automatically (OS X 10.9 or earlier)

    if it's not already checked.

Page 1 Next