4

Trying to open a http website on any web browser (event telnet) gives a ‘ERR_CONNECTION_REFUSED’ or ‘connection timed out’.

However, the same sites can be opened using https. I tried doing a traceroute and it works fine.

I am new to OS X but have experience with Linux. How do I go about troubleshooting this issue?

Update

I think I've tracked down the culprit to a rule in pf (firewall).

The result of sudo pfctl -s nat is:

No ALTQ support in kernel
ALTQ related functions disabled
rdr pass inet proto tcp from 192.168.0.101 to any port = 80 -> 127.0.0.1 port 9882

192.168.0.101 is the current ip address of the computer.

I tried to remove the rule with sudo pfctl -F all, but it is back after a few seconds. I didn't find the rule in the default configurations (/etc/pf.conf). And disabling pf with sudo pfctl -d has no effect on it.

Is this a malware issue?

  • Have you configured a proxy? Check if you set anything. What browser you're using? – dante12 Jun 4 '16 at 15:52
  • Error message looks like from Google chrome. @OP dis you try incognito mode or any other browser ? – pun Jun 4 '16 at 18:59
  • I tracked down the issue to a rule in pf. pfctl shows a rdr rule that maps all requests from the computer to port 80 to another port in localhost itself. I think this is the culprit. I have tried to remove the rule but so far have not been able to do so. Even when I do a pfctl -F all, it is back after a few seconds. Is this a malware issue? – squgeim Jun 5 '16 at 17:03
  • The reference to port 9882 looks like a Pirrit-malware infection symptom, see objective-see.com/blog/blog_0x0E.html – janv8000 Jun 14 '16 at 13:48
  • 3
2

You are probably victim of an adware: OSX/Pirrit. Please read the linked analysis.

To remove the adware save the following shell script as remove-adware.sh (e.g. on your Desktop) and execute it as root:

echo "*** Osx.Pirit Removal script, Amit Serper, @0xamit ***"
echo "*** BEFORE YOU RUN THIS SCRIPT, STOP! I CAN'T TAKE ANY RESPONSIBILITY ON ANY DAMAGES HAPPENING TO YOUR MACHINE. YOU ARE THE MASTER OF YOUR OWN FATE"
echo "*** Before running this script check that you are indeed infected with osx.pirrit. TERMINATE THIS SCRIPT BY HITTING CTRL+C AND RUNNING THE FOLLOWING COMMAND:"
echo "$ dscl . -list /Users UniqueID | grep 401"
echo "If this command has an output then continue running this script. Else DONT"
echo "Press any key to continue running this script, remember - I am not responsible for any unfortunate outcomes"
read

echo "[*] Getting net_pref name"
netPrefFileName=$(sudo defaults read /Library/Preferences/com.common.plist net_pref)

echo "[*] Netperf name is:"
echo $netPrefFileName

echo "[*] Getting appname from com.common.plist"
appName=$(sudo defaults read /Library/Preferences/com.common.plist name)
echo $appName

echo "[*] Stopping and removing LaunchDaemon"
sudo launchctl unload -w "/Library/LaunchDaemons/"$netPrefFileName
sudo killall $appName

sudo rm "/Library/LaunchDaemons/"$netPrefFileName

echo "[*] Removing injector"
sudo rm -r "/Library/"$appName
echo "[*] Removing malicious pf configs made by Pirrit"
sudo rm /etc/change_net_settings.sh

sudo pfctl -evf /etc/pf.conf

servicePrefFileName=$(sudo defaults read /Library/Preferences/com.common.plist service_pref)
echo “[*] Net pref file name:”
echo $netPrefFileName

appName=$(sudo defaults read /Library/Preferences/com.common.plist name)
echo “[*] App name is:”
echo $appName

echo “[*] Removing LaunchDaemon”
sudo launchctl unload -w "/Library/LaunchDaemons/"$servicePrefFileName
echo [*] Killing app and osascript”
sudo killall $appName
sudo killall osascript

echo “[*] Cleaning up…”
sudo rm "/Library/LaunchDaemons/"$servicePrefFileName

sudo rm -r "/Library/"$appName

echo “[*] Removing pirrit launching script”
sudo rm /etc/run_app.sh

echo “Script finished”

Make it executable:

chmod +x ~/Desktop/remove-adware.sh

change your working directory:

cd ~/Desktop

and execute it. Read the intro of the script thoroughly (especially the advice to run dscl . -list /Users UniqueID | grep 401 before continuing:

sudo ./remove-adware.sh

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .