I recently discovered a virus the consequences of which were that NIS appeared to run perfectly but in fact was far from it.
The result was that the firewall was inoperative. One could even change the setting to "Block all network traffic" and no traffic was being blocked whatsoever.
I can only suggest that if there is a hint of infection you might just test "Block all network traffic" and ensure that you cannot still get to say google.com.
Not too helpful, some might say, but it is only an advice.
Clive Goldman