A system, a method, and computer-readable media are provided for altering behavior of software based on detection of an Internet connection. The system, method, and media detect when a computer has connected to the Internet or is capable of connecting to the Internet. This detection may include analyzing a connection history of the computer to the Internet, reporting in real-time when the computer establishes a connection to the Internet, or attempting to actively establish a connection with an Internet resource using the computer. A first set of software functionality may be disabled when a previously established connection with the Internet is identified, a real-time report of a connection with the Internet is generated, or a connection with the Internet resource is established. In addition, a second set of software functionality may be enabled when the first set of software functionality is disabled.