Q: Safari 5.1 suddenly cannot connect to server when accessing Google?

Linc Davis wrote:

 

That's a link to the forum index. I can't find the thread.

Sorry 'bout that, try https://discussions.apple.com/message/15964691#15964691

I'm not sure the OP in that thread would realize that you can't send attachments to Mailinator. It would have to be a link to the page from which he downloaded the trojan (if that's what he did.)

Linc Davis wrote:

 

I'm not sure the OP in that thread would realize that you can't send attachments to Mailinator. It would have to be a link to the page from which he downloaded the trojan (if that's what he did.)

Yes, you are correct.  I had forgotten about that.

He has already provided the link and it's the same IP as they used for the fake Google page which hasn't been heard from since the day it first appeared.  So probably the only way we are going to find that thing is to get it from somebody who downloaded it that day.  And the only places I know that will accept it are VirusTotal and clamav.

Let me know if you have any better ideas.

This helps but I'm a bit stuck...Im new to the Mac world. I did everything and I get this

Last login: Sat Aug 20 17:10:00 on ttys000

Denisse-Moores-MacBook-Pro:~ juztgoogleme$ $cd /private/etc

-bash: /private/etc: is a directory

Denisse-Moores-MacBook-Pro:~ juztgoogleme$ $sudo vim hosts

~                                                                              

~                                                                              

"hosts" [New File]

I'm on the admin account. And I get Im suppose to use Text edit but for what? Can someone please help me. I'm super lost and I need this to work since my school email is on GMail. I've already deleted the flashplayer file. I can put the IP address for google but nothing else will go after that.

WILL HIGHLY APPRECIATE IT!!!

DMoore84 wrote:

 

This helps but I'm a bit stuck...Im new to the Mac world. I did everything and I get this

 

 

Last login: Sat Aug 20 17:10:00 on ttys000

Denisse-Moores-MacBook-Pro:~ juztgoogleme$ $cd /private/etc

You need another slash after etc...just copy and paste this:

cd /private/etc/

but I still think you would have an easier time using TextEdit

And I get Im suppose to use Text edit but for what?

To edit the file instead of using the Terminal "vim" editor.  Which ever you are most comfortable with.

Got it because this popped up:

##

# Host Database

#

# localhost is used to configure the loopback interface

# when the system is booting.  Do not change this entry.

##

127.0.0.1       localhost

255.255.255.255 broadcasthost

::1             localhost

fe80::1%lo0     localhost

91.224.160.26 google.com

91.224.160.26 google.co.uk

91.224.160.26 google.com.au

91.224.160.26 google.ca

91.224.160.26 google.us

91.224.160.26 www.google.com

91.224.160.26 www.google.co.uk

91.224.160.26 www.google.com.au

91.224.160.26 www.google.ca

91.224.160.26 www.google.us

~                                                                              

~                                                                              

"hosts" [readonly] 21L, 513C

Next mission is how to remove it....At times I think when I bought a Mac, I complicated my life even more.

What's complicating your life is that fact that you entered your administrator password when prompted by a trojan. If you do things like that, you're never going to be safe on any kind of computer.

I would not recommend that you use vim or any other command-line editor for this purpose. By far the easiest option is to restore the hosts file from a Time Machine backup made before the file was changed.

If you don't have that option, open the hosts file in TextEdit. You won't be able to save the changes directly. Instead, save to a file in your home folder; e.g., on the Desktop. Then use the shell to copy the saved file back to the original, like this:

sudo cat Desktop/hosts > /etc/hosts

Denisse-Moores-MacBook-Pro:~ juztgoogleme$ $cd /private/etc

-bash: /private/etc: is a directory

Your mistake was typing the $ sign. Please don't try to type shell commands when you have no idea what they mean. Copy or drag the command from your browser window into the Terminal window.

I get that I really don't know what I'm doing too much but Im trying to follow the instructions that are given (i.e. you guys help and the site about Manually deleting it). I really appreciate the help!

Linc Davis wrote:

 

open the hosts file in TextEdit. You won't be able to save the changes directly. Instead, save to a file in your home folder; e.g., on the Desktop. Then use the shell to copy the saved file back to the original, like this:

 

sudo cat Desktop/hosts > /etc/hosts

Why do I get "-bash: /etc/hosts: Permission denied" without it even asking for my password when I try this?

-rw-r--r--   1 root      wheel        214 Aug 20 16:38 hosts

Also there is the possibility the file will be saved as hosts.txt if the box in the save dialog is checked.

Why do I get "-bash: /etc/hosts: Permission denied" without it even asking for my password when I try this?

Because I made a mistake. It should be:

sudo sh -c ' cat Desktop/hosts > /etc/hosts '

Also there is the possibility the file will be saved as hosts.txt if the box in the save dialog is checked.

sudo sh -c ' cat Desktop/hosts.txt > /etc/hosts '

I deleted the Safari plist, and now Safari is working again!

Thanks for the technical advice.

-- Mac Addict 4 Life ....

Everything worked! Thanks....but now when I go back to google it gave me the test page for the Apache Server...lol! Now I'm lost!

Then the hosts file is still wrong. Please post what you have now.

lol! Double crap...just when I thought I had it.