Currently Being ModeratedJan 16, 2012 6:01 PM (in response to valeriefromvirginia beach)
Please launch the Network Utility application by entering the first few letters of its name in a Spotlight search. Select the "Lookup" tab and enter "www.google.com" (without the quotes) in the address field. Press return. Post the output -- the text, please, not a screenshot. Then select the "Ping" tab and do the same.
Currently Being ModeratedJan 16, 2012 7:47 PM (in response to Linc Davis)
here's the text from the lookup tab:
Lookup has started…
; <<>> DiG 9.6-ESV-R4-P3 <<>> www.google.com +multiline +nocomments +nocmd +noquestion +nostats +search
;; global options: +cmd
www.google.com. 344666 IN CNAME www.l.google.com.
www.l.google.com. 246 IN A 220.127.116.11
www.l.google.com. 246 IN A 18.104.22.168
www.l.google.com. 246 IN A 22.214.171.124
www.l.google.com. 246 IN A 126.96.36.199
www.l.google.com. 246 IN A 188.8.131.52
www.l.google.com. 246 IN A 184.108.40.206
Here's the response from the ping tab:
Ping has started…
PING www.l.google.com (220.127.116.11): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
Request timeout for icmp_seq 7
Request timeout for icmp_seq 8
--- www.l.google.com ping statistics ---
10 packets transmitted, 0 packets received, 100.0% packet loss
Currently Being ModeratedJan 16, 2012 8:02 PM (in response to valeriefromvirginia beach)
It looks like something or someone has modified your /etc/hosts file.
By far the easiest way to fix the hosts file is to restore it from a Time Machine (or other) backup that predates the modification. If that's not possible, then do the following.
Back up all data if you haven’t already done so. Before proceeding, you must be sure you can restore your system to the state it’s in now. If you skip this step, no one but you will be responsible for the consequences.
These instructions must be carried out in an administrator account, if you have more than one user account.
Select "Go to Folder..." from the Finder menu bar. In the text box, enter "/etc" (without the quotes.) A Finder window will open on the "etc" folder.
Double-click the file named "hosts" in that folder. It should open in TextEdit. At the top of the file, you should see something like this:
# Host Database
# localhost is used to configure the loopback interface
# when the system is booting. Do not change this entry.
Below that, you'll see some other lines. Delete everything below the last line shown above. Make sure you scroll all the way to the bottom of the document. In Lion, scroll bars are hidden by default until you actually start scrolling, so you may not realize that you’re not seeing the whole document.
Don’t try to save; you won't be able to. Instead, duplicate (in Lion) or select "Save As..." from the file menu (pre-Lion.) In the Save dialog, make the name of the file “hosts” and deselect the option to add a ".txt" extension to the file name, if it's selected. Save the file to your Desktop. You should now have a file named exactly "hosts" with no extension on your Desktop, having the contents shown above.
Now launch the Terminal application, for instance by entering the first few letters of its name in a Spotlight search. Copy or drag -- do not type -- the line of text below into the window, and press return:
sudo sh -c ' cat Desktop/hosts > /etc/hosts '
You'll be prompted for your login password, which won't be displayed when you type it. You may get a one-time warning not to screw up. Confirm. Quit Terminal.
Do not type anything into the Terminal window except your password.
That will fix your hosts file. You can now close the “etc” folder and delete the hosts file on your Desktop. Unless you know how the file was modified, I can’t guarantee that no other damage has been done to your system.
Currently Being ModeratedJan 16, 2012 8:12 PM (in response to Linc Davis)
Thanks again. This sounds serious- I will do the restore from Carbonite tomorrow as that looks easiest. Should I be concerned enough to do it right now or can it wait? Is there cumulative damage if I don't restore right now?
I just don't know exactly when this started happening today, and I'd hate to lose my documents or mail from since this started. I'll e-mail the most important documents to another computer . . .
Do you think this is contagious? Wonder how it happened, don't want it to happen again. I did try to get to Comcast.com today to look up jobs and got a warning page. I didn't proceed but did go in through a search engine directly to their career site rather than in the "front door." Wonder if that was it.
Thanks so much for your help.
Currently Being ModeratedJan 16, 2012 8:40 PM (in response to valeriefromvirginia beach)
There was a trojan going around recently that did something similar, but it redirected Google searches to a server controlled by the attacker. In your case, Google is being redirected to an Apple server, so I doubt this was caused by malware. Does anyone else have physical access to your computer?