Can't use google. Little help please

Please review the options below to determine which method is best to remove the Adware installed on your computer.

The Easy, safe, effective method:

http://www.adwaremedic.com/index.php

If you are comfortable doing manual file removals use the somewhat more difficult method:

http://support.apple.com/en-us/HT203987

Also read the articles below to be more prepared for the next time there is an issue on your computer.

https://discussions.apple.com/docs/DOC-7471

https://discussions.apple.com/docs/DOC-8071

http://www.thesafemac.com/tech-support-scam-pop-ups/

This sounds like it may be an issue with a bad or hacked DNS server or a piece of hacked network hardware. See:

http://www.adwaremedic.com/kb/baddns.php

http://www.adwaremedic.com/kb/hackedrouter.php

(Fair disclosure: I may receive compensation from links to my sites, TheSafeMac.com and AdwareMedic.com.)

If none of that info proves fruitful, use AdwareMedic to take a system snapshot (choose Take System Snapshot from the Scanner menu) and then submit it to me at The Safe Mac (there will be a button for that).

Yes, typically the internet provider has their own DNS servers, and those are the servers you are most likely using. It is possible that your provider's servers have been compromised, in which case the instructions at the first link I gave you should help solve the problem.

It's also possible that your router was hacked to point it to a DNS server that is no longer controlled by your ISP. I this is your own router, then you will need to reset it and prevent it from being controlled from the WAN (Internet) side. If it still uses the default UserID/Password that came from the factory, it will need to be changed. There may also be a firmware update to prevent other issues. If you rent the router from your ISP then they will probably have to take care of all that.

I accessed the site referenced and it tried to download a small text file, which I rejected. I had VirusTotal analyze the site and it was clean but the download was detected by one scanner as a Trojan.

To see what DNS you are actually using, open System Preferences->Network and with your "Connected" method highlighted click the "Advanced..." button and choose the DNS tab. Tell us what is says under DNS Servers: and if the font is black or gray. Same with Search Domains:.

Ajushi wrote:

Yeah in fact in System Preferences->Network the DNS and server are in grey.

And....

I asked that you to tell us what is says....

Ajushi wrote:

Based on the the advise here it seems my modem has been hacked. I plugged in the ethernet cord and the Ip address was still grey. In fact the ip address was not even my own.

It should be gray. That means it's being supplied by your modem and it will never be you ip address.

44.0.0.252 belongs to the University of California in San Diego. It does not appear to be a DNS server. openvpn is a strange entry. Have you spoken with your ISP?

Ownership of the 44.0.0.252 address is murky. Some things online say it's owned by the University of California in San Diego. Others say it's owned by Amateur Radio Digital Communications, located near Wichita, Kansas. Another source says it belongs to spotflux.com, which is a VPN service.

Since your screenshot shows "openvpn" in the Search Domains box, I'm guessing that the latter may be correct, and you may be using Spotflux VPN to connect to the internet. I've seen a few concerns raised about Spotflux; those concerns could amount to nothing more than some false positives on the part of a small number of anti-virus engines, or there could be some real issues with Spotflux that are not widely recognized. It's also possible Spotflux is legit, but has been hacked, as a Sucuri site scan identified some concerns with outdated and vulnerable server software being used on their site. I would recommend temporarily disabling, or even uninstalling, Spotflux. Test for a while without and see if the problem is gone. If it is gone, Spotflux was the cause of the problem.