Totoab57 wrote:1)where do I find the Host file?
2) what are the commands to locate that file?
1) /private/etc/hosts
2) Open Terminal and type
cd /private/etc/ and press Return, then
ls and Return will show you a file called "hosts" in that directory, with no file extension
Totoab57 wrote:3 )Should I start with making a copy of the current Host file and save it to my desktop before messing with that file? Do I need to back-up my computer as it is suggested?
It's called a "hosts file" because its filename ends with an s; anyway, it's probably easier to copy that file to your desktop, work on that copy, then move it back to its original location, overwriting the original hosts file (you will need the admin password at some point, no matter how you edit the hosts file). You probably don't need to backup your computer for this operation, but it's standard advice before changing any part of a computer's configuration.
The original support post was about someone who had intentionally made changes to the hosts file other than resetting it to default; you don't need to make a backup of your malware-tampered hosts file.
Also, that post recommended TextWrangler because unlike with TextEdit, you
know you'll be editing in plaintext. (TextEdit is similar to WordPad for Windows: It usually makes rich text files, and it
can make plain text files, but you need to change a particular setting to do that. Old Macs came with a dedicated text editor called SimpleText that was like Notepad, but Macs released in the past decade don't have that, but at least TextWrangler is free and well renowned in the Mac community.)
Totoab57 wrote:4)If I copy and paste these "lines", am I creating a new Host file, ie., without saving the old one? Am I updating the current file? How does that take care of the malware or why is that maneuver recommended?
They're literal lines of text, not the type of "lines" that are really something else but only euphemistically or simplistically referred to as lines; anyway, you are indeed overwriting the hosts file, so that none of the hosts file you started with remains. It takes care of the effects of the malware by removing some of the incorrect mappings between domains and IP addresses that the malware likely put in the hosts file.
Totoab57 wrote:5) If you say that the redirecting to hsrd.yahoo.com is not the hijacker but just a symptom of the hijacker, which i understnd, I have read in many blogs that the MalwareBytes has not been able to detect and remove that malware. So, do I need to find an effective anti-malware , i.e., to take care of the removal of that malware doing the redirecting, as a first step, before doing the copy/paste of those lines? Do you have a suggestion about that kind of anti-malware? I ran already McAfee Security suite and it found nothing! ? False negative?
Maybe you already got rid of the hijacker by other means, or whatever program did the hijacking wasn't persistent; I don't have good knowledge of the full range of anti-malware software but I've heard good things about the free Sophos Anti-Virus for Mac. Regardless, one thing you could try is editing the hosts file to a clean state, waiting a while, then seeing whether the hosts file still looks clean.
Totoab57 wrote:6) I am quite "green" and I do not understand what "hard-code mappings between domains and IP addresses" means? What are the risk of my trying to modify or reset the Host file in light of my lack of knowledge?
I am grateful for your help. Totoab57
It means to set up, in a way that does not automatically change, the IP address that your computer will try to connect to when you try to go to a particular domain. Domain names are useful because humans can remember them, but computers need the IP addresses to actually make connections. In the old days, this was managed with a file called HOSTS.TXT that was kept on a particular server and downloaded to each of the few computers that were on the Internet in the 1970s. Later on, a system called the Domain Name System (DNS) was made so that the management of domain names could be more scalable, and now computers make requests to DNS servers when they want to find the IP addresses behind domain names (that is, "resolving" them); these mappings are usually held for a while in what is known as a DNS cache, but still, at some point, the mappings will change without any settings changing on your computer. The hosts file lives on for legacy reasons, and mappings inside that file will only change if you or some program on your computer changes them; that is, they are hard-coded.
With that said, there is no risk to resetting your hosts file to the default; if you had any special reason to set up domain-to-IP mappings in that file, you would have remembered them, and everything else the hosts file once did is now done by DNS.