If you were unaware you can do local DNS resolution by modifying
/etc/hosts this file looks something like:
So, this can be done for many legitimate reasons, as a local DNS lookup may be more favourable. Do realise that the localhost (127.0.0.1) is a loopback address; it is accessible via your machine only. A localhost lookup could be favourable if you were doing web server testing locally before deployment and hence needed privacy.
Mentioning your hostname changed from
user@MacBookAir ~ to
user@DESKTOP-GD4U33R ~ implies an application with root privileges made this change (I speak more about this below). Issue
cat /etc/hostname will allow you to view your hostname. You can change your hostname either by editing
/etc/hostname or in Settings > Network Utility. By default modern, Microsoft Windows machines use the hostname @DESKTOP-XXXXXXX where X is a random base-36 string of upper case letters and numeric characters. Just a suggestion for the possible naming convention, as it's quite specific, but as for your hostname becoming
DESKTOP-GD4U33R and having a DNS resolution to
DESKTOP-GD4U33R via 192.168.1.2 does seem quite unusual.
This is good news as the IP address resolves to your local network. Consequently, this potential threat is isolated. As mentioned identify who 192.168.1.2 is before proceeding further. But, I would suggest, presuming you are the network administrator or are authorised, using NMap to identify open ports on this machine;
nmap -Pn -A 192.168.1.2 will suffice. This device can absolutely be an egress port on your machine, from terminal use
ifconfig | grep 192.168.1.2 you can identify if this IP address is one of the machine's network interfaces.
ClamAV offers a macOS antivirus, but locally this looks more like an application modified
/etc/hosts. It could also be worthwhile ensuring both files are read-only
ls -l /etc/hostname; ls -l /etc/hosts should return something like:
-rw-r--r-- root root /etc/hosts
-rw-r--r-- root root /etc/hostname
Notice that only the root user (not group) should have write access.