Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

Jul 2, 2019 4:35 PM in response to Reuben_Hood

Skanson, you are a GENIUS!! Thank you very much. I'm a neophyte but I followed your directions and it worked. THANK YOU!

BDAqua

Level 10

250,253 points

Sep 3, 2019 12:52 PM in response to jlnwallis

Thanks. :)

Sep 29, 2019 5:30 AM in response to alkra1

not work on me

Oct 12, 2019 9:22 AM in response to jlnwallis

After trying so many of these, this is the one that finally got rid of it!! Thank you so much!!

jretana

Level 1

4 points

Nov 19, 2019 4:33 PM in response to Skanson

I don't understand what the "terminal" application is, I don't know see a search function???

BDAqua

Level 10

250,253 points

Nov 19, 2019 5:54 PM in response to jretana

Terminal is in Applications>Utilities.

Search function?

Oct 28, 2018 9:58 AM in response to Reuben_Hood

I've done as instructed and still no luck. Here is what is displayed after each line was copied and pasted:

Steves-MBP:~ stevehayko$ defaults write com.google.Chrome HomepageIsNewTabPage -bool false

Steves-MBP:~ stevehayko$ defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

Steves-MBP:~ stevehayko$ defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

Steves-MBP:~ stevehayko$ defaults delete com.google.Chrome DefaultSearchProviderSearchURL

2018-10-28 09:54:58.921 defaults[7694:440908]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Steves-MBP:~ stevehayko$ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

2018-10-28 09:55:08.057 defaults[7695:441072]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Steves-MBP:~ stevehayko$ defaults delete com.google.Chrome DefaultSearchProviderName

2018-10-28 09:55:15.569 defaults[7696:441253]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Steves-MBP:~ stevehayko$

tayronas

Level 1

4 points

Oct 31, 2018 7:15 AM in response to Skanson

Hello Skanson and guys.

Thank you very much for your help.

Unfortunately, I have not been able to get rid of this malware. I have tried several things and I think I deleted partially that crap, but I still see it is on Chrome. I tried to follow Skanson's advice but I did not work. I think the problem is that English is not my native language so I think I did no understand how I have to proceed. If you have any idea to help me, I'd appreciate it very much.

Thank you, guys !

Tayronas

joemc33

Level 1

9 points

Oct 31, 2018 4:41 PM in response to Skanson

Thanks so much for this solution. Spent an hour with McAfee without results. Got Safari cleaned up myself, but none of the on-line advice, including running Malwarebytes, fixed Chrome. Your Policy restoration commands did the trick!!

joemc33

Level 1

9 points

Oct 31, 2018 5:51 PM in response to tayronas

See post from robmaine above (Oct 24) and some posts that follow that one for more explicit step by step info. Copy and paste each entire line, including the blue links. I entered them one at a time at the Terminal black command entry box that appears after my user name, hitting return after each, but that may not be necessary.

Bojstrup

Level 1

4 points

Nov 17, 2018 10:36 PM in response to ChanelCinq

Thanks so much! So happy it works and that you further explained what needed to be done. Spent time with Apple Support staff today who didn't know how to fix this. And spent many hours afterwards, trying to find another solution than backing up my old MacBook to an external harddrive and then reinstalling everything, as the Apple Support person suggested. Which would have been quite cumbersome since I need to use an older version of Safari to get the Java plug-in to work with my electronic timesheet for work (PC world).

Tusind tak! A thousand thanks, as we say it in Danish.

Bojstrup

Level 1

4 points

Nov 17, 2018 10:52 PM in response to Skanson

Thanks for your wonderful help in getting rid of this stubborn bogus Chrome. I'm so glad I found the link and your solution to the problem with my old MacBook.

Tusind tak! A thousand thanks, as we say in Danish.

Drc1969

Level 1

4 points

Nov 18, 2018 9:08 PM in response to Skanson

I fell for the adobe flash needs updating scam and received the weknow.ac virus. I have spent a couple of hours trying to eliminate it by various means but the only that that fully works is to copy/paste your policies above into the terminal. I appreciate so much that you took the time to post the fix. I also downloaded malwarebytes and ran it.

joemc33

Level 1

9 points

Nov 20, 2018 10:30 AM in response to Drc1969

Thanks,

It is disturbing that Apple techs don’t bother to keep up with these inputs from the user community. I guess they built that huge fortress of a facility to isolate themselves from the real world.

Joemc

Nov 25, 2018 5:43 PM in response to Skanson

THANK YOU! After searching for a while this is the only thing that worked for me. Don't download any unnecessary malware programs people....

this works.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Remove "weknow.ac" Malware in Chrome?