Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

BDAqua

Level 10

251,329 points

Jun 5, 2019 10:01 PM in response to HeathenJeff

Quit Chrome, move this file to the trash & restart in Safe Mode...

/Users/YourUserName/Library/Preferences/com.google.Chrome.plist

Might need to Trash this folder also...

/Users/YourUserName/Library/Saved Application State/com.google.Chrome.savedState

ttfarley

Level 1

4 points

Oct 13, 2018 9:03 PM in response to speed_racer15

Oh - P.S. it worked. Just follow the instructions from speed_racer15's October 13, 2018 5:34 post

Sep 13, 2018 3:37 AM in response to crow74

Sorry for the late response! I just followed what culvercitymacuser posted. I would suggest running the Malwarebytes first to fix the basics and then follow the steps from culvercitymacuser to fix Chrome.

alkra1

Level 1

13 points

Sep 20, 2018 7:29 AM in response to Skanson

Thanks for this response....can you please explain how to use the command line to delete / modify the affected policies? I can see that my policies are affected as described..

Applies to	Level	Source	Policy name	Policy Value	Status
Current user	Recommended	Platform	DefaultSearchProviderEnabled	true	OK
Current user	Recommended	Platform	DefaultSearchProviderName	WeKnow	OK
Current user	Recommended	Platform	DefaultSearchProviderNewTabURL	Show value	OK
Current user	Recommended	Platform	DefaultSearchProviderSearchURL	Show value	OK
Current user	Recommended	Platform	HomepageIsNewTabPage	true	OK
Current user	Recommended	Platform	HomepageLocation	Show value	OK
Current user	Recommended	Platform	NewTabPageLocation	Show value	OK

not sure what to do once i get to the page chrome://policy/

thanks!!!

Sep 27, 2018 5:10 PM in response to kelli265

Kelli there is no search in Terminal. You just simply enter the following info in the box and hit enter:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

I copy and pasted one line at a time and hit enter before going to the next one. But I think you can paste the whole thing and then hit enter. But that's it. 🙂

soozeef

Level 1

4 points

Oct 7, 2018 9:11 AM in response to Reuben_Hood

I followed @skanson's advice and pasted the 6 lines of code into my terminal and I finally got rid of weknow in Chrome!

I reset my sync settings in Chrome first, and then deleted it altogether before pasting the code into terminal. When I reinstalled Chrome, my search engine is now google again! Thanks all and good luck.

Oct 22, 2018 12:15 PM in response to caitlynfromcolonia

Closing just Chrome probably won’t entirely do it. You will need to restart you computer for it to take affect. Also, did you enter each command individually; you should have a window that pops up after each entry that states it’s completion, can’t remember the wording.

joemc33

Level 1

9 points

Oct 31, 2018 5:51 PM in response to tayronas

See post from robmaine above (Oct 24) and some posts that follow that one for more explicit step by step info. Copy and paste each entire line, including the blue links. I entered them one at a time at the Terminal black command entry box that appears after my user name, hitting return after each, but that may not be necessary.

May 7, 2019 8:45 AM in response to WhyDee706

To change your homepage in Google Chrome, open your Chrome browser and click on the menu icon represented by three lines on the top right corner of the screen next to the Web address input field. Choose "Settings" from the drop-down options. In the "Settings" screen, check the box labeled "Show Home button".

May 7, 2019 8:48 AM in response to Muhsin7

macjack

Level 10

111,302 points

Aug 15, 2018 8:38 AM in response to Reuben_Hood

Did you try the manual uninstall directions in the second link for Google Chrome?

Sep 22, 2018 9:01 PM in response to Skanson

THANK YOU SOOOOOOO MUCH!!!! it worked- 3 days of trying to crack it. Bless u!!

Oct 17, 2018 10:44 PM in response to simwharton

In addition to get Goggle home page to look normal again follow instructions from: Slartibartfastthethird posted on Oct. 1, 2018 at 1:24pm.

BDAqua

Level 10

251,329 points

Nov 18, 2018 11:24 PM in response to rawanfromgloucester

See if you even have that file...

/Users/YourUserName/Library/Preferences/com.google.Chrome.plist

ctts13

Level 1

12 points

Jan 23, 2019 11:58 AM in response to cmcostel71

On your MAC, on the top right, next to the date and time area, you'll see a "search" circle, click on that, and type "Terminal".

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Remove "weknow.ac" Malware in Chrome?