Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

BDAqua

Level 10

251,585 points

May 11, 2019 6:38 AM in response to adil145

See if this helps...

https://macreports.com/how-to-remove-weknow-ac-malware-macos/

May 26, 2019 11:31 AM in response to steve5454

Had good luck with this...

https://support.google.com/chrome/thread/1985871?hl=en

Reuben_Hood Author

Level 1

54 points

Aug 15, 2018 7:41 AM in response to macjack

Thanks for the suggestion, but I already ran Malwarebytes, as my original query mentioned. It pronounced my iMac "clean." Just tried it again, same result. The bug still exists, at least within the Chrome app. (Safari still appears to be bug-free, which is how I'm writing this entry.) Still seeking solution.

Reuben_Hood Author

Level 1

54 points

Aug 15, 2018 9:43 AM in response to macjack

Did not see any "second link." I was introduced to Malwarebytes while on the phone with Apple Support, and they walked me through the download and scan. I still have the Malwarebytes app, but don't see any reference to "manual uninstall directions ... for Google Chrome." It does sound promising, though. I'd welcome further advice.

Aug 17, 2018 11:17 AM in response to macjack

None of that works. Each of these "step-by-step" guides gives me a rundown of installing antivirus, I have installed 4! different ones that each have done absolutely nothing. I have followed manual delete, still here. scans find nothing. Nothing finds anything.

Every help chat on this gives me asinine help that does nothing

Sep 1, 2018 7:37 AM in response to culvercitymacuser

I just followed this steps, and after opening Chrome got the same old SEARCH screen. Has anyone had any luck with cleaners other than malwarebytes.com? I have had the same experience of 2 Apple reps saying they were no longer able to help, that this was a Chrome problem. Safari and Firefox are clean now, thanks to a nice Apple rep yesterday named Duane.

Kurt Lang

Level 9

72,539 points

Sep 3, 2018 3:10 PM in response to dhumble

Ah! Gotcha'.

Yes, there are tons of sites out there like that. You can type in any malware name you want to remove, and there are dozens, or hundreds of links that send you to sites to "fix" the problem. Almost all of which want you to download some no-name app to do the work for you. Some are blatant sales pitches for some of the worst utilities you could ever put on your Mac. Can't tell you how many I've seen that encourage the user to download MacKeeper.

crow74

Level 1

22 points

Sep 5, 2018 5:38 AM in response to riccaliolio

Which step did you take to fix the problem? (Malwarebytes?) I rebooted my machine after installing that and I was still completely hijacked in chrome and firefox (search engine options disabled).

For the record, I have wiped everything and set my mac back to factory defaults so I am bugfree but am interested in community eradication or at least a workable solution. I sent support at weknow.ac an email telling them they are evil and am receiving responses that "would indicate" that they think users can just disable it. They sent the link https://www.bugsfighter.com/remove-weknow-ac-mac/ which I had come across but no one is going to be psyched with downloading anything after this experience (i.e., CleanMyMac3 or Appcleaner). Interesting/baffling that they even responded 😕.

Skanson

Level 1

19 points

Sep 20, 2018 8:04 AM in response to alkra1

You need to open the "Terminal" application (use the search functionality at the top-right to find it). Then copy and paste, one by one, the commands from my above post into the terminal prompt, hitting enter after pasting each.

Reuben_Hood Author

Level 1

54 points

Sep 24, 2018 10:38 AM in response to Skanson

Thank you Thank you Thank you! The fix turned out to be so simple — but only if you are familiar enough with the Command line to think of it in the first place! I have to say that all the comments about Google's looney-goosey code security system for third-party add-on features is kind of shocking, and has made me to decide to return to Safari as my default browser — at least for now. But it's still nice to know that I can use Chrome if I need to without fear of this nefarious little malware minion running around inside my browser. Thanks again, Skanson —

Sep 25, 2018 2:42 PM in response to Skanson

😍😍😍😍😍 THANK YOU SO MUCH!!!!!! After many calls with level 2 techs over 2 weeks my mom was getting nowhere. This did it. I helped her look all over the internet for fixes but all of the directions did not pertain. weknow.ac didn't exist anywhere and probably because Apple had already removed bits and pieces but not the actual virus.

You are a lifesaver Skanson. Now this info needs to get out there so everyone else can fix their system. It's really too bad the level 2 Apple techs don't know this. Hopefully someone at Apple is reading this and will have the Apple techs do this now.

Thanks again!!!!!!

Oct 5, 2018 8:31 AM in response to Skanson

This did not work. These were my results:

Last login: Fri Oct
5 10:28:33 on ttys000

Davids-MBP:~ david$ defaults write com.google.Chrome HomepageIsNewTabPage -bool false

Davids-MBP:~ david$

Davids-MBP:~ david$ defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

Davids-MBP:~ david$

Davids-MBP:~ david$ defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

Davids-MBP:~ david$

Davids-MBP:~ david$ defaults delete com.google.Chrome DefaultSearchProviderSearchURL

2018-10-05 10:29:33.631 defaults[607:51951]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Davids-MBP:~ david$

Davids-MBP:~ david$ defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

2018-10-05 10:29:33.663 defaults[608:51956]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Davids-MBP:~ david$

Davids-MBP:~ david$ defaults delete com.google.Chrome DefaultSearchProviderName

2018-10-05 10:29:33.696 defaults[609:51960]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Most notably, as it says in highlight,

"Domain (com.google.Chrome) not found.

Defaults have not been changed."

Oct 8, 2018 10:09 PM in response to Reuben_Hood

Not that it's any of my business which browser you choose to use, I am sure you are well aware of how Google love's to track everything you do online. Also, the ad blocker add on blocks everything except Google related objects. I've recently discovered a browser that is giving Chrome a run for it's money and is extremely good at weeding out adware. It is called Brave. As an added bonus, a good alternative to the Google Search engine is DuckDuckGo.

Oct 12, 2018 12:08 AM in response to Skanson

Skanson, you are a genius!!! Thanks. It took me a while but it's so easy once i figure it out. For those whose having this issue, basically go to your utilities from the application, find terminal and copy and paste skanson whole defaults blahhh... to your terminal. press enter and done!! AWesome Skanson

ttfarley

Level 1

4 points

Oct 13, 2018 9:01 PM in response to speed_racer15

Thank you so very much!!!! Sad to know that people continue to put viruses out there, but still good to know there are people like you that share their knowledge to help total strangers. I can't thank you enough. Spent hours today trying to figure this out!

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Remove "weknow.ac" Malware in Chrome?