Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

jakepriv

Level 1

4 points

Oct 15, 2018 11:02 AM in response to Skanson

Hi. Thanks for your help, but I'm having a problem where on the last three, it says "Defaults Have Not Been Changed" I have little experience with terminal and I'm so frustrated and tired of this virus. I'm not sure how to fix this. I've tried copying/pasting all at once, or doing one at a time (either in the box, or after clicking "New Command"

any help would be so appreciated.

Oct 21, 2018 3:19 PM in response to Skanson

To paste in the commands I chose "New Command" under the Shell menu at the top in the Terminal App. Repeated for each command. Did the trick!!! I did restart my laptop to see the results. And yes, my default homepage is blank too. That needs to be reset. What an evil hijacker! Thank you Skanson!

Oct 22, 2018 11:45 AM in response to allisonkrier

okay so i went to applications, then terminal, then shell menu, then new command. I copied and pasted each individual code, closed out of chrome after copying and pasting in terminal and reopened it and I am still having the same issue.

Oct 22, 2018 12:04 PM in response to allisonkrier

Also when i paste the command in it has said

2018-10-22 15:03:19.079 defaults[650:11207]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

[Process completed]

I am not understanding what I could be doing wrong

kgsburg

Level 1

4 points

Oct 23, 2018 2:33 PM in response to Skanson

Skanson,

After an entire day of nothing working, this did! However, when I restarted my computer, if I go to the chrome://policy page, it still shows my policies being messed up like they were before. Any idea why Chrome opens up fine after modifying the policies (via command line), but the policy page didn't change? I'm wondering if I'm still being "tracked."

Thanks again, for your post!

Reuben_Hood Author

Level 1

54 points

Oct 25, 2018 9:37 AM in response to nwatson2

Depends on where you're searching FROM. If you open a new Finder window and look for the search window in the top right of that window, you'll see a list of every item on your hard drive in any way related to the term "Terminal." Among these will be the "black box" icon below, which was mentioned by romaine on Oct 2. Double-click that icon, and the Terminal window opens, where you can type the commands themselves. Then check the results. Hope this simplifies it for you.

tayronas

Level 1

4 points

Oct 31, 2018 7:15 AM in response to Skanson

Hello Skanson and guys.

Thank you very much for your help.

Unfortunately, I have not been able to get rid of this malware. I have tried several things and I think I deleted partially that crap, but I still see it is on Chrome. I tried to follow Skanson's advice but I did not work. I think the problem is that English is not my native language so I think I did no understand how I have to proceed. If you have any idea to help me, I'd appreciate it very much.

Thank you, guys !

Tayronas

joemc33

Level 1

9 points

Oct 31, 2018 4:41 PM in response to Skanson

Thanks so much for this solution. Spent an hour with McAfee without results. Got Safari cleaned up myself, but none of the on-line advice, including running Malwarebytes, fixed Chrome. Your Policy restoration commands did the trick!!

Bojstrup

Level 1

4 points

Nov 17, 2018 10:36 PM in response to ChanelCinq

Thanks so much! So happy it works and that you further explained what needed to be done. Spent time with Apple Support staff today who didn't know how to fix this. And spent many hours afterwards, trying to find another solution than backing up my old MacBook to an external harddrive and then reinstalling everything, as the Apple Support person suggested. Which would have been quite cumbersome since I need to use an older version of Safari to get the Java plug-in to work with my electronic timesheet for work (PC world).

Tusind tak! A thousand thanks, as we say it in Danish.

Bojstrup

Level 1

4 points

Nov 17, 2018 10:52 PM in response to Skanson

Thanks for your wonderful help in getting rid of this stubborn bogus Chrome. I'm so glad I found the link and your solution to the problem with my old MacBook.

Tusind tak! A thousand thanks, as we say in Danish.

Drc1969

Level 1

4 points

Nov 18, 2018 9:08 PM in response to Skanson

I fell for the adobe flash needs updating scam and received the weknow.ac virus. I have spent a couple of hours trying to eliminate it by various means but the only that that fully works is to copy/paste your policies above into the terminal. I appreciate so much that you took the time to post the fix. I also downloaded malwarebytes and ran it.

Nov 18, 2018 9:51 PM in response to Reuben_Hood

Hi! I'm having the same issue with weknow.ac in chrome and safari. I tried do your suggestion of the terminal and this is what happend. The malware is still there and I'm having trouble finding a solution. any suggestions ?

joemc33

Level 1

9 points

Nov 20, 2018 10:30 AM in response to Drc1969

Thanks,

It is disturbing that Apple techs don’t bother to keep up with these inputs from the user community. I guess they built that huge fortress of a facility to isolate themselves from the real world.

Joemc

Nov 27, 2018 3:36 PM in response to Skanson

Aha!! This worked for me after doing a zillion other things to delete that piece of caca "weknow.ac" I still had a browser screen showing up with the fake icon images of AliBaba, Facebook, Google, et.al with a doctored "search" engine field box. Once I copied the lines, pasted into terminal, entered each one separately THEN rebooted my Mac, reopened Chrome and Voila! that pesky screen was gone for good!

By the way, did anyone else start getting phone calls on your mobile from a Chinese recording?

Dec 3, 2018 6:10 PM in response to Skanson

Sorry, but where should I copy these new policy names? Once I've found it in the search engine inside chrome://policy/, if I click on the link in blue, it opens a page with a lot of technical info, but no place to copy it...

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Remove "weknow.ac" Malware in Chrome?