You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Reuben_Hood Author

Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

Dec 3, 2018 11:24 AM in response to Skanson

Hi! I have pasted each one of the commands from your post in the terminal prompt and the first work fine but when I paste the last 3 and hit enter I get this message:

Domain (com.google.Chrome) not found.

Defaults have not been changed.

Is there anything I can do for this to remove this malware? Thank you!

Dec 3, 2018 6:10 PM in response to Skanson

Sorry, but where should I copy these new policy names? Once I've found it in the search engine inside chrome://policy/, if I click on the link in blue, it opens a page with a lot of technical info, but no place to copy it...

Dec 4, 2018 7:43 PM in response to carola1984

The following code line wise need to be copied and pasted in "Terminal" app available in your launch pad.

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

You have to copy each and every line and then hit enter.

Everything worked out well after that, but, I like to have "New Tab Page" with recents and favourites being displayed, which is now displaying www.google.com when I hit the "+" to add new page. Except that every thing is good.

Appreciate if Skason can explain us how to get default New Tab Page in Chrome instead of www.google.com

hctrees

Level 1

8 points

Dec 16, 2018 12:04 PM in response to Skanson

THANK YOU! Apple support walked me through deleting WeKnow from Safari but after some tries, they could not get rid of it from Chrome. They gave me a Google number to call but unsurprisingly, I couldn't get through. Luckily I found your instructions and you've solved the problem!! Thank you.

Mpilalis

Level 1

4 points

Dec 18, 2018 6:03 PM in response to Reuben_Hood

Skanson... you are a genius!!!! THANK YOU! I was on the phone twice (two different people) with apple customer support and they couldn't fix it. Going into terminal, copy and pasting exactly what he posted, hitting enter in between each one, then hitting control AND the letter "O" at the same time saved the work in terminal and got rid of the WeKnow.ac browser.

can200

Level 1

4 points

Dec 19, 2018 6:02 PM in response to thomas_r.

"For Safari, there are a variety of techniques being used to change the settings. One is to add a bookmark and change Safari's settings to load "tabs for" that bookmark item at startup. This is easy to miss, since the homepage entry can be left untouched, making it appear that something is still installed if you're not observing carefully."

Please expound on this, I don't follow.

I deleted chrom and reinstalled. Weknow.ac still there.

Thanks1

Hudoo

Level 1

4 points

Dec 20, 2018 12:18 PM in response to Skanson

for whatever reason the defaults delete instructions failed as not found - any thoughts?

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

2018-12-20 15:15:03.547 defaults[1268:13178]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

ca55idy

Level 1

4 points

Dec 29, 2018 1:04 PM in response to can200

I deleted Chrome MANY times. But what you have to do is go to Terminal app on your laptop (go to Spotlight search) and then copy and paste these lines.

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Restart Chrome. Works a treat!! I've had this problem for months to the point I just gave up using Chrome.

Jan 6, 2019 7:46 PM in response to saylah

Just dealt with this for an hour or two. I feel like an idiot but I found that there is a zipped uninstaller available directly from the weknow people. From their search page, click on the FAQ icon at the bottom left. Scroll down and bingo. Took about a minute and a half and cleaned everything right up.

Jan 13, 2019 3:32 PM in response to Skanson

This is only thing that worked and is really simple. Just copy the full sentence over 6 times and hit enter each time. I tried everything else posted, called Geek quad two times and they removed and it reappeared, removed Goolge twice, then tried this and it worked. Wasted a day. Do this first.

Jan 15, 2019 9:42 PM in response to Reuben_Hood

Skanson!!!! You are the best!!

Thank you so much for the terminal commands, they worked PERFECTLY on any MacBook Air. I have uninstalled and re-installed Chrome what feels like a million times, deleted tons of "suspicious" files and folders, etc etc and nothing worked until I got the terminal instructions from you. THANK YOU SO MUCH!!!

dmelinn

Level 1

4 points

Jan 16, 2019 7:43 PM in response to Reuben_Hood

if using terminal doesn't work for you. The problem is that now We Know Ac is set as an Admin for your MAC directly affecting your terminal and if you input something there, it will not work as We Know Ac blocks it. So:

1. Go to your system preferences (the settings of our MAC), and look for a profiles icon.

2. Click on there (since in a default mac that shouldn't be there).

3. Remove all of the Admin blocks found.

4. And boom, you have a chrome free of malware.

This video & comment section ultimately saved me https://www.youtube.com/watch?v=C0xRhWCX2Is&vl=en

dnolimal

Level 1

4 points

Jan 19, 2019 6:30 PM in response to Skanson

Hi I'm still so confused I need help in the most layman explanation: I am opening terminal then entering the lines in your above post as follows, for example: "defaults write com.google.Chrome HomepageIsNewTabPage -bool false" What am i supposed to do next? Is that what you're saying to enter?

Jan 22, 2019 1:53 PM in response to Skanson

Can you please explain further how to do this step?

"You need to open the "Terminal" application (use the search functionality at the top-right to find it). Then copy and paste, one by one, the commands from my above post into the terminal prompt, hitting enter after pasting each."

I can't seem to get there....

Jan 30, 2019 2:51 AM in response to Reuben_Hood

Spent hours on this - this helped immediately. Not sure if some of the other stuff I did also helped, but doing this (deleting virus profiles) helped instantly. Still needed to go back and resent homepages, but now all good - YAY!!! Doesn't involve downloading anything extra.

https://blog.malwarebytes.com/threat-analysis/2018/04/new-crossrider-variant-installs-configuration-profiles-on-macs/

Remove "weknow.ac" Malware in Chrome?