Level 1

54 points

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Top-ranking reply

Skanson

Level 1

19 points

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

All I had to do then was use the command line to delete / modify the affected policies:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

The changes will not take effect until you restart Chrome.

I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

View in context

310 replies

May 10, 2019 3:45 AM in response to Skanson

Sadly, this didn't work for me. It seemed to take the first three write commands, but when I enter the three delete commands Terminal responds with "Domain (com.google.Chrome) not found. Defaults have not been changed." Any other suggestions? I've never had this much trouble removing it before. Obviously, they're getting better at this. Very frustrated!

adil145

Level 1

4 points

May 11, 2019 3:45 AM in response to Reuben_Hood

Hi,

Please can you help me ?

Each time I open Google Chrome, Weknow appears ! I deleted from everywhere also.

I followed your instructions through the Terminal application but WeKnow is still there.

Do I have to copy/paste this : defaults write com.google.Chrome HomepageIsNewTabPage -bool false OR this : com.google.Chrome HomepageIsNewTabPage -bool false

Thanks for helping me

Rikkik

Level 1

4 points

May 22, 2019 11:46 PM in response to Skanson

I get through the top three commands and then when I enter any of these, I keep getting the same message:

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

2019-05-22 23:40:26.646 defaults[58696:687519]

Domain (com.google.Chrome) not found.

Defaults have not been changed.

I am at my wits end!

Help!

BDAqua

Level 10

250,253 points

May 23, 2019 8:07 AM in response to pobzeb224

Can those still having problems try this? Or are these the commands you've tried?

Enter the following commands, pressing enter after each line:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Re-open Chrome and the issue should be resolved.

Also see this thread...

https://support.google.com/chrome/thread/3396218?msgid=4124217

Jun 5, 2019 8:18 PM in response to Reuben_Hood

I plugged this into the terminal. I'm having the an error where it's saying:

"Domain (com.google.Chrome) not found.

Defaults have not been changed.

Jeffs-MBP:~ jeffjohnson$

I'm not very experienced with this stuff, I'd love some help if you guys have a solution to this. It lists my IP beforehand I believe.

SBRJ21

Level 1

9 points

Aug 6, 2019 8:14 PM in response to Reuben_Hood

Well, Youtube has some videos with mixed results.

Going to Systems preference and deleting the profile icon works only in part.
Using Terminal - I struggle with this one. They refer to full list of commands to copy to terminal, only it does not say how to bring that list up on the screen.

My Safari and Chrome were affected. FireFox was much better in blocking the We know.ac virus.

Check Safari preference and go to the website tabs. We know is hidden in there and I have not been able to delete it.

In Chrome, removing profile from Systems preference allowed me to edit and remove weknow from the search engine, but it still comes up if i do a File, and new window.

I have found nothing that totally removed the we know.ac virus.

I tried many malware removal tools and none of them even recognized the virus.

macjack

Level 10

111,242 points

Aug 15, 2018 7:14 AM in response to Reuben_Hood

Malwarebytes Anti-Malware for Mac will detect weknow-ac and remove it.

How to remove Weknow.ac redirect (Virus Removal Guide)

Reuben_Hood Author

Level 1

54 points

Aug 17, 2018 12:47 PM in response to tonysopranus

I agree, Tony. One of those “fixes” was actually for a Windows system!!

epp1948

Level 1

4 points

Aug 17, 2018 2:49 PM in response to Reuben_Hood

I have the same identical problem. Happened August 16, 2018. Applecare was not very helpfull!

Reuben_Hood Author

Level 1

54 points

Aug 18, 2018 5:52 AM in response to culvercitymacuser

Much appreciated, culvercitymac. At least you’re providing new information and a ray of hope.

crow74

Level 1

22 points

Sep 2, 2018 1:36 PM in response to Reuben_Hood

Same scenario here. I DLed Kaspersky Internet Security and Malwarebytes and they did nothing.

I'm factory resetting my mac. Which hurts. This is a nasty bug.

Sep 3, 2018 1:44 AM in response to culvercitymacuser

I tried this and it worked for me. The first time did not work but I tried again and it worked. Maybe I forgot a step (reboot?) during the first time.

dhumble

Level 1

11 points

Sep 3, 2018 1:42 PM in response to macjack

I would NOT recommend clicking and installing the above program - as it is just another gimmick.

Kurt Lang

Level 9

68,502 points

Sep 3, 2018 2:27 PM in response to dhumble

Which program are you talking about? If you mean MalwareBytes for Mac, it is far from a gimmick.

Sep 23, 2018 7:08 AM in response to Skanson

Hi there

I found this helpful, but now a New Tab comes up blank. Is there a way to revert to the New Tab being the same as Homepage? e.g. Google.com

Thanks

Charlie

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Remove "weknow.ac" Malware in Chrome?