You can make a difference in the Apple Support Community!

When you sign up with your Apple Account, you can provide valuable feedback to other community members by upvoting helpful replies and User Tips.

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Remove "weknow.ac" Malware in Chrome?

iMac (Retina 5K, 27-inch, Late 2015), 3.3 GHz Intel Core i5, 16 GB 1867 MHz DDR3, 1.7 TB free — Running High Sierra 10.13.6 (17G65). For a variety of reasons, Chrome is my default browser, and Google is my default search engine and homepage. While browsing with Chrome two days ago, I made the idiotic mistake of clicking on a Flash download popup and immediately noticed signs of infection by this malware. The main only noticeable effect is that my homepage, tab option, and search engine in the Chrome browser now default to this alien "weknow.ac" search engine, which produces results very different from Google's. I've tried three long phone troubleshooting sessions with Apple Help, including downloading and scanning with Malwarebytes, which read my computer as "clean." Also pursued other remedial steps I've seen suggested in other websites. (Although there are only a few that deal specifically with Chrome on Mac.) Uninstalled Chrome application, including trashing all its support folders from Library. However, the bug still keeps coming back. The "good" news is that Safari (so far) shows no sign of the infestation — so I'm using that as my only browser. However, I don't want my (still relatively new) iMac to go through the rest of its life with this alien entity ticking away in its innards. Can anyone here recommend a more permanent solution to my problem? Is there a third-party malware removal product that's both effective and trustworthy? Thanks in advance for any help.

iMac

Posted on Aug 15, 2018 6:51 AM

Reply
Question marked as Top-ranking reply

Posted on Sep 20, 2018 6:37 AM

I was finally able to fix this for chrome after having no luck with anything posted here. This is what I discovered:


"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.


All I had to do then was use the command line to delete / modify the affected policies:


defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName


The changes will not take effect until you restart Chrome.


I recommend following some of the other pieces of advice in this thread, ie definitely do a malware scan too.

310 replies

May 10, 2019 3:45 AM in response to Skanson

Sadly, this didn't work for me. It seemed to take the first three write commands, but when I enter the three delete commands Terminal responds with "Domain (com.google.Chrome) not found. Defaults have not been changed." Any other suggestions? I've never had this much trouble removing it before. Obviously, they're getting better at this. Very frustrated!

May 11, 2019 3:45 AM in response to Reuben_Hood

Hi,

Please can you help me ?

Each time I open Google Chrome, Weknow appears ! I deleted from everywhere also.

I followed your instructions through the Terminal application but WeKnow is still there.


Do I have to copy/paste this : defaults write com.google.Chrome HomepageIsNewTabPage -bool false OR this : com.google.Chrome HomepageIsNewTabPage -bool false


Thanks for helping me

May 22, 2019 11:46 PM in response to Skanson

I get through the top three commands and then when I enter any of these, I keep getting the same message:


defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName


2019-05-22 23:40:26.646 defaults[58696:687519] 

Domain (com.google.Chrome) not found.

Defaults have not been changed.


I am at my wits end!


Help!



May 23, 2019 8:07 AM in response to pobzeb224

Can those still having problems try this? Or are these the commands you've tried?


Enter the following commands, pressing enter after each line:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"
defaults delete com.google.Chrome DefaultSearchProviderSearchURL
defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
defaults delete com.google.Chrome DefaultSearchProviderName

Re-open Chrome and the issue should be resolved.


Also see this thread...

https://support.google.com/chrome/thread/3396218?msgid=4124217



Jun 25, 2019 9:59 AM in response to Skanson

I ALSO FIXED THE PROBLEM!


I wanted to follow up to this solution b/c this solution ultimately saved me. However, it's a year later and the malware has different app names and file names, and the policies are all different. So I wanted to update with my solution. Thanks to @Skanson for the original help with the Terminal commands, I wouldn't have known how to do that.


With inspiration from many different forums, I did several things which seem to have gotten rid of the problem entirely (fingers crossed):


1) Immediately delete/uninstall whatever malicious program you downloaded that ended up taking over Chrome. Mine was called "Macbook Cleaner Pro." I got a message from a website saying I needed to install the most up to date Adobe Flash Player, which was a clever trick b/c I actually have gotten legitimate updates like that several times throughout the last year, so I immediately downloaded it without thinking. Big mistake.


2) I used Malwarebytes to find any remaining files linked to Macbook Cleaner Pro (MCP). Although people are skeptical of Mac malware programs for good reason (I was using Dr. Cleaner for a while which eventually removed critical launch files that allowed my computer to restart and shutdown and I ended up having the wipe the computer and reinstall everything), Malwarebytes identified 5 additional MCP files through its normal scan function and deleted them. Happy about that b/c I wouldn't have found them myself.


3) The next thing I did was reset Chrome settings to default after exporting my bookmarks, which I didn't actually have to do b/c it is saved in the cloud, but just for good measure. Quit Chrome and reopen.


4) The final issue is all of the Chrome policies the malware installed automatically on Chrome that make it impossible to sign in to Chrome and show the message saying "Chrome is managed by your organization" or something similar, essentially cutting you out from changing settings, extensions, signing in, etc. And of course the malware is probably reading all of your movements and information and selling it to someone. I was on a bunch of different websites that warned against deleting policies that might be critical to the functioning of Chrome. But I eventually came across a blog that said that policies aren't necessary, that you only have them if Chrome is being managed by someone else or if you put them there yourself. Which I never have.. So, my conclusion was that Chrome shouldn't have any policies running. Into your address bar in Chrome, type in chrome://policy. Then use the following command online that you should plug into the Terminal app on Mac one by one with the name of the policy at the end: 


defaults write com.google.Chrome [POLICYNAME]


Put that into Terminal, hit enter, paste again and change the policy name, hit enter, etc. This process is deleting the policy you type in every time you hit enter. Do that one by one for every policy you see listed. When you're done, quit Chrome and reopen. Should fix it! If you can't see the entire policy name, click on it, it'll open a new tab that should read the entire policy name.


That solved the problem for me! Can't speak for anyone else, and I'm definitely not a computer whiz, but I wanted to throw this on here for other Mac users like me who are struggling.

Jun 25, 2019 10:01 AM in response to HeathenJeff

Hey HeathenJeff, I posted this in the general thread too, but wanted to respond to you directly, hope this helps!


—————


I wanted to follow up to this solution b/c this solution ultimately saved me. However, it's a year later and the malware has different app names and file names, and the policies are all different. So I wanted to update with my solution. Thanks to @Skanson for the original help with the Terminal commands, I wouldn't have known how to do that.


With inspiration from many different forums, I did several things which seem to have gotten rid of the problem entirely (fingers crossed):


1) Immediately delete/uninstall whatever malicious program you downloaded that ended up taking over Chrome. Mine was called "Macbook Cleaner Pro." I got a message from a website saying I needed to install the most up to date Adobe Flash Player, which was a clever trick b/c I actually have gotten legitimate updates like that several times throughout the last year, so I immediately downloaded it without thinking. Big mistake.


2) I used Malwarebytes to find any remaining files linked to Macbook Cleaner Pro (MCP). Although people are skeptical of Mac malware programs for good reason (I was using Dr. Cleaner for a while which eventually removed critical launch files that allowed my computer to restart and shutdown and I ended up having the wipe the computer and reinstall everything), Malwarebytes identified 5 additional MCP files through its normal scan function and deleted them. Happy about that b/c I wouldn't have found them myself.


3) The next thing I did was reset Chrome settings to default after exporting my bookmarks, which I didn't actually have to do b/c it is saved in the cloud, but just for good measure. Quit Chrome and reopen.


4) The final issue is all of the Chrome policies the malware installed automatically on Chrome that make it impossible to sign in to Chrome and show the message saying "Chrome is managed by your organization" or something similar, essentially cutting you out from changing settings, extensions, signing in, etc. And of course the malware is probably reading all of your movements and information and selling it to someone. I was on a bunch of different websites that warned against deleting policies that might be critical to the functioning of Chrome. But I eventually came across a blog that said that policies aren't necessary, that you only have them if Chrome is being managed by someone else or if you put them there yourself. Which I never have.. So, my conclusion was that Chrome shouldn't have any policies running. Into your address bar in Chrome, type in chrome://policy. Then use the following command online that you should plug into the Terminal app on Mac one by one with the name of the policy at the end: 


defaults write com.google.Chrome [POLICYNAME]


Put that into Terminal, hit enter, paste again and change the policy name, hit enter, etc. This process is deleting the policy you type in every time you hit enter. Do that one by one for every policy you see listed. When you're done, quit Chrome and reopen. Should fix it! If you can't see the entire policy name, click on it, it'll open a new tab that should read the entire policy name.


That solved the problem for me! Can't speak for anyone else, and I'm definitely not a computer whiz, but I wanted to throw this on here for other Mac users like me who are struggling.

Remove "weknow.ac" Malware in Chrome?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.