how to remove weknow.ac virus

I called Apple help. They had me install a malware cleansing program and walked me through the process. The installed program, I think is called Malware bytes, took several minutes to remove the program.

SO.... I followed the terminal cut paste directions including changing the shell... I did this about a month ago and it seemed to clear the situation. All of a sudden I see that WeKnow is back :( I followed the same method and it is not working. I think because of something to do with password verification... See string... it will not let me enter a password though (and shows a little key

Macintosh-0016cbced0bd-6:~ trea$ chsh -s /bin/tcsh

Changing shell for trea.

Password for trea: 

chsh: Credentials could not be verified, username or password is invalid.  Credentials could not be verified, username or password is invalid.

Macintosh-0016cbced0bd-6:~ trea$ chsh -s /bin/tcsh

Changing shell for trea.

Password for trea: 

Look for the magnifying glass (search icon) in the top right corner of your mac.

Click on it, type Terminal in it.

It will open a UNIX programming window (similar to MS-DOS window in Windows OS computers).

Type the code lines one by one (copy, and past one line, click enter, then do the same for second...so on and so forth).

Re-start the computer! This should address your issues.

This advice no longer works. The virus has been upgraded, and won't allow itself to be deleted from the Safari browser list. My computer has not got any Safari extensions, has no WeKnow application, and I have reset both Safari and restarted my Mac, to no avail.

Any additional help welcome.

I've done this and it clears weknow from the search boxes on my main page, but when I ask for a new page or new window under the "File" dropdown menu in Chrome, weknow shows up again in the search boxes on the new page/window. When I check AdminPrefs under Profiles, no profiles are listed there. Anyone know something about this?

I just found the easiest way to solve all the problems that even genius bar couldn't solve. If you already tried Malwarebytes and your chrome homepage is still 'weknow', like me, just click the 'FAQS' on the bottom of the 'weknow' page, and there's a question 'How to uninstall weknow', and there's a zip file called uninstall provided in the answer! Just download that and click! And it's all gone! It's just amazing, I can't believed I tried everything for so long and it turn out to be so easy to solve.

People use Chrome on snow leopard, because Apple dropped support updates on safari in older OS's, and perhaps 20% of websites on the internet do not load or work properly. I use Firefox instead.. but hardly use the web on a snow leopard machine other than on my home network, unless I need to and know where I am going online is safe. I never trusted Chrome.

I tried this and it worked. One thing I had to look up was how to find "Terminal"

In a Mac it's in Applications, then click on Utilities, then Terminal App.

Once open a box will show. Then you simple type each line like you said and hit return after.

It worked. Thanks.

Thank you for your help.

This has been a maze and I had trouble getting rid of weknow. I tried numerous ways. and spent hours, I found the following and it worked for me.

Use the command line to delete / modify the affected policies. Do this by opening up "Terminal" (Click the magnifier on the top right corner of computer, type in “terminal” ), copy and paste each of the following entries below. Do one at a time. Copy and pasted the first line and then hit enter and then went to the next until finish all 6 below:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Quit Chrome and restart it and voila the virus will be gone. I tried everything and this was the only thing that worked.

I post it here for people who have weknow virus to be used to get rid of it.

For Chrome. I spent hours on this issue, finally it worked using the instruction below. Good luck.

click the magnifier on the top right corner of computer, type in “terminal” 

Use the command line to delete / modify the affected policies. You do this by opening up "Terminal" and copy and paste each of the following entries below. I did each one at a time. I copy and pasted the first line and then hit enter and then went to the next until I had finished all 6 below:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Quit Chrome and restart it and voila the virus will be gone. I tried everything and 3 phone calls with Apple and this was the only thing that worked.

So many complicated methods of getting rid of Weknow!! I tried them all, and a few more as well; until I found the easiest way to get rid of it - I deleted Adobe Flash Player, which is well known for carrying piggy-backed Adware and Malware!!! In a single stroke I got rid of it!! DON'T download any more updates of this rubbish and you'll help to keep your Mac clean!!

This worked great on the surface, but when I looked in chrome policies, it still said this: defaultsearchproviderkeyword with policy value being http://search-operator.com/search.php?q=%s.

Can you help with this? Thank you!

Yeah, I got that but you made it a point to say she spoke to 2 Senior Advisors who could not resolve this. They would not be able to resolve an issue within Chrome as they can only support Safari as that is an Apple web browser.

There are too many respondants on this thread. It is impossible to keep track of who is responding to what. Please start a new thread. Not to mention, the discovery of the Terminal solution if not solving it should be addressed in a new thread, saying it does work for whomever it does not.

You may need to remove all Chrome plugins and extensions in the preferences before proceeding,

Quit from Chrome after doing that by selecting Quit Chrome in the Chrome menu or File menu.

Then run the Terminal commands. Lastly, relaunch Chrome holding the shift key down when you do, telling it you don’t want to reload the last page. Then go chrome://policy link. If that link is still showing other sites on the page, reload policies.