Can't remove weknow.ac affecting Chrome on MacBook Pro

Status
Not open for further replies.

Randy Ewins

New Member
Thread author
Dec 15, 2018
3
I am running both Safari and Chrome on a MacBook Pro. OS is High Sierra 10.13.6. I picked up weknow.ac when I downloaded an update to Flash Player. I was able to get control of my Safari search engine page by going into Sys Pref> Profiles and deleting the malicious profile. However, I cannot seem to get it off my Chrome browser. I have tried everything I have found on line, including deleting Chrome and reloading it. The weknow.ac search engine came right back up. I did make changes to get a Google.com search engine when I first open Chrome, but when I open a second tab, it goes to weknow.ac. Any suggestions?
 

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,377
Hello @Randy Ewins,

Lets completely remove Google Chrome and all its data, then reinstall it. Before doing this be aware that this will delete all data for all Google apps you have installed, such as your bookmarks, so you will need to export them before doing this.

  1. To completely remove Google Chrome, click the Finder icon, from the menu bar. Choose Go, click Go to Folder, then paste one of the below paths into the window that opens.

    Code:
    /Applications/Chrome.app
    /Library/Application Support/Google/
    /Library/Google/
    ~/Library/Application Support/Google/
    ~/Library/Google/
    ~/Library/Preferences/com.google.Chrome.plist
  2. You will need to delete all of the above items. After deleting all of the above files, restart your device.
  3. You can now download and re-install Google Chrome on your device. You will need to import any exported bookmarks or other data, and may need to reinstall any other Google apps that you use.
 

Randy Ewins

New Member
Thread author
Dec 15, 2018
3
Hello @Randy Ewins,

Lets completely remove Google Chrome and all its data, then reinstall it. Before doing this be aware that this will delete all data for all Google apps you have installed, such as your bookmarks, so you will need to export them before doing this.

  1. To completely remove Google Chrome, click the Finder icon, from the menu bar. Choose Go, click Go to Folder, then paste one of the below paths into the window that opens.

    Code:
    /Applications/Chrome.app
    /Library/Application Support/Google/
    /Library/Google/
    ~/Library/Application Support/Google/
    ~/Library/Google/
    ~/Library/Preferences/com.google.Chrome.plist
  2. You will need to delete all of the above items. After deleting all of the above files, restart your device.
  3. You can now download and re-install Google Chrome on your device. You will need to import any exported bookmarks or other data, and may need to reinstall any other Google apps that you use.
Jack, Thank You! I followed your steps. I had previously read these instructions from Malwarebytes, but did not understand how to delete the files. I didn't know I was supposed to right click on Finder.
1. The /Applications/Chrome.app file said there was no file, so I did not delete anything there.
2. I deleted all of the other files, EXCEPT /Library/Application Support Google/. That pulled up 28 folders and did not highlight any one or two like some of the other files did. There were two files that had small red circles with a line through them. (Don't know what that means.) The 28 folders made me nervous to delete, so I did not delete anything in that file.
3. Then I dragged Google Chrome to the trash from my Applications Folder.
4. I emptied the trash, rebooted the machine, reinstalled Google Chrome and the weknow.ac malware seems to be gone. I opened my new Chrome install and it went directly to Google search engine. (It previously would go to the weknow.ac search engine.)
5. For the record, can you tell me if you think I left some malware on my machine by not deleting the Library file? Should I go back through this entire process and delete all 28 of those files and reinstall Chrome again? It really did not take that long and I would rather be safe than sorry, but also I don't want to create a mess. Let me know your thoughts.

Again, thank you very much,
Randy
 
  • Like
Reactions: oldschool
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top