Joined
Aug 7, 2018
Messages
2
Operating System
MacOS High Sierra
Antivirus
Malwarebytes
#1
I did have an issue the other day on Macbook Pro with some malware and I suspect that's when it happened. A new search engine is running my searches on Google Chrome: www.weknow.ac. I have no idea what that is or where it came from. (Forgot to mention that I have run malwarebytes at least 4 times since my incident and it comes back clean everytime.)

I've gone to the settings in my google chrome in an effort to change it, but I can't change the default back to google, and I can't remove this unknown search engine.

If anyone can help me, I would grateful! This is making me bonkers!
 
Joined
Jun 24, 2018
Messages
275
#2
Go to Applications. If you see any unfamiliar applications with "weknow" in the title, delete them.

Go to System Preferences, then Profiles. There may be a Device Profile there that you did not add. Click on it and click the minus button to delete it.

After that, go to each affected browser, remove any "weknow" extensions that were added.

Finally, reset each affected browser's settings.

Do one last scan with Malwarebytes for peace of mind.

Let me know if any of these steps don't make sense and I'll add screenshots from my Mac.
 

arttykh

New Member
Joined
Sep 27, 2018
Messages
1
#5
I am having the same problems with the "weknow" I have done everything from deleting application, profiles and even malwarebytes. It has found threats but I cant delete? Still on El Capitan 10.11.6
I am investigating this malware now.

It is possible, that your Mac was infected by Weknow,ac / Anysearch from the .dmg file of Adobe Flash Player.

Did you download this application on your computer recently?
 
Likes: oldschool

m_mchenry

New Member
Joined
Oct 5, 2018
Messages
1
Operating System
MacOS
Antivirus
Malwarebytes
#6
I have... I spent 2+ hours on the phone with Apple today and we tried everything to get rid of this. We got it off of my Safari and Firefox, but no matter what we did, how many times we removed and re-added Google Chrome it still comes up with the "fake" screen and the pop up at the bottom right corner. What do we do.... For now I have resolved to just abandon Google Chrome...
 
Likes: oldschool

oldschool

Level 17
Verified
Joined
Mar 29, 2018
Messages
817
Operating System
Windows 10
Antivirus
Cylance
#7
I have... I spent 2+ hours on the phone with Apple today and we tried everything to get rid of this. We got it off of my Safari and Firefox, but no matter what we did, how many times we removed and re-added Google Chrome it still comes up with the "fake" screen and the pop up at the bottom right corner. What do we do.... For now I have resolved to just abandon Google Chrome...
I'm not a Mac user but you could uninstall Chrome, then scan with Malwarebytes. You may then be able to safely install Brave Beta browser, which is a privacy oriented Chromium based browser. Please consider your browsing habits, find safe computing tips here on the forum and make sure you are a safe user. (y)
 
Likes: Weebarra

zafoto

New Member
Joined
Oct 19, 2018
Messages
1
Operating System
MacOS
Antivirus
Comodo
#8
i have same problem.how can i change weknow.ac from my browser?
 

Jack

Admin
MalwareTips Team
Verified
Joined
Jan 24, 2011
Messages
8,800
Operating System
Windows 10
Antivirus
Windows Defender
#9
Can you please check if there's an AdminPrefs file on the device. If it's there, you should remove it.

  1. Go to System Preferences.
  2. Click Profiles.
  3. The list will include an item “AdminPrefs“. Select this and click the remove “” button in the lower left corner.

Next, scan your device with - Malwarebytes for Mac — Mac Antivirus Replacement

----

If the issue persists, you will need to completely remove Chrome and all data, then reinstall. To do this, delete all of the following items:

Code:
/Applications/Chrome.app

/Library/Application Support/Google/

/Library/Google/

~/Library/Application Support/Google/

~/Library/Google/

~/Library/Preferences/com.google.Chrome.plist
Be aware that this will delete all data for all Google apps you have installed, such as Chrome bookmarks. Export any data you want to keep beforehand.

If you're not sure how to find these folders, choose Go to Folder from the Go menu in the Finder, then paste one of those paths into the window that opens. Be sure to delete the correct item, as deleting the wrong item could cause data loss or even damage to your system or other apps.

After deleting all these files, restart the computer. Then re-download Chrome and reinstall. You will need to import any exported bookmarks or other data, and may need to reinstall any other Google apps that you use.
 

Izybelz

New Member
Joined
Nov 25, 2018
Messages
1
#10
Hey guys, I just fixed this problem on my computer. You go to setting and profiles and there should be 1 (there was 2 on mine) of the same profiles that say something like admin which require your password to remove. There's a hyperlink at the bottom of them which includes weknow in it. Once they've been removed, quit Chrome reopen it and you should be good. :)
 
Likes: Jack