Troubleshoot Google Chrome default search engine changed...and I can't change it back

Status
Not open for further replies.

Peteswife41798

New Member
Thread author
Aug 7, 2018
2
I did have an issue the other day on Macbook Pro with some malware and I suspect that's when it happened. A new search engine is running my searches on Google Chrome: www.weknow.ac. I have no idea what that is or where it came from. (Forgot to mention that I have run malwarebytes at least 4 times since my incident and it comes back clean everytime.)

I've gone to the settings in my google chrome in an effort to change it, but I can't change the default back to google, and I can't remove this unknown search engine.

If anyone can help me, I would grateful! This is making me bonkers!
 

slash/

Level 6
Verified
Jun 24, 2018
277
Go to Applications. If you see any unfamiliar applications with "weknow" in the title, delete them.

Go to System Preferences, then Profiles. There may be a Device Profile there that you did not add. Click on it and click the minus button to delete it.

After that, go to each affected browser, remove any "weknow" extensions that were added.

Finally, reset each affected browser's settings.

Do one last scan with Malwarebytes for peace of mind.

Let me know if any of these steps don't make sense and I'll add screenshots from my Mac.
 

SabbyGlo0809

New Member
Aug 14, 2018
1
I am having the same problems with the "weknow" I have done everything from deleting application, profiles and even malwarebytes. It has found threats but I cant delete? Still on El Capitan 10.11.6
 

Attachments

  • Screen Shot 2018-08-14 at 11.13.08 PM.png
    Screen Shot 2018-08-14 at 11.13.08 PM.png
    78.1 KB · Views: 2,058

arttykh

New Member
Sep 27, 2018
1
I am having the same problems with the "weknow" I have done everything from deleting application, profiles and even malwarebytes. It has found threats but I cant delete? Still on El Capitan 10.11.6

I am investigating this malware now.

It is possible, that your Mac was infected by Weknow,ac / Anysearch from the .dmg file of Adobe Flash Player.

Did you download this application on your computer recently?
 
  • Like
Reactions: oldschool

m_mchenry

New Member
Oct 5, 2018
1
I have... I spent 2+ hours on the phone with Apple today and we tried everything to get rid of this. We got it off of my Safari and Firefox, but no matter what we did, how many times we removed and re-added Google Chrome it still comes up with the "fake" screen and the pop up at the bottom right corner. What do we do.... For now I have resolved to just abandon Google Chrome...
 
  • Like
Reactions: oldschool

oldschool

Level 81
Verified
Top Poster
Well-known
Mar 29, 2018
7,043
I have... I spent 2+ hours on the phone with Apple today and we tried everything to get rid of this. We got it off of my Safari and Firefox, but no matter what we did, how many times we removed and re-added Google Chrome it still comes up with the "fake" screen and the pop up at the bottom right corner. What do we do.... For now I have resolved to just abandon Google Chrome...

I'm not a Mac user but you could uninstall Chrome, then scan with Malwarebytes. You may then be able to safely install Brave Beta browser, which is a privacy oriented Chromium based browser. Please consider your browsing habits, find safe computing tips here on the forum and make sure you are a safe user. (y)
 
  • Like
Reactions: Weebarra

Jack

Administrator
Verified
Staff Member
Well-known
Jan 24, 2011
9,377
Can you please check if there's an AdminPrefs file on the device. If it's there, you should remove it.

  1. Go to System Preferences.
  2. Click Profiles.
  3. The list will include an item “AdminPrefs“. Select this and click the remove “” button in the lower left corner.

Next, scan your device with - Malwarebytes for Mac — Mac Antivirus Replacement

----

If the issue persists, you will need to completely remove Chrome and all data, then reinstall. To do this, delete all of the following items:

Code:
/Applications/Chrome.app

/Library/Application Support/Google/

/Library/Google/

~/Library/Application Support/Google/

~/Library/Google/

~/Library/Preferences/com.google.Chrome.plist

Be aware that this will delete all data for all Google apps you have installed, such as Chrome bookmarks. Export any data you want to keep beforehand.

If you're not sure how to find these folders, choose Go to Folder from the Go menu in the Finder, then paste one of those paths into the window that opens. Be sure to delete the correct item, as deleting the wrong item could cause data loss or even damage to your system or other apps.

After deleting all these files, restart the computer. Then re-download Chrome and reinstall. You will need to import any exported bookmarks or other data, and may need to reinstall any other Google apps that you use.
 

Izybelz

New Member
Nov 25, 2018
1
Hey guys, I just fixed this problem on my computer. You go to setting and profiles and there should be 1 (there was 2 on mine) of the same profiles that say something like admin which require your password to remove. There's a hyperlink at the bottom of them which includes weknow in it. Once they've been removed, quit Chrome reopen it and you should be good. :)
 
  • Like
Reactions: Jack
Status
Not open for further replies.

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top