The most difficult Apple Mac OS virus we have ever come across ….. Weknow.Ac
How do I know if my computer has the Weknow.ac virus?
Open up any browser …. does your search page look like the following or similar?
If so, you have the Weknow.ac virus and you need to get rid of it ASAP
Following suggestions on another website (MacReports) we managed to clean up Safari browser ….
The advise offered here regarding Google Chrome did not work, we know this because it is still impossible to change the default search-engine away from we know.ac
How did I get the weknow.ac virus?
Well in our case we were looking for a Microsoft site called “Success with Teams” and instead of typing successwithteams.com mis-spelled it as sucesswithteams.com which landed me on the following page where I was fooled into thinking that Flash Player needed upgrading
We found more advice on removing the we know.ac virus on the Apple Communities Website, where we came across two solutions:
- Wipe and reformat your HDD by going into recovery mode.(Only advisable if you have a current Time Machine Backup)
…. “weknow.ac” changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you’re infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.
Use the command line to delete / modify the affected policies. You do this by opening up “Terminal” and copy and paste each of the following entries below. I did each one at a time. I copy and pasted the first line and then hit enter and then went to the next until I had finished all 6 below:
defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string “https://www.google.com/”
defaults write com.google.Chrome HomepageLocation -string “https://www.google.com/”
defaults delete com.google.Chrome DefaultSearchProviderSearchURL
defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
defaults delete com.google.Chrome DefaultSearchProviderName
Need more help?
Covid-19 Update: Business as usual for workshop repairs, remote support and onsite support.
If you live in Western Australia, and you need any kind of computer help, please complete the form here before bringing your device or computer to us at 315 Rokeby Road, Subiaco, Western Australia or call us out by clicking here. You can email us at email@example.com or call:
For instant remote control sessions, follow the instructions found on this page