Remove Weknow.ac Virus from Mac (2022 Guide)

Weknow.ac virus – a persistent Mac infection targeting Chrome browser

Contents

Weknow.ac virus – a persistent Mac infection targeting Chrome browser
PUP comes as a fake Adobe Flash update or in software bundles
Remove Weknow.ac virus from Mac

Weknow.ac virus is persistent Mac browser hijacker that injects browser policies to persist on infected system. It changes default homepage, new tab page and primary search engine URLs to promote a fake search engine at www.weknow.ac. This virus hijacks default Chrome policies, making it extremely hard to remove it, especially for inexperienced Mac users. This unwanted program is reportedly related to Smart Search browser hijacker family. In this guide, we will explain how to easily remove the threat and restore settings back to defaults.

As most of other PUPs, Weknow.ac virus enters the system via software bundles or fake Adobe Flash updates. After the installation, it takes over the used browser and changes its default settings. One key feature of this browser hijacker is that it runs a set of Terminal commands to change Google Chrome policies for its own benefit.

The aim of this hijacker is to force people perform searches through unreliable site. Every time you open your browser or a new tab, you will be redirected to a fake search engine without the ability to reset your browser’s settings.

The virus might sneak into your computer via fake Flash Player update pop-up.

These manipulative activities gained this fake search add-on a virus label. Although this name is not technically accurate, people feel highly threatened by this hijacker’s resistance for removal; thus, it is often referred as Weknow.ac virus.

Furthermore, some versions of this potentially unwanted program (PUP) do not redirect to its own search engine; instead, it corrupts Google Chrome itself. You can notice the infection by a little change — it says Chrome managed by your organization in the URL bar and settings.

Unfortunately, every browsing activity (such as search queries, browsing history, etc.) is monitored while you have this browser hijacker installed on your system. Experts note that information provided during queries on the search engine is collected and may be shared with third-parties or used to customize ads.

AUTOMATIC REMOVAL

See Full Review

Remove Weknow.ac virus using INTEGO ANTIVIRUS for Mac (includes scanning for iOS devices). The one-of-a-kind security suite provides VirusBarrier X9 real-time protection against Mac and Windows-based malware, removes existing threats and scans for malware in popular e-mail clients. Includes NetBarrier X9, an intelligent firewall for home, work and public connections.

Those who notice Safari homepage Weknow ac, also report that their browsers are flooded with various advertising content. During browsing sessions, people receive an excessive amount of pop-ups, banners and various product offerings.

Additionally, the ads cause significant slowdowns in computer’s performance and can lead to dangerous websites. We recommend to stay away from any promotional content online and refrain from clicking on ads. Otherwise, you might trigger an installation of other potentially unwanted programs (PUPs).

Currently, many people search how to remove weknow.ac malware from Mac and Chrome. For this reason, we have prepared a simple step-by-step guide at the end of this article. Every step is illustrated and specifically designed to help you eliminate this browser hijacker from both, your computer and currently used browser. If you’re looking for an automated tool to complete the removal for you, we highly recommend INTEGO. It is a well-reviewed antivirus for OS X that reaches 100% detection rate for OS-targeted malware.

Name	Weknow.ac virus
Domain	https://www.weknow.ac/
Category	Browser hijacker; Fraudulent search engine
Target	Mac OS
Symptoms	1. Changes the primary search engine to a fake one; 2. Manipulates browser’s settings; 3. Alters Chrome policies; 4. Provides skewed search results.
Distribution	Widely distributed as a fake Adobe Flash update pop-up and in software bundles
Damage	To the computer: hijacks the browser and manipulates it’s settings without permission, increases the risk of malware infections, and slowdowns the system. To the user: collects private information that is later shared with third parties, can lure into scams and other phishing activities.
Removal	Since this is a persistent threat, we recommend using professional antivirus software for Weknow.ac virus removal from Mac. Our top choice is INTEGO.

AUTOMATIC REMOVAL

See Full Review

Remove the virus using INTEGO ANTIVIRUS for Mac (includes scanning for iOS devices). The one-of-a-kind security suite provides VirusBarrier X9 real-time protection against Mac and Windows-based malware, removes existing threats and scans for malware in popular e-mail clients. Includes NetBarrier X9, an intelligent firewall for home, work and public connections.

PUP comes as a fake Adobe Flash update or in software bundles

There are two ways how Weknow.ac virus spreads. One of them is traveling as a fake Adobe Flash update pop-up on untrustworthy sites. Users get redirected to a new tab or window displaying a warning that their flash player must be updated. Although, it is merely a disguise to trick people into downloading malware.

Another way how this browser hijacker spreads is through software bundles. It is a common practise to distribute applications as an add-on to the main software. Unfortunately, less reliable people took advantage of the legitimate practise and now distribute potentially unwanted programs (PUPs) the same way.

The hijacker travels in software bundles.

For example, if you download software, always choose manual instead of automatic installation process on the installation wizard. This way, you will walk through all the steps and give permission to only necessary changes. Look for pre-selected tick boxes that offer installing add-ons.

De-select them and double check your system for additional software that you did not agree to install. For that, always use a robust malware removal software with real-time protection. This feature is designed to help you avoid cyber threats in real time as well as perform regular system scans for professional security.

Remove Weknow.ac virus from Mac

Step 1. Delete Weknow.ac virus profiles from your Mac

Go to System Preferences and click on Profiles at the bottom-right corner;
Select AdminPrefs and delete it by clicking on the minus button;

Step 2. Remove the PUP from the Applications

Open Finder and navigate to Applications via the toolbar on the left;
Search for Weknow.app or similar files and throw them to the trash.
Open the Trash bin and navigate to the Gear Icon > Empty Bin.

Step 3. Uninstall Weknow.ac add-on and reset search engine settings

Get rid of Weknow from Safari:
1. Open Safari;
2. Navigate to Safari > Preferences > Extensions;
3. Search for Weknow.ac extension and remove it;
4. Then navigate to Preferences > Search;
5. Reset the search engine to a legitimate one, for example, Google.
Delete the browser hijacker from Google Chrome:
1. Open Google Chrome and press on the three vertical dots at the top-right corner of the window;
2. Navigate to Settings > Extensions and remove Weknow.ac extension;
3. Then go to Settings > Search Engine and set it to Google.
Uninstall Weknow.ac from Mozilla Firefox:
1. Open Mozilla Firefox;
2. Type about:addons in the address bar;
3. Search for suspicious add-ons and remove them.

Step 4. Delete Weknow files from LaunchAgents, Application Support, and LaunchDaemons directories

Clean hijacker’s components from LaunchAgents directory:
1. On the top bar navigate to Go > Go to Folder;
2. Enter /Library/LaunchAgents;
3. Sort files by recently added and try to identify the ones related to Weknow.ac;
4. Drag them to the Trash Bin;
5. Repeat the steps in ~/Library/LaunchAgents directory;
Get rid of PUP’s elements from Application Support catalog:
1. Open Go > Go to Folder;
2. Type /Library/Application Support;
3. Delete suspicious files as previously explained;
4. Repeat the steps in ~/Library/Application Support directory.
Delete files related to the browser hijacker from LaunchDaemons path:
1. Navigate to Go > Go to Folder;
2. Enter /Library/LaunchDaemons and press Go;
3. Get rid of files related to Weknow.ac hijacker.
Clean the trash bin:
1. Once you complete all the steps above and drag the suspicious files to the trash bin, you have to empty it;
2. Go to Trash Bin at the bottom-right corner of the screen;
3. Navigate to the Gear Icon > Empty Bin.

Step 5. Remove Weknow.ac from Chrome (delete policies)

Note. This step is essential to finalize Weknow.ac virus removal from Chrome.

Navigate to Go > Utilities and open Terminal application;
Now, enter each of these commands into Terminal and press Enter after each of them:
- defaults write com.google.Chrome
  HomepageIsNewTabPage -bool false
- defaults write com.google.Chrome
  NewTabPageLocation -string “https://www.google.com/”
- defaults write com.google.Chrome
  HomepageLocation -string “https://www.google.com/”
- defaults delete com.google.Chrome DefaultSearchProviderSearchURL
- defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
- defaults delete com.google.Chrome
  DefaultSearchProviderName
Restart Google Chrome application.

Note. If you receive “domain (com google chrome not found)” warning when entering the commands into Terminal, it means that Weknow virus might have corrupted some files on the computer. We suggest running a full system scan right away. Try INTEGO, it is highly recommended by security experts and other computer users.

AUTOMATIC REMOVAL

See Full Review

Additional Mac cleanup and browser reset instructions are provided below.

OUR GEEKS RECOMMEND

Keep your Mac virus-free with INTEGO, an exceptional antivirus with an option to scan other iOS devices. The VirusBarrier X9 offers 24/7 real-time protection against Mac and Windows malware, includes intelligent firewall (NetBarrier X9) for protecting your incoming/outgoing connections at home, work or public hotspots and more.

INSTALL INTEGO

INTEGO antivirus is one of the leading security products for Mac that includes VirusBarrier X9 and NetBarrier X9 features allowing detection of viruses, ransomware, adware, browser hijackers, Trojans, backdoors and other threats and blocks suspicious network connections. If any detections are found, the software will eliminate them. Learn more about the software's features in its full review.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Weknow.ac virus Removal Tutorial

To remove the unwanted program from your Mac, use these instructions below to uninstall associated applications from your Mac computer. Then scroll down for instructions how to clean each affected web browser individually.

Remove Weknow.ac virus from Mac

Click on Finder.
Go to Applications folder.
Look for suspicious applications you can't remember installing. Right-click them and select Move to Trash.
After moving all suspicious apps to Trash, right-click the Trash bin in Mac's Dock and select Empty Trash.

To remove Mac threats automatically, we strongly recommend using robust and well-reviewed antivirus solution INTEGO.

AUTOMATIC REMOVAL

See Full Review

Remove using INTEGO ANTIVIRUS for Mac (includes scanning for iOS devices). The one-of-a-kind security suite provides VirusBarrier X9 real-time protection against Mac and Windows-based malware, removes existing threats and scans for malware in popular e-mail clients. Includes NetBarrier X9, an intelligent firewall for home, work and public connections.

Safari Chrome Firefox

Remove Weknow.ac virus from Safari

Uninstall suspicious Safari extensions

Open Safari and click on Safari button in the top left corner. Select Preferences in the menu that appears on the screen.
Now, go to Extensions tab. Look at the left to see all installed extensions, click on suspicious ones and hit that Uninstall button as shown in the picture. Confirm your choice by clicking Uninstall again. Repeat until you get rid of all unwanted extensions.

Change Safari Homepage and default search engine

In Preferences, open the General tab. Here, check what URL is set as your homepage. Delete it and type in whatever URL you want to set as your Safari Start Page.
Next, go to the Search tab. Here, choose what Search engine you want to set as default.
Next, click on Manage websites... then Remove all... and then Done.

Remove push notifications on Safari

Some suspicious websites can try to corrupt your Safari by asking to enable push notifications. If you have accidentally agreed, your browser will be flooded with various intrusive advertisements and pop-ups. You can get rid of them by following this quick guide:

Open Safari and click on Safari button in the top-left corner of the screen to select Preferences;
Go to Websites tab and navigate to Notifications on the left side toolbar.

Reset Safari

Click on Safari > Clear History...
Then choose to clear All history and hit Clear History button to confirm.
Go to Safari > Preferences and then open Privacy tab.
Click Manage Website Data... then Remove All. To finish, click Done.
Finally, clear Safari cache. In Safari Menu, click Develop > Clear Cache.

Safari Chrome Firefox

Remove Weknow.ac virus from Google Chrome

Remove suspicious Chrome extensions

Open Chrome and type chrome://extensions into address bar and press Enter.
Here, look for suspicious extensions, and Remove them.
Don't forget to confirm by pressing Remove in the confirmation pop-up.

Change Start Page settings

In Chrome address bar, type chrome://settings and press Enter.
Scroll down to the On startup section. Check for suspicious extensions controlling these settings, and Disable them.
Additionally, you can set browser to Open a specific page or set of pages via these settings. Simply choose this option, click Add a new page, enter your preferred URL (f.e. www.google.com) and press Add.

Change default search settings

In Chrome URL bar, type chrome://settings/searchEngines and press Enter. Make sure you type searchEngines, not searchengines. Additionally, you can go to chrome://settings and find Manage search engines option.
First, look at the list of search engines and find the one you want to set as default. Click the three dots next to it and select Make Default.
Finally, look through the list and eliminate suspicious entries. Right-click the three dots and select Remove from the list.

Remove push notifications from Chrome

If you want to get rid of the annoying ads and so-called push-notifications viruses, you must identify their components and clean your browser. You can easily remove ads from Chrome by following these steps:

In Google Chrome, press on Menu (upward arrow) in the top-right corner of the window.
Select Settings.
Go to Privacy and Security > Site Settings.
Open Notifications.
Here, go to the Allow list and identify suspicious URLs. You can either Block or Remove by pressing on the three vertical dots on the right side of the URL. However, we suggest the Block option, so the site won't ask you to enable the notifications if you ever visit it again.

Reset Google Chrome browser

The final option is to reset Google Chrome. Type chrome://settings in the URL bar, press Enter and then scroll down until you see Advanced option. Click it and scroll to the bottom of the settings.
Click Restore settings to their original defaults.
Click Restore settings to confirm.

Safari Chrome Firefox

Remove Weknow.ac virus from Mozilla Firefox

Remove unwanted add-ons from Firefox

Open Firefox and type about:addons in the URL bar. Press Enter.
Now, click on Extensions (in the left section).
Click Remove next to every suspicious browser add-on that you can't remember installing.

Change Firefox Homepage

In Firefox address bar, type about:preferences and hit Enter.
Look at the left and click the Home tab.
Here, delete the suspicious URL and type or paste in the URL of a website you'd like to set as your homepage.

Alter preferences in Firefox

Type about:config in Firefox address bar and hit Enter.
Click I accept the risk! to continue.
Here, type in the URL which has taken over your browser without your knowledge. Right-click each value that includes it and choose Reset.

Remove annoying push notifications from Firefox

Suspicious sites that ask to enable push notifications gain access to Mozilla's settings and can deliver intrusive advertisements when browsing the Internet. Therefore, you should remove access to your browser by following these simple steps:

In Mozilla Firefox, click on Menu (the three horizontal bars) on the top-right corner of the window, then choose Options.
Click on Privacy and Security, then scroll down to Permissions section.
Here, find Notifications and click Settings button next to it.
Identify all unknown URLs and choose to Block them. Click Save Changes afterward.

Reset Mozilla Firefox

In Firefox, type about:support in the address bar and press Enter.
Click on Refresh Firefox...
Click Refresh Firefox again to confirm.

Disclaimer. This site includes affiliate links. We may earn a small commission by recommending certain products, at no additional cost for you. We only choose quality software and services to recommend.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.