"Weknow.ac" malware virus

[mbiviano]

I, along with many others, have the "Weknow.ac" malware virus after updating flashplayer. This virus takes over your search engine and won't allow you to change the default setting. Has anyone found a way to remove it? Neither Avast or Onyx work. Any help will be appreciated. Thanks.

 

[honestone]

Wonder why either Malwarebytes or ClamXav cannot "catch it". This link has a comprehensive discussion about that malware, and how to remove it:

https://macsecurity.net/view/193-remove-weknow-ac-virus-from-mac

Also, one can do a search of their machine for "Weknow", and/or "Weknow.ac". I use the excellent freeware program EasyFind for my searches, available from here:

https://www.devontechnologies.com/products/freeware.html

 

[mbiviano]

Thank you for the reply, but none of the first few steps were able to be done. The Activity Monitor did not show the virus and it was not in anywhere in my Applications folder. I did a search with Spotlight and nothing came up, yet the malware is still there anytime I open any of my browsers!

 

[MightyGem]

In future, when updating Flash Player, do it from the Flash Player Pane in System Prefs. That will ensure that you go to the proper Adobe site.

 

[honestone]

OK, first, download and run the following 2 programs, in the order indicated:

1. Malwarebytes, available from here:

https://www.malwarebytes.com/mac/

2. ClamXav, available from here:

https://www.clamxav.com/

When you launch ClamXav, select your entire drive to be scanned. ClamXav "digs" deeper than Malwarebytes (MW), but MW is a good start.

Secondly, EasyFind, like ClamXav, digs "deeper" than Spotlight. You really should download and run it. It does an excellent job!

 

[honestone]

In future, when updating Flash Player, do it from the Flash Player Pane in System Prefs. That will ensure that you go to the proper Adobe site.

Good advice, but with the way browsers have come along, there is no need for Flash Player. Just about all content is displayed fine without it. I stopped using it a few years ago, and all is well. And definitely avoid any pop ups, saying you need a new version of Adobe Flash Player.

 

[mbiviano]

PROBLEM SOLVED!!

After much research I found something that removes the virus.
Open "Terminal" and copy and paste each of the following entries below. I did each one at a time. I copy and pasted the first line and then hit enter and then went to the next until I had finished all 6 below:


defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"

defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName


Quit Chome and restart it and the virus will be gone.