How to Remove Weknow.ac Malware on macOS 10.15
2024-09-19 14:12:38 • Filed to: macOS 10.15 • Proven solutions
Weknow.ac is an insidious malware that usurps your control over your browser settings and alters them without your approval. It changes your browser’s default homepage and search engine to http://weknow.ac, and installs extensions and add-ons that constantly interrupt your browsing sessions.
You might be able to remove Weknow.ac from your Safari, Chrome, or Firefox on Mac OS 10.15 by performing a system-wide troubleshooting technique. But in some cases, you might need to treat one browser at a time to get rid of Weknow.ac on Mac OS 10.15.
How to Remove Weknow.ac Virus on macOS 10.15
Method 1: Remove Weknow.ac Malware from Mac on Mac OS 10.15
The first thing to do is to implement system-wide troubleshooting techniques to get rid of Weknow.ac on Mac OS 10.15. But if the virus continues to linger on in any of your browsers, then you might need to go down to each browser to fish out the virus.
To remove Weknow.ac virus on Mac OS 10.15, you need to find and eradicate malicious apps and folders from your hard drive.
1. Go to “Finder > Applications”. This brings up the list of every application installed on your Mac.
2. Now look for an app named Weknow, or other similarly suspicious names like “MPlayerX”, “NicePlayer”. Right-click on them, and click on “Move to Trash”.
3. Also, delete any Weknow-related file from every part of your system. Click “Go > Go to Folder” or press the “Shift + Cmd + G” keys, and then key in “/Library/LaunchAgents”, and then click go. Next, search for files with similar suspicious names. The following is a compilation of such names gathered around the web from victims:
“installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist”. Some other names you should look for Genieo, Inkeeper, InstallMac, CleanYourMac, MacKeeper, SoftwareUpdater, MplayerX, NicePlayer, installmac.AppRemoval.plist”, “myppes.download.plist”, “mykotlerino.ltvbit.plist”, “kuklorest.update.plist, com.aoudad.net-preferences.plist”, “com.myppes.net-preferences.plist”, “com.kuklorest.net-preferences.plist”, “com.avickUpd.plist”.
4. Now, dump everything related to these files in your Trash folder.
Also, repeat the same for “/Library/Application Support” and “/Library/LaunchDaemons”.
5. Next, open your Trash from your dock, and click on “Empty Trash”. By doing so you banish the malicious apps and their folders off your hard-drive for good.
6. Also, ensure that you reverse any group policy settings the malicious attack might have left behind as a Trojan horse to let in the virus after it’s been booted from your hard-drive. Open “System Preferences”, and then select “Profiles”. On the next page, look for a list with an item “AdminPrefs”, click on it, and then tap the remove (-) button in the bottom left corner of your screen.
Method 2: Remove Weknow.ac from your Safari, Chrome, or Firefox
If you couldn’t make a clean sweep and some of the malicious files are still lurking around in your system, you can go down to the individual apps directly to root out the virus.
To stamp out the virus from your Safari,
1. Open the Safari menu, and then select the “Preference” tab.
2. Now, check on the homepage field under the “General” tab on the “Preference” window, and if it is set to WeKnow.ac, change it back to your preferred homepage.
3. Next, open the “Extensions” tab. This brings up a list of every extension installed on your Safari. Now, look for and take down any WeKnow-related extensions. Simply navigate to each one of them and click “Uninstall”.
The following is a compilation of names of malicious extensions related to the Weknow virus:
MacSaver, MacVX (and variants like MacVaX), MacCaptain, MacPriceCut, SaveOnMac, Mac Global Deals or MacDeals, MacSter, MacXcoupon, Shop Brain, SShoP Braaiin, PalMall, MacShop, MacSmart, News Ticker Remover, Shopper Helper Pro, Photo Zoom, Best YouTube Downloader, ArcadeYum, Extended protection, Video download helper, FlashFree or GoldenBoy.
For Chrome browsers, enter the following command lines in Terminal to revert any policy changes that keep your browser infested.
1. Go to “Utilities > Terminal”, and then key in the following commands, tapping your “Enter” key, after each line:
defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string “https://www.google.com/”
defaults write com.google.Chrome HomepageLocation -string “https://www.google.com/”
defaults delete com.google.Chrome DefaultSearchProviderSearchURL
defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
defaults delete com.google.Chrome DefaultSearchProviderName
After that, restart your Chrome.
Learn more about PDFelement for Mac >>
Free Download or Buy PDFelement right now!
Free Download or Buy PDFelement right now!
Buy PDFelement right now!
Buy PDFelement right now!
Audrey Goodwin
chief Editor
Comment(s)