1. Remove the weknow.ac profile. Here is how:

    On your Mac, open System Preferences (click the System Preferences icon in the dock)
    Click Profiles
    Select AdminPrefs
    Delete this profile (AdminPrefs) by pressing the minus icon.
    Now delete search engine settings:
    Chrome: chrome://settings/searchEngines
    Safari: Safari > Preferences > Search
  2. Delete weknow.ac. Remove anything weknow.ac related. Remove anything suspicious apps to the Trash folder. Look for recently added apps.

    Open the Applications folder
    Delete Weknow.ac or Weknow.ac.app also look for “MPlayerX”,“NicePlayer”. Look for suspicious apps.
    Empty Trash
  3. Remove the weknow addon

    Safari: Safari > Preferences > Extensions > Locate the weknow.ac extension and remove it
    Google Chrome: Go to chrome://extensions/ and find the weknow.ac addon and remove it.
    Firefox: Go to about:addons and remove the addon.
  4. Delete weknow files:
    Go > Go to Folder (or press Shift + Cmd + G)
    Enter /Library/LaunchAgents and click Go

    Look for suspicious files such as
    installmac.AppRemoval.plist, myppes.download.plist, mykotlerino.ltvbit.plist, kuklorest.update.plist.

    Some other names you should look for:
    Genieo, Inkeeper, InstallMac, CleanYourMac, MacKeeper, SoftwareUpdater, MplayerX, NicePlayer, installmac.AppRemoval.plist, myppes.download.plist, mykotlerino.ltvbit.plist, kuklorest.update.plist, com.aoudad.net-preferences.plist, com.myppes.net-preferences.plist, com.kuklorest.net-preferences.plist, com.avickUpd.plist.

    If you see any of them, drag them to the Trash folder and then empty Trash.

And now repeat the same process on the following folders:

/Library/Application Support

/Library/LaunchDaemons

5-If your browser is Chrome, follow the steps below to change some Chrome policies, if you are still having the problem:


Open the Terminal app (Go > Utilities > Terminal or press Command+Space and search Terminal)

Enter the commands below, hit Enter after each

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string “https://www.google.com/”

defaults write com.google.Chrome HomepageLocation -string “https://www.google.com/”

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Restart Chrome

Please note that the developers behind weknow.ac are very sneaky and they will likely further develop this malware so this means that those tips may not work in near future. We will try to keep updating this posts.


You may also want to install and run MalwareBytes.