Posted on

Malware WeKnow on Mac

I spent some time cleaning friends Macbook from weKnow malware and wanted to share this handy tips with you, should you need it.

Basically, it hijacks local Chrome policy and you need to remove/edit them via terminal/cmd line.

  1. cmd + spacebar (search for “terminal” app)
  2. use following commands:
    1. defaults delete <nameOfThePolicy>
    2. defaults write <naemOfThePolicy> -string “
    3. example:
      defaults write HomepageLocation -string “

Do not install “mac cleaners” or similar. If anything, just use MalwareBytes. Check all extensions and default search engines (Safari,Chrome,Firefox) and remove unknown/unwanted extensions and apps from Mac. There should not be any extra profiles, admin accounts or login items, so clear that too.

additional resources: