Jump to content

WeKnow.ac stuck in Home page of Safari / Can't turn on real time protection


Recommended Posts

Client has a Mac and downloaded a fake Adobe Flash update. I have removed all remnants except the home page in Safari. It can be changed but then immediately switches back to weknow.ac. This does not happen in a new profile. Also, when installing Malwarebytes, I cannot change the system preferences page to allow Malwarebytes access to turn on real time protection.

Removal steps so far: 

Install Malwarebytes - cannot do final step of updating System Preferences. Clicking "allow" does nothing
Removed 2 AdminPref profiles
Removed extensions from Safari and Chrome
Removed any rogue applications
Reset Safari
 

 

Vaughn.JPG

Link to post
Share on other sites

  • Staff
On 10/27/2018 at 8:28 AM, lrthames said:

I have removed all remnants except the home page in Safari. It can be changed but then immediately switches back to weknow.ac.

Did you follow the instructions under "If Safari's home page is stuck" on the topic that Al referred you to?

Quote

This does not happen in a new profile. Also, when installing Malwarebytes, I cannot change the system preferences page to allow Malwarebytes access to turn on real time protection. [...] Install Malwarebytes - cannot do final step of updating System Preferences. Clicking "allow" does nothing

Since you mention you're helping a client, I'm guessing that you're trying to click "Allow" over some kind of screen sharing. If that is the case, note that macOS does not allow that, and will ignore clicks on that button via screen sharing. See:

https://support.malwarebytes.com/docs/DOC-2632

Link to post
Share on other sites

Yes, I did follow the instructions under "If Safari's home page is stuck." I can change the home page but when I go back to screen, it has immediately changed back. 

I did not know that the Allow button could not be clicked over Teamviewer. Will have the client click it next time. 

Still, Malwarebytes is not totally removing the malware. 

 

Link to post
Share on other sites

21 minutes ago, lrthames said:

Yes, I did follow the instructions under "If Safari's home page is stuck." I can change the home page but when I go back to screen, it has immediately changed back.

So after changing the homepage you switched to another tab without pressing return, then confirmed changing the homepage and when you returned to the General tab it changed back? Perhaps that's something else that cannot be successfully done with TeamViewer so ask the client to take that step themselves.

It's not clear that Malwarebytes has not totally removed the malware if your only indication of it is that you have not been able to change the settings. Do you have any other evidence?

Link to post
Share on other sites

Yes, I followed those instructions exactly. 

I had the client try to change the home page, switch to another tab before pressing return and then confirm the home page change. When he confirms the home page change, it is switched back to weknow.ac.... 

 

I posted to find some other options. I have successfully removed this malware from Chrome by following the instructions posted in the forum so I am familiar with this malware. It's just the last step of changing the home page that isn't working. Are there other options? If not, I will have to create a new profile for this client. 

I thought I would get some other options in this forum. I rely on MWB to protect Macs. 

Link to post
Share on other sites

I suspect this may be yet another new twist and the staff will need some additional diagnostics from your client that should not be posted here. In that case they will need you or the client to open a Support ticket.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.