Skip to content

Instantly share code, notes, and snippets.

@sunapi386
Last active September 7, 2019 21:57
Show Gist options
  • Select an option

  • Save sunapi386/28dab29e6a04841a1f92bd8ff1d51431 to your computer and use it in GitHub Desktop.

Select an option

Save sunapi386/28dab29e6a04841a1f92bd8ff1d51431 to your computer and use it in GitHub Desktop.
Remove the WeKnow.ac Chrome newtab hijack key in defaults

Remove WeKnow.ac hijack Google Chrome newtab

defaults read com.google.Chrome

{
DefaultSearchProviderEnabled = 1;
HomepageIsNewTabPage = 0;
HomepageLocation = "https://www.google.com/";
ILMediaBrowserAudioSplitViewPosition = 140;
ILMediaBrowserExpandedGroups1 = (
"com.apple.Photos.Photos",
"com.apple.Photos.TopLevelAlbums"
);
ILMediaBrowserImageSplitViewPosition = 106;
ILMediaBrowserMediaType = 1;
ILMediaBrowserSelectedGroup0 = "com.apple.iTunes.7214E01B107D3EE1";
ILMediaBrowserSelectedGroup1 = "com.apple.Photos.com.apple.Photos.SharedGroup";
ILMediaBrowserSelectedGroupIndex0 = 13;
ILMediaBrowserSelectedGroupIndex1 = 5;
KeychainReauthorizeInAppSpring2017Success = 1;
LastRunAppBundlePath = "/Applications/Google Chrome.app";
NSNavLastRootDirectory = "~/Library/Mobile Documents/com~apple~CloudDocs/Sophie";
NSNavPanelExpandedSizeForOpenMode = "{1436, 816}";
NSNavPanelExpandedSizeForSaveMode = "{712, 594}";
NSNavPanelExpandedStateForSaveMode = 1;
NSNavPanelMediaBrowserTypeForOpenModeKey = 1;
"NSTableView Columns AudioTable" = (
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 0e417564 696f5461 626c654e 616d6586>,
224,
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 10417564 696f5461 626c6541 72746973 7486>,
173,
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 0e417564 696f5461 626c6554 696d6586>,
142
);
"NSTableView Hidden Columns AudioTable" = (
);
"NSTableView Sort Ordering AudioTable" = (
);
NewTabPageLocation = "https://www.google.com/";
}
{
DefaultSearchProviderEnabled = 1;
DefaultSearchProviderName = WeKnow;
DefaultSearchProviderNewTabURL = "https://www.weknow.ac/search/?asset=hp&wtguid=27389110730260728&wtsrc=4583&wtdt=092118&wtbr=1&wtpl=10.11.6.0&v=6.0";
DefaultSearchProviderSearchURL = "https://www.weknow.ac/search/?asset=ds&wtguid=27389110730260728&wtsrc=4583&wtdt=092118&wtbr=1&wtpl=10.11.6.0&v=6.0&q={searchTerms}";
HomepageIsNewTabPage = 1;
HomepageLocation = "https://www.weknow.ac/search/?asset=hp&wtguid=27389110730260728&wtsrc=4583&wtdt=092118&wtbr=1&wtpl=10.11.6.0&v=6.0";
ILMediaBrowserAudioSplitViewPosition = 140;
ILMediaBrowserExpandedGroups1 = (
"com.apple.Photos.Photos",
"com.apple.Photos.TopLevelAlbums"
);
ILMediaBrowserImageSplitViewPosition = 106;
ILMediaBrowserMediaType = 1;
ILMediaBrowserSelectedGroup0 = "com.apple.iTunes.7214E01B107D3EE1";
ILMediaBrowserSelectedGroup1 = "com.apple.Photos.com.apple.Photos.SharedGroup";
ILMediaBrowserSelectedGroupIndex0 = 13;
ILMediaBrowserSelectedGroupIndex1 = 5;
KeychainReauthorizeInAppSpring2017Success = 1;
LastRunAppBundlePath = "/Applications/Google Chrome.app";
NSNavLastRootDirectory = "~/Library/Mobile Documents/com~apple~CloudDocs/Sophie";
NSNavPanelExpandedSizeForOpenMode = "{1436, 816}";
NSNavPanelExpandedSizeForSaveMode = "{712, 594}";
NSNavPanelExpandedStateForSaveMode = 1;
NSNavPanelMediaBrowserTypeForOpenModeKey = 1;
"NSTableView Columns AudioTable" = (
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 0e417564 696f5461 626c654e 616d6586>,
224,
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 10417564 696f5461 626c6541 72746973 7486>,
173,
<040b7374 7265616d 74797065 6481e803 84014084 8484084e 53537472 696e6701 8484084e 534f626a 65637400 8584012b 0e417564 696f5461 626c6554 696d6586>,
142
);
"NSTableView Hidden Columns AudioTable" = (
);
"NSTableView Sort Ordering AudioTable" = (
);
NewTabPageLocation = "https://www.weknow.ac/search/?asset=hp&wtguid=27389110730260728&wtsrc=4583&wtdt=092118&wtbr=1&wtpl=10.11.6.0&v=6.0";
}
.
./.MMUpdater
./.MMUpdater/MMUpdater
./.MMUpdater/MMUpdater/config.json
./.MyShopcoupon
./.MyShopcoupon/MyShopcoupon
./.MyShopcoupon/MyShopcoupon/based
./.MyShopcoupon/MyShopcoupon/MyShopcoupon
./.MyShopcoupon/MyShopcoupon/MyShopcoupon.config
./AnySearch-2.safariextz
./com.macmechanic.mmhlpr.plist
./com.MyMacUpdater.agent.plist
./com.MyShopcoupon.agent.plist
./Mac Mechanic
./Mac Mechanic/msets.plist
./Mac Mechanic/rlist.plist
./Mac Mechanic_2_
./Mac Mechanic_2_/pmmcarams.plist
./Mac Mechanic_2_/smmcettings.plist
./mmc
./mmc/com.macmechanic.mmcuninstall.plist
./mmc/com.macmechanic.mmhlpr.plist
./mmc/infAdlt
./mmc/mmcuninstall.app
./mmc/mmcuninstall.app/Contents
./mmc/mmcuninstall.app/Contents/_CodeSignature
./mmc/mmcuninstall.app/Contents/_CodeSignature/CodeResources
./mmc/mmcuninstall.app/Contents/Info.plist
./mmc/mmcuninstall.app/Contents/MacOS
./mmc/mmcuninstall.app/Contents/MacOS/mmcuninstall
./mmc/mmcuninstall.app/Contents/PkgInfo
./mmc/mmcuninstall.app/Contents/Resources
./mmc/mmcuninstall.app/Contents/Resources/Base.lproj
./mmc/mmcuninstall.app/Contents/Resources/Base.lproj/MainMenu.nib
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/_CodeSignature
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/_CodeSignature/CodeResources
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/Info.plist
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/MacOS
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/MacOS/mmcuninstallhelper
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/PkgInfo
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/Resources
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/Resources/Base.lproj
./mmc/mmcuninstall.app/Contents/Resources/mmcuninstallhelper.app/Contents/Resources/Base.lproj/MainMenu.nib
./mmc/mmhlpr.app
./mmc/mmhlpr.app/Contents
./mmc/mmhlpr.app/Contents/_CodeSignature
./mmc/mmhlpr.app/Contents/_CodeSignature/CodeResources
./mmc/mmhlpr.app/Contents/Info.plist
./mmc/mmhlpr.app/Contents/MacOS
./mmc/mmhlpr.app/Contents/MacOS/mmhlpr
./mmc/mmhlpr.app/Contents/PkgInfo
./mmc/mmhlpr.app/Contents/Resources
./mmc/mmhlpr.app/Contents/Resources/alert_logo.png
./mmc/mmhlpr.app/Contents/Resources/Base.lproj
./mmc/mmhlpr.app/Contents/Resources/Base.lproj/MainMenu.nib
./mmc/mmhlpr.app/Contents/Resources/BG.png
./mmc/mmhlpr.app/Contents/Resources/btn_left_dwn.png
./mmc/mmhlpr.app/Contents/Resources/btn_left_hov.png
./mmc/mmhlpr.app/Contents/Resources/btn_left_nor.png
./mmc/mmhlpr.app/Contents/Resources/btn_mid_dwn.png
./mmc/mmhlpr.app/Contents/Resources/btn_mid_hov.png
./mmc/mmhlpr.app/Contents/Resources/btn_mid_nor.png
./mmc/mmhlpr.app/Contents/Resources/btn_right_dwn.png
./mmc/mmhlpr.app/Contents/Resources/btn_right_hov.png
./mmc/mmhlpr.app/Contents/Resources/btn_right_nor.png
./mmc/mmhlpr.app/Contents/Resources/call_number_tooltip.png
./mmc/mmhlpr.app/Contents/Resources/close_btn.png
./mmc/mmhlpr.app/Contents/Resources/DisableSelection.js
./mmc/mmhlpr.app/Contents/Resources/Discount_Popup.htm
./mmc/mmhlpr.app/Contents/Resources/error_popup.htm
./mmc/mmhlpr.app/Contents/Resources/frame_top_left.png
./mmc/mmhlpr.app/Contents/Resources/frame_top_mid.png
./mmc/mmhlpr.app/Contents/Resources/frame_top_right.png
./mmc/mmhlpr.app/Contents/Resources/Girl.png
./mmc/mmhlpr.app/Contents/Resources/img_txt.png
./mmc/mmhlpr.app/Contents/Resources/infs
./mmc/mmhlpr.app/Contents/Resources/jquery.min.js
./mmc/mmhlpr.app/Contents/Resources/lang_da.plist
./mmc/mmhlpr.app/Contents/Resources/lang_de.plist
./mmc/mmhlpr.app/Contents/Resources/lang_en.plist
./mmc/mmhlpr.app/Contents/Resources/lang_es.plist
./mmc/mmhlpr.app/Contents/Resources/lang_fi.plist
./mmc/mmhlpr.app/Contents/Resources/lang_fr.plist
./mmc/mmhlpr.app/Contents/Resources/lang_it.plist
./mmc/mmhlpr.app/Contents/Resources/lang_ja.plist
./mmc/mmhlpr.app/Contents/Resources/lang_nl.plist
./mmc/mmhlpr.app/Contents/Resources/lang_no.plist
./mmc/mmhlpr.app/Contents/Resources/lang_pt-br.plist
./mmc/mmhlpr.app/Contents/Resources/lang_ru.plist
./mmc/mmhlpr.app/Contents/Resources/lang_sv.plist
./mmc/mmhlpr.app/Contents/Resources/left.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_da.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_de.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_en.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_es.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_fi.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_fr.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_it.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_ja.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_nl.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_no.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_pt-br.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_ru.png
./mmc/mmhlpr.app/Contents/Resources/Limited-Time-Offer_sv.png
./mmc/mmhlpr.app/Contents/Resources/mmupd.app
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/_CodeSignature
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/_CodeSignature/CodeResources
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/Info.plist
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/MacOS
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/MacOS/mmupd
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/PkgInfo
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/Resources
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/Resources/Base.lproj
./mmc/mmhlpr.app/Contents/Resources/mmupd.app/Contents/Resources/Base.lproj/MainMenu.nib
./mmc/mmhlpr.app/Contents/Resources/nag_left_blue_btn.png
./mmc/mmhlpr.app/Contents/Resources/nag_mid_blue_btn.png
./mmc/mmhlpr.app/Contents/Resources/nag_right_blue_btn.png
./mmc/mmhlpr.app/Contents/Resources/openapp_popup.htm
./mmc/mmhlpr.app/Contents/Resources/owl.carousel.min.css
./mmc/mmhlpr.app/Contents/Resources/owl.carousel.min.js
./mmc/mmhlpr.app/Contents/Resources/Phone.png
./mmc/mmhlpr.app/Contents/Resources/popup_btn_left.png
./mmc/mmhlpr.app/Contents/Resources/popup_btn_mid.png
./mmc/mmhlpr.app/Contents/Resources/popup_btn_right.png
./mmc/mmhlpr.app/Contents/Resources/Popup_Duplicate_icon.png
./mmc/mmhlpr.app/Contents/Resources/Popup_infection_icon.png
./mmc/mmhlpr.app/Contents/Resources/Popup_Largefiles_icon.png
./mmc/mmhlpr.app/Contents/Resources/Popup_login_icon.png
./mmc/mmhlpr.app/Contents/Resources/Popup_onetouch_icon.png
./mmc/mmhlpr.app/Contents/Resources/right.png
./mmc/mmhlpr.app/Contents/Resources/StyleSheet.css
./mmc/mmhlpr.app/Contents/Resources/StyleSheetPhotos.css
./mmc/mmhlpr.app/Contents/Resources/system_notification.png
./mmc/mmhlpr.app/Contents/Resources/Timer_BG.png
./mmc/mmhlpr.app/Contents/Resources/Timer_BG_Large.png
./mmc/mmhlpr.app/Contents/Resources/uninstall.htm
./MyMacUpdater
./MyMacUpdater/enc_file
./MyMacUpdater/MyMacUpdater
./MyShopcoupon+.safariextz
defaults write com.google.Chrome HomepageIsNewTabPage -bool false
defaults write com.google.Chrome NewTabPageLocation -string "https://www.google.com/"
defaults write com.google.Chrome HomepageLocation -string "https://www.google.com/"
defaults delete com.google.Chrome DefaultSearchProviderSearchURL
defaults delete com.google.Chrome DefaultSearchProviderNewTabURL
defaults delete com.google.Chrome DefaultSearchProviderName
@AmyB-pixel
Copy link

Well, There are several basic guidelines that you can follow to remove it from your machine.

Step 1. Ending Process Running Under The “Activity Monitor”
Step 2. Remove Weknow.ac virus Malicious Apps From Mac OS
Step 3. Remove Weknow.ac virus Apps From Auto-Startup
Step 4. Remove Weknow.ac virus Daemons And Agents From Mac’s Startup
Step 5. Uninstall Weknow.ac virus Or Unwanted/Suspicious Extensions From If Added Browsers
Step6. Restart the browser.

You can find step by step guidelines here: remove weknow.ac

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment