All Posts by Date or last 15, 30, 90 or 180 days.
also by Lloyd: diglloyd.com photography and WindInMyFace.com
Thank you for purchasing through links and ads on this site.
OWC / MacSales.com...
diglloyd Deal Finder...
Buy other stuff at Amazon.com...
Capacities up to 56TB and speeds up to 1527MB/s
Handpicked deals...
$2499 $1399
SAVE $1100

$400 $280
SAVE $120

$1798 $1598
SAVE $200

$3297 $2797
SAVE $500

$3397 $2797
SAVE $600

$150 $90
SAVE $60

$1398 $898
SAVE $500

$3698 $2998
SAVE $700

$2998 $2498
SAVE $500

$1799 $1329
SAVE $470

$1999 $1199
SAVE $800

$2299 $1599
SAVE $700

$2399 $2049
SAVE $350

$2799 $2399
SAVE $400

$2799 $1899
SAVE $900

$1199 $920
SAVE $279

$997 $897
SAVE $100

$2099 $1699
SAVE $400

$1999 $1369
SAVE $630

$1999 $1599
SAVE $400

$1349 $949
SAVE $400

$4499 $3099
SAVE $1400

$4499 $3999
SAVE $500

$329 $329
SAVE $0

$1499 $1029
SAVE $470

$1499 $1289
SAVE $210

$2199 $1999
SAVE $200

$3399 $2199
SAVE $1200

Browser Hijacking: the WeKnow.ac Malware

I was helping a client with a few issues on her Mac, when I noticed odd behavior in the web browser on her machine. In the space of a few moments, I saw:

  • An “update your Adobe Flash” install popup window (NEVER do this!!!!)
  • Another popup window trying to sell software by scumbags (MacKeeper semi-malware).
  • Two folders containing shell scripts that wrote to /tmp, enable execute permissions and executed some script.
  • Safari was hijacked in a way that prevented setting any home page, and the default page was set to the web site "weknow.ac" (don’t visit it!).

From what I could tell, the problem started from her having clicked on an “Update Flash” prompt that came from an infected website.

Her machine was infected with the WeKnow.ac malware. It does all sort of annoying things but the main thing is that much worse things are likely to result from it via information stealing, redirection to dangerous web sites, etc. This page at macpaw.com has a good how-to remove WeKnow.ac without frequently trying to sell you new software to fix it.

I was able to clean up the mess, but most people will have trouble doing so. There are lots of "how to" cleanup pages, most of which push anti-virus software (which MPG is at best ambivalent on and does not recommend). Don’t panic and find an expert to help you (does Apple help with such stuff?) or research fixit software and the company selling it before buying anything.

Downloading software that purports to remove WeKnow.ac is itself a risk—how would you know that it itself is not malware?! Certainly do not click through any link on a fixit page. Research it separately if you want to use other software to fix it.

Question for Apple: what is wrong with macOS that it allows this kind of well-known longstanding malware to infect a computer?

View all handpicked deals...

Samsung 2TB T5 Portable Solid-State Drive (Black)
$400 $280
SAVE $120

diglloyd.com | Terms of Use | PRIVACY POLICY
Contact | About Lloyd Chambers | Consulting | Photo Tours
Mailing Lists | RSS Feeds | Twitter
Copyright © 2019 diglloyd Inc, all rights reserved.
Display info: __RETINA_INFO_STATUS__