Forum

Browser question....  

  RSS

mrstucci
(@mrstucci)
Eminent Member
Joined: 1 year ago
Posts: 33
December 18, 2018 3:50 EDT PM  

Hi all! I am using Chrome right now as my preferred browser but I also use Safari. I am running Mojave on my 2014 MBP.

I know not use to MacKeeper but somehow on both browsers this page comes up (see screenshot). I can't remember the name for this start page but I don't want it to come up when I click on the plus button to add another page on Chrome.

How do I get rid of all traces of this? Both browsers were kind of hijacked by this webpage and it wasn't easy to get rid of it but I thought I had gotten rid of it but it still comes up on Chrome anyway.

I am sorry I can't remember the name of the site that has this search page. I do use the web page Start.me to organize my bookmarks-is that what is causing this?

Thank you for the help. Merry Christmas! Judy

Screen Shot 2018 12 18 at 3.41.33 PM


Quote
Ben Rosenthal
(@earthsaver)
Trusted Member
Joined: 11 months ago
Posts: 76
December 27, 2018 12:10 EDT PM  

I would look for any malicious extensions installed in Chrome and otherwise just change your homepage.


ReplyQuote
mrstucci
(@mrstucci)
Eminent Member
Joined: 1 year ago
Posts: 33
January 7, 2019 3:47 EDT PM  

Hi Ben! Thank you for replying. I deleted Startpage and now have my bookmarks like I had them before. Thanks! Judy


ReplyQuote
Ben Rosenthal
(@earthsaver)
Trusted Member
Joined: 11 months ago
Posts: 76
January 7, 2019 11:01 EDT PM  

You may also have contracted some malware anyway. It would be wise to scan with Malwarebytes to be sure.


ReplyQuote
Graham McKay
(@kiwigraham)
Reputable Member
Joined: 3 years ago
Posts: 297
January 8, 2019 7:41 EDT AM  

MalwareBytes AntiMalware is certainly good for tracking down & disinfecting the rogue extensions. I have found however that it doesn't necessarily clean up the config settings in the browsers for a) search engine, b) home page, c) new page/tab. So it's worth double checking browser preferences/settings for those to help prevent immediate reinfection.


ReplyQuote
mrstucci
(@mrstucci)
Eminent Member
Joined: 1 year ago
Posts: 33
January 8, 2019 4:06 EDT PM  

I have MalwareBytes. And thank you for the tip, Graham McKay!


ReplyQuote
mrstucci
(@mrstucci)
Eminent Member
Joined: 1 year ago
Posts: 33
January 9, 2019 5:13 EDT PM  

I thought I'd post an update to my issue. This all started when I got the weknow.ac virus and my original post was a result of that virus. I got rid of most of it but still had one lingering issue-in Chrome when I would click on the + sign to add another tab up would pop the weknow.ac search box. I wanted to get rid of that and found a video on YouTube that outlined how to get rid of it! It worked. I was VERY hesitant to try it because it involved the terminal but I took the plunge and followed the instructions and I can now add a tab without the weknow.ac search box and NO MacKeeper ad!!!

I thought I would post the instructions here in case anyone else gets this ugly virus. I found a posting on the Apple Discussion forum and here is the instructions. It's also on YouTube.

Sep 25, 2018 10:59 PM in response to udayfromwalnut

My mom had this virus and was unable to remove it. I was helping her and tried everything I could, plus she spoke with three Level 2 Apple techs and in the end, they could not help, but FINALLY, these instructions solved the issue. This was posted by Skanson on another post. I changed around the instructions just a bit to make them more clear. If you have tried the other stuff and cannot remove the virus try this. It has worked for me and others.

"weknow.ac" changes a group of Chrome policies so as to set a new default homepage, new tab behavior, etc. You can see your current Chrome policies by typing chrome://policy/ into your URL bar. If you're infected, it should be very obvious as the half-dozen or so policies changed by weknow will be displayed.

Use the command line to delete / modify the affected policies. You do this by opening up "Terminal" and copy and paste each of the following entries below. I did each one at a time. I copy and pasted the first line and then hit enter and then went to the next until I had finished all 6 below:

defaults write com.google.Chrome HomepageIsNewTabPage -bool false

defaults write com.google.Chrome NewTabPageLocation -string " https://www.google.com/ "

defaults write com.google.Chrome HomepageLocation -string " https://www.google.com/ "

defaults delete com.google.Chrome DefaultSearchProviderSearchURL

defaults delete com.google.Chrome DefaultSearchProviderNewTabURL

defaults delete com.google.Chrome DefaultSearchProviderName

Quit Chome and restart it and voila the virus will be gone. I tried everything and 3 phone calls with Apple and this was the only thing that worked.


ReplyQuote
Graham McKay
(@kiwigraham)
Reputable Member
Joined: 3 years ago
Posts: 297
January 9, 2019 7:13 EDT PM  

Thanks for the update Judy - interesting to know these things. I'm now curious though about whether the built-in "Reset Settings" option for Google Chrome would have fixed this - because that is what it is designed for.

Almost tempted to install it myself to test!

PS. Technically speaking this is not a "virus" because it doesn't self propagate to other machines. It falls into a class that is more commonly called "malware".


ReplyQuote
mrstucci
(@mrstucci)
Eminent Member
Joined: 1 year ago
Posts: 33
January 9, 2019 7:51 EDT PM  

Ha! You are 'almost' tempted to install it???!!! Hmmmm...... I guess I'll never know if the reset Chrome settings would remove it or not. I hope to never do that again! I had it on Safari also but it wasn't as hard to remove as the Chrome one. It was interesting to read people's comments on YouTube about the fix... Most said it worked and were very thankful that the fix was fairly easy. There were some where it didn't fix the issue. I forget what they had to do to get rid of it but I think they did. Good riddance to BAD, real bad, rubbish! Thanks for the explanation of virus vs malware. I get those confused. I just know that they are bad. lol


ReplyQuote
Share: